45 ms·

NHS rejects Apple-Google coronavirus app plan

276 points by jfk13 7y ago

samwillis 7y ago
Could someone with a little more understanding of the frameworks and restrictions please explain what this means for locking iPhones while the app is tracking, and using Bluetooth devices like AirPods? Does it prevent them from working and stop you locking your device? Also not a good look (edit: for the uk) on the day Germany swapped from using this style app to a Google-Apple backed system. If the true reason for the centralised matching is that they want to have a better oversight of the spread could they not do that with the Google-Apple system by having it (optionally) phone home to a server when there is a match?
- dTal 7y ago
  On the contrary, it's a very good look for Germany and a terrible blow for privacy-conscious UK denizens. I hope this is reversed somehow. The Apple/Google system is zero-knowledge. The NHS system sounds like a privacy disaster. >The tech giants believe their effort provides more privacy, as it limits the ability of either the authorities or a hacker to use the computer server logs to track specific individuals and identify their social interactions. >But NHSX believes a centralised system will give it more insight into Covid-19's spread, and therefore how to evolve the app accordingly.
  - samwillis 7y ago
    That is exactly what I meant, bad look for the UK! Fully support Germany going with the Google-Apple backed solution. I hope we follow Germany and reverse this decision!
  - temac 7y ago
    I certainly prefer the Apple/Google/DP-3T approaches but they are certainly not "zero-knowledge". They are not even strictly "less-knowledge" than PEPP-PT if you trust the central server (but arguably not in ways that can have strong practical consequences, at least not more than the situation in the other direction).
- asperous 7y ago
  Bluetooth allows 7 devices connected at once, but actually the spec uses bluetooth low energy which is a special low-bandwidth, low-energy mode. You can lock your device. [1] It sounds to me like NHS wants location data logs of everyone in the country. You can measure contacts and spread that way but it's a privacy disaster. The decentralized approach tells authorities and users if they've been near someone who later on marked themselves as infected. The data is much more limited but still accomplishes the main purpose. [1] https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-BluetoothSpecificationv1.1.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu...
  - deleted 7y ago
    [deleted]
  - SlowRobotAhead 7y ago
    There is no BLE hard limit to device connections here at all. This whole system works on advertising packets. Beacons are non-connectable, aptly named. Your phone can be connected n number of BLE devices and also appear to be n number of peripherals itself. No hard limit that I can think of, usually just depends on the stack. But this isn’t that. This is your phone pumping out <CONTACT: I am 7733> and listening for other people’s phones to say <CONTACT: I am xxxx>. I can think of no stack that has a connection limit and after that stops allowing for reception of advertising packets.
    - nickff 7y ago
      I believe that Bluetooth units are limited to 1 central (master/server/upstream) and 7 peripheral (slave/client/downstream) connections. Mesh networks can be made up of up to 255 units. Advertising is different, and not limited, but it is not classified as a 'connection'. My understanding is that advertisements are simply broadcast, so there is no bidirectional communication.
      - SlowRobotAhead 7y ago
        I thought I had seen multi master stacks. For peripherals I know I’ve seen 20 concurrent this n the Nordic S132, definitely not 8 as any BLE spec limitation. Yes. That’s what I said, beacons are advertising packeting with the connectable flag cleared. You misunderstood, there is no bidirectional in my post. Just two transmitters and two receivers.
smileypete 7y ago
Wonder if the Apple Google plan involved keeping the data within UK borders at all time? Trouble is, as soon as the data leaves these shores, it falls under the usual Five Eyes spying loopholes. I had one of those Youtube surveys 'Do you trust Apple, Google etc with your health data' - Not very much thankyou!
- phreeza 7y ago
  My understanding is that the data stays on the users device, except when they register themselves as infected.
  - mcintyre1994 7y ago
    And further, I don't think Apple/Google intend to provide the database that infected people push their data into - my understanding was that would be per-app and in this case controlled by NHSX.
- strictnein 7y ago
  You understand the UK is part of the Five Eyes, right? And with this plan the NHS will just have access to all the data? So the thing you are fearful of is actually happening because the NHS plan is the route they are choosing.
  - anpago 7y ago
    With GCHQ advising on the App..
- izacus 7y ago
  The Apple/Google plan just exposes an API to on-device data. There still needs to be an app that retrieves that data and uploads it somewhere (supposed to be implemented by the governments / health officials). In that way it's similar like e.g. location APIs work - the device handles the resolution and data processing for you, but there still needs to be an app to retrieve it and do something with it. Hence your original question isn't applicable in context of APIs they've designed.
rezeroed 7y ago
I'd sooner acquire the virus than put theses things on my phone.
- TwoHeadedBeast 7y ago
  It's not all about you, it's about trying to stop the spread of the virus to people who might be more vulnerable than you are.
  - rezeroed 7y ago
    They should isolate.
    - andybak 7y ago
      Please don't continue with this.
      - rezeroed 7y ago
        I didn't mean acquire and wander around infecting people, rather acquire and sit around until it's over. HN obviously interpreted it the other way.
        oneeyedpigeon 7y ago
        You said: > [people who might be more vulnerable] should isolate. and now you appear to be saying: > [they should] acquire [the virus] and sit around until it's over That's incredibly bad advice. Now, notice that I'm not going in too hard on you because I'm hoping I've misunderstood what you're saying, but can you clarify it to avoid such confusion, please?
        danpalmer 7y ago
        It's thought that 20-80% are asymptomatic, so the plan to acquire and sit around won't work for a very large number of people. Plus they still have a ~0.1-0.5% rate of fatal complications. Wide error bars on these, but all numbers I've seen reported from studies.
ucarion 7y ago
From the the article: > Germany had been in line with NHSX, but its government announced on Sunday it had switched tack to a "strongly decentralised approach". Today's Stratechery (https://stratechery.com/2020/more-on-apple-and-google-germany-versus-apple-facebooks-surveys/ https://stratechery.com/2020/more-on-apple-and-google-german...): > What is worth noting is why Germany changed their approach: > > Germany as recently as Friday backed a centralized standard called Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT), which would have needed Apple in particular to change the settings on its iPhones. When Apple refused to budge there was no alternative but to change course, said a senior government source. > This is exactly what I was driving at in Coronavirus Clarity: tech companies are the ones setting the rules, not governments.
- cwhiz 7y ago
  I can't read that article without an account but the quotes imply that only Apple was standing in the way of the centralized approach. Did Germany have a centralized contact tracing solution through Android? Is there more context that might imply that Google wasn't playing ball?
  - tssva 7y ago
    iOS has more restrictions than Android regarding Bluetooth use by applications in the background. Germany may have needed Apple to change those restrictions while Android already provided the access they needed.
noodlesUK 7y ago
This is silly. There’s a clearly demonstrable reason why Germany switched tack, and why the UK should too. All of this contact tracing can be done in a privacy preserving way. However, the NHSX development of these tools is led by such industry partners as palantir... We aren’t going to see much regard for privacy from them. Edit: Google and Apple need to get their act together though, and just provide a contact tracing framework as part of the OS that is compatible, and can have data housed in each country where they see fit. It should be optional for people, but it should be part of the OS, and it should just be presented to the countries as ready to go with just a little bit of integration. That way we can force everyone to respect user privacy and not do sketchy contact tracing apps.
- anon102010 7y ago
  I will never touch / install contact tracing if it can be backdoored into global surveilance. Apple has built a reputation for at least trying to preserve some user privacy. Their current proposal keeps it simple, your privacy is preserved and benefits for exposure notification (FAR beyond current horrendous govt efforts in terms of speed of notification etc) are there. They need to get their act together, and ignore folks trying to backdoor their systems.
  - 0xBeefFed 7y ago
