It would be nice if we could have a serious discussion, rather than assuming that this must certainly be the wrong decision, made by nefarious spies acting behi

It would be nice if we could have a serious discussion, rather than assuming that this must certainly be the wrong decision, made by nefarious spies acting behind the scenes. First, it is important to understand that there are two protocols, both of them based on the work done by the Oxford epi group and others over the years on minimally disclosive electronic contact tracing. Both of these are a massive privacy improvement on the pervasive surveillance used in South Korea and China. I don't know enough about the Singapore app to comment on that but I would guess this is also an improvement on what they have. These protocols are DP-3T, on which Google/Apple have based their API and PEPP-PT which many countries including the UK have been building their solution. Until very recently, Germany was also using PEPP-PT but they have switched to DP-3T. Both protocols make trade-offs between the amount of information which leaks and the usefulness of the tool. That's important. Installing an app based on either will strictly reduce your current privacy. It is also important, in understanding the privacy trade-off made, to understand the degree of new privacy loss from either framework. We are already pervasively geolocated based on our phone position, this just adds a possible layer of precision to that data. If GCHQ wants to track your movements, they do have tools which can do that relatively effectively already. Both frameworks use pseudo-random rotating keys which are exchanged over Bluetooth. In PEPP-PT a central server manages a rotating private key which is used to generate a set of time-gated ephemeral IDs for each device. Devices exchange and log these IDs. When a health authority determines that someone is infected, they issue them a key which allows them to upload all their logged IDs to the central server. The server is able to determine who the infected person's phone has logged a contact with and notify those people. A random sample of additional people also receive notification messages which their phones are able to discard as invalid decoy messages. In DP-3T, the keys are generated on the devices and IDs are stored only on the devices. If a central server authorises you to do so (based on a confirmed diagnosed infection), you broadcast the IDs of all the devices you have been in proximity to. All devices regularly download a list of IDs and check the list for one of their own rotating ID numbers. If they match, the user is notified and is able to pre-emptively isolate. The second approach reduces the consequences of a nefarious central operator but at the cost of sharing more information with more people (since everyone sees the list of possibly-infected IDs). In other words, even in privacy terms, this is not a perfect approach either. That information can be used to carry out re-identification attacks and reveal infected users if certain conditions are met. From a privacy point of view, I think many people would prefer the latter (possibly allow malicious attacker, if they are able to do certain not-so-easy things to determine that they were infected) since most people in the UK will not consider that deeply private and secret information about themselves. Many of my friends who got it have posted about it on FB, twitter, etc. The former, which gives a state actor more information seems like a greater breach of privacy. However, it is worth considering why the NHSX team has made this decision, there are epidemiological reasons to significantly prefer PEPP-PT. First, it allows tweaking of the notification algorithm over time. DP-3T only allows notification of everyone in the contact with no risk indication, it's binary. Second, the greater information on the infection graph available to the central authority allows for better aggregate contact measuring which may shape increasing or decreasing distancing measures much more quickly than is currently possible since we currently have to use measures that lag considerably. DP-3T requires more data exchange and on-phone calculation but I'm not convinced that is a convincing argument against it. I tend towards selecting the solution with greater protection against state data collection and the fact that it will have API support and will therefore likely be able to run with a lower power requirement means that I would select DP-3T over PEPP-PT but I'm not the one who has to make that decision and I would love to see the internal decision making document. I do not think it is so obvious as many people are making it out to be.