    It should be noted that your privacy is not preserved if you test positive and need to upload your Daily Tracing Keys to a server. Your broadcast IDs for an entire day can be linked together, making it easier to de-anonymize you. I understand that they use Daily Tracing Keys to reduce the demand of the backend server, but I think it would be better for user privacy if they either reduced the linkable period from a day to say an hour, or used an unlinkable design.
    - pintxo 7y ago
      In case you test positive, and we actually have the resources to trace your contacts, your privacy will be gone in todays system for sure. As you'll have to provide information about your recent contacts to the authorities performing the contact tracing. At least that's how I understand our local law (Germany). So I don't think its necessarily worse doing it with an App than doing it the old fashioned way. Sure digital traces are always easier to abuse, but then on the other hand, because things get automated, actually less people might get access to your data. Which would be a privacy win. I believe what's even more important than how we design the app, is how we design the legal framework around it. We do need rock solid laws, having enforceable data retention periods, and that limit access to the pare minimum needed. Unfortunately, our track record for the design of such laws has not been too good over the last years.
lorsting 7y ago
These days I stop and read these headlines and articles two or three times to make sure this is not people trolling on the internet or some new SF movie. You people should have lived in communist countries and should have woken up at 5 am to receive half of a bread in exchange for a ticket. And you should watch state TV between 20-22 only. Only after living like this for a decade you are entitled to ask for state supervision like this.
- lstamour 7y ago
  First off, having a cell phone or having friends over with cell phones means, technologically speaking, you can be tracked and overheard by a sufficiently advanced adversary, given reason. That said, I think this is making waves precisely because it is centralized. If you trust Apple, and their decentralized approach, you can opt in. If you live in a country which forces you to scan QR codes, you either need a lot of friends or you can’t easily escape the surveillance. That said, given the ubiquity of police cameras in London and the way they are spreading to other areas currently for automated speed ticketing, it seems likely that we’re on a path to significantly more surveillance digitally in the future. But... let’s not fool ourselves, what your carrier or ISP knows, your government is one court order away, at best, from knowing...
  - SlowRobotAhead 7y ago
    I don’t like this argument. Yes, your phone could be used to get information on you. That does not mean there is then no issue with phones doing contact scanning and recording. You can own a phone, acknowledge the risk, and not want to see that risk expanded recklessly. The privacy systems “SEEM” ok, but any hesitation is rightfully earned. These companies and governments have abused trust and have not earned it back. This is system a road paved with best intentions and should absolutely not be implemented until coivd19 is over and people can think clearly. The hard push right now for it is clearly not wanting to “let a crisis go to waste”.
    - lstamour 7y ago
      I’m not making an argument that there’s no issue with phones doing contact scanning. Rather, I trust Apple, and maybe Google, to do what they say they will do, and I trust that they will be very closely inspected from a security perspective by third-parties to confirm that. I’m not saying that phones should always report your location, but I am saying that they already have that capability. It’s like complaining about cookies when your phone already has a perfectly unique fingerprint due to Chrome’s origin trials, say.
jupp0r 7y ago
This is insane. Why would they risk people not adopting the app due to privacy concerns while it's only effective if a majority of the population uses it? What's the benefit if they can gather better stats with a central approach if it doesn't work because a lot of people aren't installing the app?
- SlowRobotAhead 7y ago
  > due to privacy concerns You immediately answered your own question. This topic seems to be a rorschach test.
- s_dev 7y ago
  > while it's only effective if a majority of the population uses it? 60% is the minimum number the experts are saying must use the app before it's effective.
  - cwhiz 7y ago
    Source? I have heard much higher numbers, as high as 95%.
    - jpollock 7y ago
      If (1-1/R0) of the population is using the app, it should bring the R0 below 1. With covid-19, if the R0 is 3, then being able to track 2/3rds of infections should _hopefully_ bring the R0 below 1. At least that's how I've been reasoning it out.
      - user5994461 7y ago
        The last estimates put R0 around 6.
        chimprich 7y ago
        But do the best estimates? As far as I can tell estimates vary a lot, but an R0 of 6 would be a significant outlier. But the current R value in the UK under the lockdown is estimated to be somewhere between 0.5 and 1. A contact-tracing app doesn't need to be perfect; any reduction in R would allow for either a swifter reduction in cases or a liberalisation of lockdown measures.
figgyc 7y ago
Apple and Google could force otherwise if they just ban the app from their stores. Especially considering that they seem to be using some questionable workarounds to run in the background on iOS, they could chalk it down to policy, but it probably wouldn't be in their best interests since "Apple blocks NHS from releasing contact tracing app" would not be a good headline.
raphaelj 7y ago
That's very bad. Anonymous and (mostly) decentralized contact tracing is definitively possible, and is exactly what the D3P-T and Apple/Google protocols are trying to achieve. Developing a reasonably anonymous contact-tracing app is not that complex at all. I wrote a very simple (but working) app that also implements contact-tracing in a way similar to D3P-T or Apple/Google, and it only took me a few days: https://github.com/RaphaelJ/covid-tracer/blob/master/README.md https://github.com/RaphaelJ/covid-tracer/blob/master/README.... Users will also never opt-in for such apps if they don't at least try to slightly protect privacy.
Angostura 7y ago
Oh dear. I was definitely going to put this on my phone. Now I won’t b
supernova87a 7y ago
I ask an uncomfortable question for debate about this: Many of us probably think ridiculous the people who are jumping to reopen businesses (and states) in the interest of economic activity, at the cost of putting people's lives at risk. Why, on the other hand, is privacy so important versus saving lives if a more effective (but slightly less private) information gathering mechanism could be implemented? How do we judge one not worth the risk, while the other is?
- prh8 7y ago
  It's a great question, but over the last couple weeks, it's clear (from a number of topics) that 95% of HN would rather have completely perfect privacy more than safety. It seems that counter to things like freedom of speech, there are no qualms about infringing upon other humans when it comes to the right to privacy.
  - kstrauser 7y ago
    Yes, that's correct. I can do things like isolate myself and my family to protect ourselves (and others) from things like covid 19, but I can't reach out and make governments and business respect my privacy. In the longer scale, I think you and I are more at risk from loss of privacy than I am from a virus that, while nasty right now, is likely to be over soon.
    - prh8 7y ago
      There's no evidence that it's likely to be over soon, in fact, most suggests the opposite. Also, it's either completely ignorant or just highly asinine to suggest anyone besides yourself is at more risk from loss of privacy than the virus.
- ck425 7y ago
  The harm that a developed surveillance state can do is incredible. See China. We need to balance saving lives from corona with potentially saving lives or quality of lives from privacy abuse. It's a slippery slope argument and those are always hard to discuss as we're discussing potential future abuse. In this case however it's a reasonably safe and effective system vs an pretty unsafe but slightly more efficient system. To my mind there's a clear winner there.
diebeforei485 7y ago
The Apple-Google protocol is designed to reasonably protect their users even in less-free countries. Consider every Middle Eastern country; China (Xinjiang, Tibet etc); India (Kashmir etc); Latin American countries that have cozy relationships with gangs and cartels; Russia; even the USA with ICE and other agencies. Do you really think Apple and Google should be giving information on their users to those governments? They can't possibly say "stronger contact tracing for Canadians, but not for Mexicans" - it has to be one global standard.
- deleted 7y ago
  [deleted]
- deleted 7y ago
  [deleted]
- ENOTTY 7y ago
  > [Apple and Google] can't possibly say "stronger contact tracing for Canadians, but not for Mexicans" - it has to be one global standard. Why not? Apple and Google could just as easily say, "Only countries that meet the standards we set get access to more data." On one hand, it seems like the HN community seems okay with giving Apple and Google the power to set norms on technology policy that apply worldwide (e.g., what level of potential privacy loss is acceptable to combat a pandemic), but on the the other hand we don't trust Apple and Google to know how to distinguish a totalitarian regime from a government that respects its citizens' rights?
  - diebeforei485 7y ago
    It's very hard to make such a distinction in practice, because it comes off as Apple saying that some of their customers' lives are worth more than others.
BlackVanilla 7y ago
It's worth highlighting the differences between the UK and the rest of the world. The NHS is embedded into the UK's culture. Since the start of lockdown, drawings of rainbows are commonly seen in windows with captions like 'Thank you NHS and key workers' and on Thursdays at 8pm, people stand on doorsteps and clap for the NHS. The NHS is very well trusted and this app, if viewed as a creation of NHS (or NHSX) and not 'the government', could still remain successful despite privacy concerns. Unlike other countries, the UK has the opportunity to frame this as an NHS-created app, rather than a state-created app. If they're able to do that, then it wouldn't surprise me that the UK's population takes up the app. Additionally, few people consider data privacy concerns at the best of times. Given the circumstances, I think more people are willing to prioritise public health over privacy concerns.[1] So, they seem to have judged that the richer data trumps the slight reduction in usage. The combination of these factors could be the rationale behind this judgment call. [1] https://www.ft.com/content/1752affb-24dc-4ad9-8503-78f9ce1adca9 https://www.ft.com/content/1752affb-24dc-4ad9-8503-78f9ce1ad... (there's a paywall, so the link below shows a similar poll) [2] Ipsos MORI poll https://www.ipsos.com/sites/default/files/2020-04/coronavirus-covid-19-infographic-ipsos-mori.pdf https://www.ipsos.com/sites/default/files/2020-04/coronaviru...
- 1996 7y ago
  > on Thursdays at 8pm, people stand on doorsteps and clap for the NHS This looks very orwellian. Does it come from a grass root initiative, or was it started by the government?
  - cameronbrown 7y ago
    It's not a requirement or anything, people are clapping voluntarily. Britain doesn't just like the NHS, it really does love the service.
    - TechBro8615 7y ago
      This is quite the generalization, equivalent to saying that Americans love the Democratic Party. A poll in 2019 found that satisfaction with the NHS hit an eleven year low, with 53% of respondents satisfied with services in the year prior. https://www.bbc.co.uk/news/health-47472472 https://www.bbc.co.uk/news/health-47472472
cm2187 7y ago
So basically the NHS wants to make it a surveillance system because they think they will get some interesting data watching every movements. They may be right. But this piece of dirt won't be on my phone.
- chimprich 7y ago
  I'd be happy to install it for the duration of the outbreak. It's not as if I'm doing anything terribly interesting. It doesn't sound like it would collect anywhere near as much personal data as Google, or the government, already does. For the sake of protecting lives and getting out of lockdown quicker to rebuild the economy I'm prepared to sacrifice a little privacy. Edit: I don't particularly care, but there seems to be a systematic approach from some users to voting down posts for expressing honestly held beliefs that a balanced approach can be taken with respect to privacy.
  - jupp0r 7y ago
    The question is why they didn't implement it in a decentralized way that works together with OS primitives implemented by Google and Apple. I would also install it for the duration of the outbreak, if there wasn't any effective alternative. My gripe is that there is an alternative that works 100% as well and they chose to ignore it in favor of universal population surveillance.
    - chimprich 7y ago
      It's a fair question; the answer to that doesn't seem to have been communicated yet. We can speculate as to reasons why: one could be that the authors feel that the decentralised approach is lacking some important feature that could save lives, such as insufficient feedback about how it is being used. Another could be that they feel that they can implement a solution faster than waiting for Google/Apple to finish their platform and then building something on top of it. This leaves open the possibility of changing tack if the new API is superior. Or maybe they're just hedging their bets in case the Google/Apple approach doesn't work or gets pulled. (I'm assuming none of this is a nefarious plot by the government to add to their general surveillance powers. I personally don't think they'd care given the considerable abilities they already reputedly have to track mobiles).
est31 7y ago
I've watched some German TV recently and heard politicians claim that Apple/Google demanded access to the contact tracing data if the government were to get it as well.
hackandtrip 7y ago
Will iOS - iOS Bluetooth communication be ok with those new API? Wasn't a major problem with other frameworks the iOS Bluetooth turning off for battery capacity?
- barbegal 7y ago
  It can work in a limited fashion using iBeacons. These have special status on iPhones allowing them to be received by an app even in the background. But even these are rate limited and each iBeacon can only wake up the app once when it comes into range.
Cantbekhan 7y ago
I don't trust Apple and Google but I trust my government even less. And I also do (cynically) think that Google and Apple already have most of this contact tracing information anyway... I mean I would even trust Facebook more than my govt.
- lowwave 7y ago
  In addition Google and Apple are US companies, and US has worse privacy law than Europe. The future may be each person or entity will self host their own data on a RasberryPi (or better yet BeagleBoard).
  - stevenwliao 7y ago
    We can't expect everyone to secure their own data infrastructure. Billions don't even know how to use a Raspberry Pi.
    - lowwave 7y ago
      Well, perfect time for hackers to just make off the shelf boxes.
    - lowwave 7y ago
      In the end it is all about who owns the data.
      - stevenwliao 7y ago
        There are other concerns- availability, durability, security, privacy (once info leaves the box and goes into some system).
- ENOTTY 7y ago
  > I don't trust Apple and Google but I trust my government even less. That's a really interesting statement. Could you elaborate on your thinking? Under what form of government do you live? Why do you feel Apple or Google is more trustworthy than your government?
cm2187 7y ago
Weren't Google and Apple going to release an official app along their API? It may be that if the NHS app gets enough bad press (which apparently it should), people naturally use Google and Apple's implementation. Even people who are happy to go along the NHS will likely also want to have the Apple/Google app running as well, as they don't know from which of the two "networks" the notification will come from.
- djrogers 7y ago
  No, Google and Apple announced they are creating APIs and tools for governments to build apps - they are not releasing an App themselves. "8. Who will create the apps and where do I find them? Public health authorities will update or create apps which users may install if they choose to participate. Google and Apple will make available, as normal, the public health authority apps for each region in the Play Store and App Store." [1] https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.0.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu...
deminature 7y ago
This is more a reflection of the poor reputation towards privacy of Google rather than a rational response to the joint contact tracing specification issued by Google/Apple. The specification was clearly engineered to be as privacy conscious as possible and it would be very difficult to extract PII from stored data, but it looks like the well of trust is unrecoverably poisoned.
easytiger 7y ago
An app is not the answer to this. Contact tracing is not necessary as a solution to this. Indeed it is nearly worthless. People here who make proverbial hammers are liable to want to hit nails, without considering if it is necessary. Especially considering the lockdown and that you can't get tested.
- azinman2 7y ago
  Contact tracing is a known strategy for dealing with epidemics, and has demonstrated effectiveness not only in past epidemics, but is working very well today (manually) in South Korea. This helps it scale and makes it possible to know about exposures to strangers.
lunias 7y ago
Forgive my ignorance, but is it possible to create two competing apps? I know this is not at all ideal (kind of defeats the purpose), but I believe people could be steered to the better choice over a little bit of time. Is the NHSX planning to try and force Google / Apple to change their plan and build the app the way that they want or are they proposing that they will develop a different app?
buboard 7y ago
Centralized or not, app-based contact tracing has not worked anywhere. The countries that do successful tracing do it manually, and when personal data is used, it's only infected people's data. Taiwan's minister explains here: https://www.youtube.com/watch?v=ScIVe6STVxI https://www.youtube.com/watch?v=ScIVe6STVxI . No need to bug the entire population for this. As long as new cases are very low, manual tracing by trained personell is superior (because of all the edge cases) and sustainable. If you have too many cases (>100s per million) you re better off shutting down anyway. What are all these apps other than a new kind of surveillance toys, which we know will be force-installed in many countries and will most likely be abused? Maybe it's solutionism that appeals to world leaders for safety theater. https://www.brookings.edu/techstream/inaccurate-and-insecure-why-contact-tracing-apps-could-be-a-disaster/ https://www.brookings.edu/techstream/inaccurate-and-insecure...
- azinman2 7y ago
  If I take a subway next to you, and you get Covid from my cough, no amount of probing from manual tracing can reveal our link when we're strangers. You can't categorically say "manual tracing by trained personell is superior". The apple / google proposal is designed to minimize the ability for abuse from surveillance states.
gnufx 7y ago
I'm not sure I entirely agree, but Ross Anderson deserves to be read on the topic: https://www.lightbluetouchpaper.org/2020/04/12/contact-tracing-in-the-real-world/ https://www.lightbluetouchpaper.org/2020/04/12/contact-traci...
- zb 7y ago
  It’s not often I dare to disagree with Ross Anderson, but most of these objections don’t make a lot of sense to me. There’s nothing to stop the app from phoning home once a contact is identified, so all of the human-in-the-loop stuff is still possible. The only difference between a centralised and decentralised solution so far as I can tell is whether or not we end up with massive centralised databases of every social contact between people who are not infected. Collecting that data seems completely unjustifiable to me, given that it is by definition unnecessary.
Mvandenbergh 7y ago
It would be nice if we could have a serious discussion, rather than assuming that this must certainly be the wrong decision, made by nefarious spies acting behind the scenes. First, it is important to understand that there are two protocols, both of them based on the work done by the Oxford epi group and others over the years on minimally disclosive electronic contact tracing. Both of these are a massive privacy improvement on the pervasive surveillance used in South Korea and China. I don't know enough about the Singapore app to comment on that but I would guess this is also an improvement on what they have. These protocols are DP-3T, on which Google/Apple have based their API and PEPP-PT which many countries including the UK have been building their solution. Until very recently, Germany was also using PEPP-PT but they have switched to DP-3T. Both protocols make trade-offs between the amount of information which leaks and the usefulness of the tool. That's important. Installing an app based on either will strictly reduce your current privacy. It is also important, in understanding the privacy trade-off made, to understand the degree of new privacy loss from either framework. We are already pervasively geolocated based on our phone position, this just adds a possible layer of precision to that data. If GCHQ wants to track your movements, they do have tools which can do that relatively effectively already. Both frameworks use pseudo-random rotating keys which are exchanged over Bluetooth. In PEPP-PT a central server manages a rotating private key which is used to generate a set of time-gated ephemeral IDs for each device. Devices exchange and log these IDs. When a health authority determines that someone is infected, they issue them a key which allows them to upload all their logged IDs to the central server. The server is able to determine who the infected person's phone has logged a contact with and notify those people. A random sample of additional people also receive notification messages which their phones are able to discard as invalid decoy messages. In DP-3T, the keys are generated on the devices and IDs are stored only on the devices. If a central server authorises you to do so (based on a confirmed diagnosed infection), you broadcast the IDs of all the devices you have been in proximity to. All devices regularly download a list of IDs and check the list for one of their own rotating ID numbers. If they match, the user is notified and is able to pre-emptively isolate. The second approach reduces the consequences of a nefarious central operator but at the cost of sharing more information with more people (since everyone sees the list of possibly-infected IDs). In other words, even in privacy terms, this is not a perfect approach either. That information can be used to carry out re-identification attacks and reveal infected users if certain conditions are met. From a privacy point of view, I think many people would prefer the latter (possibly allow malicious attacker, if they are able to do certain not-so-easy things to determine that they were infected) since most people in the UK will not consider that deeply private and secret information about themselves. Many of my friends who got it have posted about it on FB, twitter, etc. The former, which gives a state actor more information seems like a greater breach of privacy. However, it is worth considering why the NHSX team has made this decision, there are epidemiological reasons to significantly prefer PEPP-PT. First, it allows tweaking of the notification algorithm over time. DP-3T only allows notification of everyone in the contact with no risk indication, it's binary. Second, the greater information on the infection graph available to the central authority allows for better aggregate contact measuring which may shape increasing or decreasing distancing measures much more quickly than is currently possible since we currently have to use measures that lag considerably. DP-3T requires more data exchange and on-phone calculation but I'm not convinced that is a convincing argument against it. I tend towards selecting the solution with greater protection against state data collection and the fact that it will have API support and will therefore likely be able to run with a lower power requirement means that I would select DP-3T over PEPP-PT but I'm not the one who has to make that decision and I would love to see the internal decision making document. I do not think it is so obvious as many people are making it out to be.
amelius 7y ago
Doesn't bluetooth give too many false positives anyway (with its range that is far greater than the required 6ft, and its ability to pierce walls?) And how will the general public respond to these false positives? I fear that the effect of a covid app will be somewhere between chaotic and useless.
- tgsovlerkhgsel 7y ago
  The protocols I've seen involve using the signal strength, including knowing the transmission strength, which will probably allow treating people on the other side of any semi-solid wall as "not in contact".
  - amelius 7y ago
    Then doesn't the human body act like a wall to a significant extent?
soylentcola 7y ago
One thing I don't see mentioned and may have missed: if this is all (at least allegedly) anonymous and infection status is self-reported, what is to stop trolls and pranksters from marking themselves as "infected" and then going about their day in public/crowded spaces? Seems like false connections could be spread more easily than the actual virus, no? I would hope this has been addressed somehow but if not, have you ever met people? People* will always figure out a way to break stuff given the opportunity. *Valid for some subset of "people".
- Slartie 7y ago
  Infection status is not self-reported without some kind of authorization from the authority that provides the actual app used for tracing - which is probably some local government entity. That app is built on top of Apple/Google API which does all the BT broadcasting and scanning and key generation stuff, but the government still retains the capability of setting up a system for authorizing app users to flag themselves as infected and thus upload their daily keys to some server (which is probably also operated by the provider of the app, I suppose).
KCUOJJQJ 7y ago
I think that a few terms appeared that describe superstitious beliefs. These terms are (not a complete list): * tracking app * social distancing * self quarantine * lockdown Life is not a video game. There are no game designers able to decide that tracking apps somehow work, for instance. Can you please not downvote my post?
kolleykibber 7y ago
This makes no sense, so there will be a consultant firm behind this poor decision. It's sure it'll play out just like the direction the UK took over the lockdown. The app take up will be poor and they'll start using the goog/appl data 'alongside' the centralised app, eventually sidelining the centralised app altogether. But the contractors will have been paid and will continue to be paid.
- kolleykibber 7y ago
  Edit: Seems Like Carole Cadwalladr has already joined the dots... @carolecadwalla Let’s add another data point. Faculty won this contract back in August, we now know. That’s when NHSX new £250m lab announced. Yet Faculty decided to divulge this news on March 13. Day after SAGE meeting Cummings attended with Ben Warner - brother of Faculty founder, Marc https://twitter.com/carolecadwalla/status/1254887428260868096 https://twitter.com/carolecadwalla/status/125488742826086809...

276 points by jfk13 7y ago

Could someone with a little more understanding of the frameworks and restrictions please explain what this means for locking iPhones while the app is tracking, and using Bluetooth devices like AirPods? Does it prevent them from working and stop you locking your device? Also not a good look (edit: for the uk) on the day Germany swapped from using this style app to a Google-Apple backed system. If the true reason for the centralised matching is that they want to have a better oversight of the spread could they not do that with the Google-Apple system by having it (optionally) phone home to a server when there is a match?

dTal 7y ago
On the contrary, it's a very good look for Germany and a terrible blow for privacy-conscious UK denizens. I hope this is reversed somehow. The Apple/Google system is zero-knowledge. The NHS system sounds like a privacy disaster. >The tech giants believe their effort provides more privacy, as it limits the ability of either the authorities or a hacker to use the computer server logs to track specific individuals and identify their social interactions. >But NHSX believes a centralised system will give it more insight into Covid-19's spread, and therefore how to evolve the app accordingly.
- samwillis 7y ago
  That is exactly what I meant, bad look for the UK! Fully support Germany going with the Google-Apple backed solution. I hope we follow Germany and reverse this decision!
- temac 7y ago
  I certainly prefer the Apple/Google/DP-3T approaches but they are certainly not "zero-knowledge". They are not even strictly "less-knowledge" than PEPP-PT if you trust the central server (but arguably not in ways that can have strong practical consequences, at least not more than the situation in the other direction).
asperous 7y ago
Bluetooth allows 7 devices connected at once, but actually the spec uses bluetooth low energy which is a special low-bandwidth, low-energy mode. You can lock your device. [1] It sounds to me like NHS wants location data logs of everyone in the country. You can measure contacts and spread that way but it's a privacy disaster. The decentralized approach tells authorities and users if they've been near someone who later on marked themselves as infected. The data is much more limited but still accomplishes the main purpose. [1] https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-BluetoothSpecificationv1.1.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu...
- deleted 7y ago
  [deleted]
- SlowRobotAhead 7y ago
  There is no BLE hard limit to device connections here at all. This whole system works on advertising packets. Beacons are non-connectable, aptly named. Your phone can be connected n number of BLE devices and also appear to be n number of peripherals itself. No hard limit that I can think of, usually just depends on the stack. But this isn’t that. This is your phone pumping out <CONTACT: I am 7733> and listening for other people’s phones to say <CONTACT: I am xxxx>. I can think of no stack that has a connection limit and after that stops allowing for reception of advertising packets.
  - nickff 7y ago
    I believe that Bluetooth units are limited to 1 central (master/server/upstream) and 7 peripheral (slave/client/downstream) connections. Mesh networks can be made up of up to 255 units. Advertising is different, and not limited, but it is not classified as a 'connection'. My understanding is that advertisements are simply broadcast, so there is no bidirectional communication.
    - SlowRobotAhead 7y ago
      I thought I had seen multi master stacks. For peripherals I know I’ve seen 20 concurrent this n the Nordic S132, definitely not 8 as any BLE spec limitation. Yes. That’s what I said, beacons are advertising packeting with the connectable flag cleared. You misunderstood, there is no bidirectional in my post. Just two transmitters and two receivers.

smileypete 7y ago

Wonder if the Apple Google plan involved keeping the data within UK borders at all time? Trouble is, as soon as the data leaves these shores, it falls under the usual Five Eyes spying loopholes. I had one of those Youtube surveys 'Do you trust Apple, Google etc with your health data' - Not very much thankyou!

phreeza 7y ago
My understanding is that the data stays on the users device, except when they register themselves as infected.
- mcintyre1994 7y ago
  And further, I don't think Apple/Google intend to provide the database that infected people push their data into - my understanding was that would be per-app and in this case controlled by NHSX.
strictnein 7y ago
You understand the UK is part of the Five Eyes, right? And with this plan the NHS will just have access to all the data? So the thing you are fearful of is actually happening because the NHS plan is the route they are choosing.
- anpago 7y ago
  With GCHQ advising on the App..
izacus 7y ago
The Apple/Google plan just exposes an API to on-device data. There still needs to be an app that retrieves that data and uploads it somewhere (supposed to be implemented by the governments / health officials). In that way it's similar like e.g. location APIs work - the device handles the resolution and data processing for you, but there still needs to be an app to retrieve it and do something with it. Hence your original question isn't applicable in context of APIs they've designed.

rezeroed 7y ago

I'd sooner acquire the virus than put theses things on my phone.

TwoHeadedBeast 7y ago
It's not all about you, it's about trying to stop the spread of the virus to people who might be more vulnerable than you are.
- rezeroed 7y ago
  They should isolate.
  - andybak 7y ago
    Please don't continue with this.
    - rezeroed 7y ago
      I didn't mean acquire and wander around infecting people, rather acquire and sit around until it's over. HN obviously interpreted it the other way.
      - oneeyedpigeon 7y ago
        You said: > [people who might be more vulnerable] should isolate. and now you appear to be saying: > [they should] acquire [the virus] and sit around until it's over That's incredibly bad advice. Now, notice that I'm not going in too hard on you because I'm hoping I've misunderstood what you're saying, but can you clarify it to avoid such confusion, please?
      - danpalmer 7y ago
        It's thought that 20-80% are asymptomatic, so the plan to acquire and sit around won't work for a very large number of people. Plus they still have a ~0.1-0.5% rate of fatal complications. Wide error bars on these, but all numbers I've seen reported from studies.

ucarion 7y ago

From the the article: > Germany had been in line with NHSX, but its government announced on Sunday it had switched tack to a "strongly decentralised approach". Today's Stratechery (https://stratechery.com/2020/more-on-apple-and-google-germany-versus-apple-facebooks-surveys/ https://stratechery.com/2020/more-on-apple-and-google-german...): > What is worth noting is why Germany changed their approach: > > Germany as recently as Friday backed a centralized standard called Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT), which would have needed Apple in particular to change the settings on its iPhones. When Apple refused to budge there was no alternative but to change course, said a senior government source. > This is exactly what I was driving at in Coronavirus Clarity: tech companies are the ones setting the rules, not governments.

cwhiz 7y ago
I can't read that article without an account but the quotes imply that only Apple was standing in the way of the centralized approach. Did Germany have a centralized contact tracing solution through Android? Is there more context that might imply that Google wasn't playing ball?
- tssva 7y ago
  iOS has more restrictions than Android regarding Bluetooth use by applications in the background. Germany may have needed Apple to change those restrictions while Android already provided the access they needed.

noodlesUK 7y ago

This is silly. There’s a clearly demonstrable reason why Germany switched tack, and why the UK should too. All of this contact tracing can be done in a privacy preserving way. However, the NHSX development of these tools is led by such industry partners as palantir... We aren’t going to see much regard for privacy from them. Edit: Google and Apple need to get their act together though, and just provide a contact tracing framework as part of the OS that is compatible, and can have data housed in each country where they see fit. It should be optional for people, but it should be part of the OS, and it should just be presented to the countries as ready to go with just a little bit of integration. That way we can force everyone to respect user privacy and not do sketchy contact tracing apps.

anon102010 7y ago
I will never touch / install contact tracing if it can be backdoored into global surveilance. Apple has built a reputation for at least trying to preserve some user privacy. Their current proposal keeps it simple, your privacy is preserved and benefits for exposure notification (FAR beyond current horrendous govt efforts in terms of speed of notification etc) are there. They need to get their act together, and ignore folks trying to backdoor their systems.
- 0xBeefFed 7y ago
  It should be noted that your privacy is not preserved if you test positive and need to upload your Daily Tracing Keys to a server. Your broadcast IDs for an entire day can be linked together, making it easier to de-anonymize you. I understand that they use Daily Tracing Keys to reduce the demand of the backend server, but I think it would be better for user privacy if they either reduced the linkable period from a day to say an hour, or used an unlinkable design.
  - pintxo 7y ago
    In case you test positive, and we actually have the resources to trace your contacts, your privacy will be gone in todays system for sure. As you'll have to provide information about your recent contacts to the authorities performing the contact tracing. At least that's how I understand our local law (Germany). So I don't think its necessarily worse doing it with an App than doing it the old fashioned way. Sure digital traces are always easier to abuse, but then on the other hand, because things get automated, actually less people might get access to your data. Which would be a privacy win. I believe what's even more important than how we design the app, is how we design the legal framework around it. We do need rock solid laws, having enforceable data retention periods, and that limit access to the pare minimum needed. Unfortunately, our track record for the design of such laws has not been too good over the last years.

lorsting 7y ago

These days I stop and read these headlines and articles two or three times to make sure this is not people trolling on the internet or some new SF movie. You people should have lived in communist countries and should have woken up at 5 am to receive half of a bread in exchange for a ticket. And you should watch state TV between 20-22 only. Only after living like this for a decade you are entitled to ask for state supervision like this.

lstamour 7y ago
First off, having a cell phone or having friends over with cell phones means, technologically speaking, you can be tracked and overheard by a sufficiently advanced adversary, given reason. That said, I think this is making waves precisely because it is centralized. If you trust Apple, and their decentralized approach, you can opt in. If you live in a country which forces you to scan QR codes, you either need a lot of friends or you can’t easily escape the surveillance. That said, given the ubiquity of police cameras in London and the way they are spreading to other areas currently for automated speed ticketing, it seems likely that we’re on a path to significantly more surveillance digitally in the future. But... let’s not fool ourselves, what your carrier or ISP knows, your government is one court order away, at best, from knowing...
- SlowRobotAhead 7y ago
  I don’t like this argument. Yes, your phone could be used to get information on you. That does not mean there is then no issue with phones doing contact scanning and recording. You can own a phone, acknowledge the risk, and not want to see that risk expanded recklessly. The privacy systems “SEEM” ok, but any hesitation is rightfully earned. These companies and governments have abused trust and have not earned it back. This is system a road paved with best intentions and should absolutely not be implemented until coivd19 is over and people can think clearly. The hard push right now for it is clearly not wanting to “let a crisis go to waste”.
  - lstamour 7y ago
    I’m not making an argument that there’s no issue with phones doing contact scanning. Rather, I trust Apple, and maybe Google, to do what they say they will do, and I trust that they will be very closely inspected from a security perspective by third-parties to confirm that. I’m not saying that phones should always report your location, but I am saying that they already have that capability. It’s like complaining about cookies when your phone already has a perfectly unique fingerprint due to Chrome’s origin trials, say.

jupp0r 7y ago

This is insane. Why would they risk people not adopting the app due to privacy concerns while it's only effective if a majority of the population uses it? What's the benefit if they can gather better stats with a central approach if it doesn't work because a lot of people aren't installing the app?

SlowRobotAhead 7y ago
> due to privacy concerns You immediately answered your own question. This topic seems to be a rorschach test.
s_dev 7y ago
> while it's only effective if a majority of the population uses it? 60% is the minimum number the experts are saying must use the app before it's effective.
- cwhiz 7y ago
  Source? I have heard much higher numbers, as high as 95%.
  - jpollock 7y ago
    If (1-1/R0) of the population is using the app, it should bring the R0 below 1. With covid-19, if the R0 is 3, then being able to track 2/3rds of infections should _hopefully_ bring the R0 below 1. At least that's how I've been reasoning it out.
    - user5994461 7y ago
      The last estimates put R0 around 6.
      - chimprich 7y ago
        But do the best estimates? As far as I can tell estimates vary a lot, but an R0 of 6 would be a significant outlier. But the current R value in the UK under the lockdown is estimated to be somewhere between 0.5 and 1. A contact-tracing app doesn't need to be perfect; any reduction in R would allow for either a swifter reduction in cases or a liberalisation of lockdown measures.

figgyc 7y ago

Apple and Google could force otherwise if they just ban the app from their stores. Especially considering that they seem to be using some questionable workarounds to run in the background on iOS, they could chalk it down to policy, but it probably wouldn't be in their best interests since "Apple blocks NHS from releasing contact tracing app" would not be a good headline.

raphaelj 7y ago

That's very bad. Anonymous and (mostly) decentralized contact tracing is definitively possible, and is exactly what the D3P-T and Apple/Google protocols are trying to achieve. Developing a reasonably anonymous contact-tracing app is not that complex at all. I wrote a very simple (but working) app that also implements contact-tracing in a way similar to D3P-T or Apple/Google, and it only took me a few days: https://github.com/RaphaelJ/covid-tracer/blob/master/README.md https://github.com/RaphaelJ/covid-tracer/blob/master/README.... Users will also never opt-in for such apps if they don't at least try to slightly protect privacy.

Angostura 7y ago

Oh dear. I was definitely going to put this on my phone. Now I won’t b

supernova87a 7y ago

I ask an uncomfortable question for debate about this: Many of us probably think ridiculous the people who are jumping to reopen businesses (and states) in the interest of economic activity, at the cost of putting people's lives at risk. Why, on the other hand, is privacy so important versus saving lives if a more effective (but slightly less private) information gathering mechanism could be implemented? How do we judge one not worth the risk, while the other is?

prh8 7y ago
It's a great question, but over the last couple weeks, it's clear (from a number of topics) that 95% of HN would rather have completely perfect privacy more than safety. It seems that counter to things like freedom of speech, there are no qualms about infringing upon other humans when it comes to the right to privacy.
- kstrauser 7y ago
  Yes, that's correct. I can do things like isolate myself and my family to protect ourselves (and others) from things like covid 19, but I can't reach out and make governments and business respect my privacy. In the longer scale, I think you and I are more at risk from loss of privacy than I am from a virus that, while nasty right now, is likely to be over soon.
  - prh8 7y ago
    There's no evidence that it's likely to be over soon, in fact, most suggests the opposite. Also, it's either completely ignorant or just highly asinine to suggest anyone besides yourself is at more risk from loss of privacy than the virus.
ck425 7y ago
The harm that a developed surveillance state can do is incredible. See China. We need to balance saving lives from corona with potentially saving lives or quality of lives from privacy abuse. It's a slippery slope argument and those are always hard to discuss as we're discussing potential future abuse. In this case however it's a reasonably safe and effective system vs an pretty unsafe but slightly more efficient system. To my mind there's a clear winner there.

diebeforei485 7y ago

The Apple-Google protocol is designed to reasonably protect their users even in less-free countries. Consider every Middle Eastern country; China (Xinjiang, Tibet etc); India (Kashmir etc); Latin American countries that have cozy relationships with gangs and cartels; Russia; even the USA with ICE and other agencies. Do you really think Apple and Google should be giving information on their users to those governments? They can't possibly say "stronger contact tracing for Canadians, but not for Mexicans" - it has to be one global standard.

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
ENOTTY 7y ago
> [Apple and Google] can't possibly say "stronger contact tracing for Canadians, but not for Mexicans" - it has to be one global standard. Why not? Apple and Google could just as easily say, "Only countries that meet the standards we set get access to more data." On one hand, it seems like the HN community seems okay with giving Apple and Google the power to set norms on technology policy that apply worldwide (e.g., what level of potential privacy loss is acceptable to combat a pandemic), but on the the other hand we don't trust Apple and Google to know how to distinguish a totalitarian regime from a government that respects its citizens' rights?
- diebeforei485 7y ago
  It's very hard to make such a distinction in practice, because it comes off as Apple saying that some of their customers' lives are worth more than others.

BlackVanilla 7y ago

It's worth highlighting the differences between the UK and the rest of the world. The NHS is embedded into the UK's culture. Since the start of lockdown, drawings of rainbows are commonly seen in windows with captions like 'Thank you NHS and key workers' and on Thursdays at 8pm, people stand on doorsteps and clap for the NHS. The NHS is very well trusted and this app, if viewed as a creation of NHS (or NHSX) and not 'the government', could still remain successful despite privacy concerns. Unlike other countries, the UK has the opportunity to frame this as an NHS-created app, rather than a state-created app. If they're able to do that, then it wouldn't surprise me that the UK's population takes up the app. Additionally, few people consider data privacy concerns at the best of times. Given the circumstances, I think more people are willing to prioritise public health over privacy concerns.[1] So, they seem to have judged that the richer data trumps the slight reduction in usage. The combination of these factors could be the rationale behind this judgment call. [1] https://www.ft.com/content/1752affb-24dc-4ad9-8503-78f9ce1adca9 https://www.ft.com/content/1752affb-24dc-4ad9-8503-78f9ce1ad... (there's a paywall, so the link below shows a similar poll) [2] Ipsos MORI poll https://www.ipsos.com/sites/default/files/2020-04/coronavirus-covid-19-infographic-ipsos-mori.pdf https://www.ipsos.com/sites/default/files/2020-04/coronaviru...

1996 7y ago
> on Thursdays at 8pm, people stand on doorsteps and clap for the NHS This looks very orwellian. Does it come from a grass root initiative, or was it started by the government?
- cameronbrown 7y ago
  It's not a requirement or anything, people are clapping voluntarily. Britain doesn't just like the NHS, it really does love the service.
  - TechBro8615 7y ago
    This is quite the generalization, equivalent to saying that Americans love the Democratic Party. A poll in 2019 found that satisfaction with the NHS hit an eleven year low, with 53% of respondents satisfied with services in the year prior. https://www.bbc.co.uk/news/health-47472472 https://www.bbc.co.uk/news/health-47472472

cm2187 7y ago

So basically the NHS wants to make it a surveillance system because they think they will get some interesting data watching every movements. They may be right. But this piece of dirt won't be on my phone.

chimprich 7y ago
I'd be happy to install it for the duration of the outbreak. It's not as if I'm doing anything terribly interesting. It doesn't sound like it would collect anywhere near as much personal data as Google, or the government, already does. For the sake of protecting lives and getting out of lockdown quicker to rebuild the economy I'm prepared to sacrifice a little privacy. Edit: I don't particularly care, but there seems to be a systematic approach from some users to voting down posts for expressing honestly held beliefs that a balanced approach can be taken with respect to privacy.
- jupp0r 7y ago
  The question is why they didn't implement it in a decentralized way that works together with OS primitives implemented by Google and Apple. I would also install it for the duration of the outbreak, if there wasn't any effective alternative. My gripe is that there is an alternative that works 100% as well and they chose to ignore it in favor of universal population surveillance.
  - chimprich 7y ago
    It's a fair question; the answer to that doesn't seem to have been communicated yet. We can speculate as to reasons why: one could be that the authors feel that the decentralised approach is lacking some important feature that could save lives, such as insufficient feedback about how it is being used. Another could be that they feel that they can implement a solution faster than waiting for Google/Apple to finish their platform and then building something on top of it. This leaves open the possibility of changing tack if the new API is superior. Or maybe they're just hedging their bets in case the Google/Apple approach doesn't work or gets pulled. (I'm assuming none of this is a nefarious plot by the government to add to their general surveillance powers. I personally don't think they'd care given the considerable abilities they already reputedly have to track mobiles).

est31 7y ago

I've watched some German TV recently and heard politicians claim that Apple/Google demanded access to the contact tracing data if the government were to get it as well.

hackandtrip 7y ago

Will iOS - iOS Bluetooth communication be ok with those new API? Wasn't a major problem with other frameworks the iOS Bluetooth turning off for battery capacity?

barbegal 7y ago
It can work in a limited fashion using iBeacons. These have special status on iPhones allowing them to be received by an app even in the background. But even these are rate limited and each iBeacon can only wake up the app once when it comes into range.

Cantbekhan 7y ago

I don't trust Apple and Google but I trust my government even less. And I also do (cynically) think that Google and Apple already have most of this contact tracing information anyway... I mean I would even trust Facebook more than my govt.

lowwave 7y ago
In addition Google and Apple are US companies, and US has worse privacy law than Europe. The future may be each person or entity will self host their own data on a RasberryPi (or better yet BeagleBoard).
- stevenwliao 7y ago
  We can't expect everyone to secure their own data infrastructure. Billions don't even know how to use a Raspberry Pi.
  - lowwave 7y ago
    Well, perfect time for hackers to just make off the shelf boxes.
  - lowwave 7y ago
    In the end it is all about who owns the data.
    - stevenwliao 7y ago
      There are other concerns- availability, durability, security, privacy (once info leaves the box and goes into some system).
ENOTTY 7y ago
> I don't trust Apple and Google but I trust my government even less. That's a really interesting statement. Could you elaborate on your thinking? Under what form of government do you live? Why do you feel Apple or Google is more trustworthy than your government?

cm2187 7y ago

Weren't Google and Apple going to release an official app along their API? It may be that if the NHS app gets enough bad press (which apparently it should), people naturally use Google and Apple's implementation. Even people who are happy to go along the NHS will likely also want to have the Apple/Google app running as well, as they don't know from which of the two "networks" the notification will come from.

djrogers 7y ago
No, Google and Apple announced they are creating APIs and tools for governments to build apps - they are not releasing an App themselves. "8. Who will create the apps and where do I find them? Public health authorities will update or create apps which users may install if they choose to participate. Google and Apple will make available, as normal, the public health authority apps for each region in the Play Store and App Store." [1] https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.0.pdf https://covid19-static.cdn-apple.com/applications/covid19/cu...

deminature 7y ago

This is more a reflection of the poor reputation towards privacy of Google rather than a rational response to the joint contact tracing specification issued by Google/Apple. The specification was clearly engineered to be as privacy conscious as possible and it would be very difficult to extract PII from stored data, but it looks like the well of trust is unrecoverably poisoned.

easytiger 7y ago

An app is not the answer to this. Contact tracing is not necessary as a solution to this. Indeed it is nearly worthless. People here who make proverbial hammers are liable to want to hit nails, without considering if it is necessary. Especially considering the lockdown and that you can't get tested.

azinman2 7y ago
Contact tracing is a known strategy for dealing with epidemics, and has demonstrated effectiveness not only in past epidemics, but is working very well today (manually) in South Korea. This helps it scale and makes it possible to know about exposures to strangers.

lunias 7y ago

Forgive my ignorance, but is it possible to create two competing apps? I know this is not at all ideal (kind of defeats the purpose), but I believe people could be steered to the better choice over a little bit of time. Is the NHSX planning to try and force Google / Apple to change their plan and build the app the way that they want or are they proposing that they will develop a different app?

buboard 7y ago

Centralized or not, app-based contact tracing has not worked anywhere. The countries that do successful tracing do it manually, and when personal data is used, it's only infected people's data. Taiwan's minister explains here: https://www.youtube.com/watch?v=ScIVe6STVxI https://www.youtube.com/watch?v=ScIVe6STVxI . No need to bug the entire population for this. As long as new cases are very low, manual tracing by trained personell is superior (because of all the edge cases) and sustainable. If you have too many cases (>100s per million) you re better off shutting down anyway. What are all these apps other than a new kind of surveillance toys, which we know will be force-installed in many countries and will most likely be abused? Maybe it's solutionism that appeals to world leaders for safety theater. https://www.brookings.edu/techstream/inaccurate-and-insecure-why-contact-tracing-apps-could-be-a-disaster/ https://www.brookings.edu/techstream/inaccurate-and-insecure...

azinman2 7y ago
If I take a subway next to you, and you get Covid from my cough, no amount of probing from manual tracing can reveal our link when we're strangers. You can't categorically say "manual tracing by trained personell is superior". The apple / google proposal is designed to minimize the ability for abuse from surveillance states.

gnufx 7y ago

I'm not sure I entirely agree, but Ross Anderson deserves to be read on the topic: https://www.lightbluetouchpaper.org/2020/04/12/contact-tracing-in-the-real-world/ https://www.lightbluetouchpaper.org/2020/04/12/contact-traci...

zb 7y ago
It’s not often I dare to disagree with Ross Anderson, but most of these objections don’t make a lot of sense to me. There’s nothing to stop the app from phoning home once a contact is identified, so all of the human-in-the-loop stuff is still possible. The only difference between a centralised and decentralised solution so far as I can tell is whether or not we end up with massive centralised databases of every social contact between people who are not infected. Collecting that data seems completely unjustifiable to me, given that it is by definition unnecessary.

Mvandenbergh 7y ago

It would be nice if we could have a serious discussion, rather than assuming that this must certainly be the wrong decision, made by nefarious spies acting behind the scenes. First, it is important to understand that there are two protocols, both of them based on the work done by the Oxford epi group and others over the years on minimally disclosive electronic contact tracing. Both of these are a massive privacy improvement on the pervasive surveillance used in South Korea and China. I don't know enough about the Singapore app to comment on that but I would guess this is also an improvement on what they have. These protocols are DP-3T, on which Google/Apple have based their API and PEPP-PT which many countries including the UK have been building their solution. Until very recently, Germany was also using PEPP-PT but they have switched to DP-3T. Both protocols make trade-offs between the amount of information which leaks and the usefulness of the tool. That's important. Installing an app based on either will strictly reduce your current privacy. It is also important, in understanding the privacy trade-off made, to understand the degree of new privacy loss from either framework. We are already pervasively geolocated based on our phone position, this just adds a possible layer of precision to that data. If GCHQ wants to track your movements, they do have tools which can do that relatively effectively already. Both frameworks use pseudo-random rotating keys which are exchanged over Bluetooth. In PEPP-PT a central server manages a rotating private key which is used to generate a set of time-gated ephemeral IDs for each device. Devices exchange and log these IDs. When a health authority determines that someone is infected, they issue them a key which allows them to upload all their logged IDs to the central server. The server is able to determine who the infected person's phone has logged a contact with and notify those people. A random sample of additional people also receive notification messages which their phones are able to discard as invalid decoy messages. In DP-3T, the keys are generated on the devices and IDs are stored only on the devices. If a central server authorises you to do so (based on a confirmed diagnosed infection), you broadcast the IDs of all the devices you have been in proximity to. All devices regularly download a list of IDs and check the list for one of their own rotating ID numbers. If they match, the user is notified and is able to pre-emptively isolate. The second approach reduces the consequences of a nefarious central operator but at the cost of sharing more information with more people (since everyone sees the list of possibly-infected IDs). In other words, even in privacy terms, this is not a perfect approach either. That information can be used to carry out re-identification attacks and reveal infected users if certain conditions are met. From a privacy point of view, I think many people would prefer the latter (possibly allow malicious attacker, if they are able to do certain not-so-easy things to determine that they were infected) since most people in the UK will not consider that deeply private and secret information about themselves. Many of my friends who got it have posted about it on FB, twitter, etc. The former, which gives a state actor more information seems like a greater breach of privacy. However, it is worth considering why the NHSX team has made this decision, there are epidemiological reasons to significantly prefer PEPP-PT. First, it allows tweaking of the notification algorithm over time. DP-3T only allows notification of everyone in the contact with no risk indication, it's binary. Second, the greater information on the infection graph available to the central authority allows for better aggregate contact measuring which may shape increasing or decreasing distancing measures much more quickly than is currently possible since we currently have to use measures that lag considerably. DP-3T requires more data exchange and on-phone calculation but I'm not convinced that is a convincing argument against it. I tend towards selecting the solution with greater protection against state data collection and the fact that it will have API support and will therefore likely be able to run with a lower power requirement means that I would select DP-3T over PEPP-PT but I'm not the one who has to make that decision and I would love to see the internal decision making document. I do not think it is so obvious as many people are making it out to be.

amelius 7y ago

Doesn't bluetooth give too many false positives anyway (with its range that is far greater than the required 6ft, and its ability to pierce walls?) And how will the general public respond to these false positives? I fear that the effect of a covid app will be somewhere between chaotic and useless.

tgsovlerkhgsel 7y ago
The protocols I've seen involve using the signal strength, including knowing the transmission strength, which will probably allow treating people on the other side of any semi-solid wall as "not in contact".
- amelius 7y ago
  Then doesn't the human body act like a wall to a significant extent?

soylentcola 7y ago

One thing I don't see mentioned and may have missed: if this is all (at least allegedly) anonymous and infection status is self-reported, what is to stop trolls and pranksters from marking themselves as "infected" and then going about their day in public/crowded spaces? Seems like false connections could be spread more easily than the actual virus, no? I would hope this has been addressed somehow but if not, have you ever met people? People* will always figure out a way to break stuff given the opportunity. *Valid for some subset of "people".

Slartie 7y ago
Infection status is not self-reported without some kind of authorization from the authority that provides the actual app used for tracing - which is probably some local government entity. That app is built on top of Apple/Google API which does all the BT broadcasting and scanning and key generation stuff, but the government still retains the capability of setting up a system for authorizing app users to flag themselves as infected and thus upload their daily keys to some server (which is probably also operated by the provider of the app, I suppose).

KCUOJJQJ 7y ago

I think that a few terms appeared that describe superstitious beliefs. These terms are (not a complete list): * tracking app * social distancing * self quarantine * lockdown Life is not a video game. There are no game designers able to decide that tracking apps somehow work, for instance. Can you please not downvote my post?

kolleykibber 7y ago

This makes no sense, so there will be a consultant firm behind this poor decision. It's sure it'll play out just like the direction the UK took over the lockdown. The app take up will be poor and they'll start using the goog/appl data 'alongside' the centralised app, eventually sidelining the centralised app altogether. But the contractors will have been paid and will continue to be paid.

kolleykibber 7y ago
Edit: Seems Like Carole Cadwalladr has already joined the dots... @carolecadwalla Let’s add another data point. Faculty won this contract back in August, we now know. That’s when NHSX new £250m lab announced. Yet Faculty decided to divulge this news on March 13. Day after SAGE meeting Cummings attended with Ben Warner - brother of Faculty founder, Marc https://twitter.com/carolecadwalla/status/1254887428260868096 https://twitter.com/carolecadwalla/status/125488742826086809...