4 ms·

Yet, reading a recent report in [1]: "The NHS contact-tracing app must not be rolled out across the UK until the government has increased privacy and data prot

Yet, reading a recent report in [1]: "The NHS contact-tracing app must not be rolled out across the UK until the government has increased privacy and data protections, an influential parliamentary committee has said". The app requests location permission on Android, something that Google doesn't allow when using their implementation. I suspect this app, in this form, is DOA and will be quickly replaced. Even if they do somehow roll it out widely, there are concerns in [2] about its effectiveness working in the background. This app is a complete disaster, and will be unviable for the mass tracing they will want to conduct. They've pushed and pushed for "why" a centralized approach is the "right" one, made blog posts, issued justifications. Yet the app isn't likely to see mass adoption and isn't going to work due to restrictions within the OS. This app represents the disastrous approach the government took to this virus. Flip flopping around, shutting down way too late, no clear guidelines or approach, and a high death rate to solidify their failure. Then, they decide the official approach is "wrong" or "not good enough". Heads should roll over this. [1]: https://www.theguardian.com/world/2020/may/07/uk-coronavirus-contract-tracing-app-could-fall-foul-of-privacy-law-government-told https://www.theguardian.com/world/2020/may/07/uk-coronavirus... [2]: https://github.com/nhsx/COVID-19-app-iOS-BETA/issues/2 https://github.com/nhsx/COVID-19-app-iOS-BETA/issues/2

ealexhudson 6y ago
Location permission is a technical requirement for using Bluetooth in this way because of beacons. Lots of people keep saying the app can't work due to restrictions. Maybe, I'm not sure that has really been shown yet. A lot of the criticism doesn't really withstand the light of day.
- aboringusername 6y ago
  The problem is, there's no way to disassociate the two flaws with this: 1: people see "government app wants your location" 2: the government possibly using that location access at a later time I don't want to accept location on a government app, and the UK has some history with facial recognition cameras and other privacy invasive laws. So there's no way for me to know this location is only for them to use BT LE and they won't make an API call to getLocation and uploadLocationToServer. I assume once you grant location permission even for BT LE purposes it can be (ab)used in some other way. They've made their own bed with their actions, public confidence might not trust an app like this with a permission like that.
  - bigfudge 6y ago
    I agree with you and won’t be installing the app. However I think you may Misjudge public mood on this. If told this ends the lockdown early it will at least be downloaded by a lot of people. Whether they keep it running when it hammers their battery is another question.
  - ngcc_hk 6y ago
    Totally agreed. You cannot trust a government as there would not be oversight. An independent one with explicit safeguard against anybody other than health tracing not contact tracing will be possibly first stage. Still abuse is possibly even then. But get the institution barrier right first before we talk about technical issues.
  - jka 6y ago
    It's probably exactly your concern about the ability for apps with network access to upload user data that led the Android team to introduce the locations permissions for BLE identifier scanning. Without a location requirement, an app could claim to use only Wi-Fi and BLE permissions, yet it could combine beacon scanning and data access to de-anonymize user locations. This permission requirement was introduced in Android 6.0 (see the release notes[1]) in October 2015, so it's been around for a while. If you have some suggestions around how to improve the tracking of permission usage (static analysis? run-time requests (preferably avoiding times when users are under duress and likely to click 'OK' by default)?) then you may wish to file some requests with them and/or contribute to other projects that you feel are taking a better approach. Your concerns around trust in app developers -- regardless of whether they are a government or any other entity -- are best handled by two means: - Open sourcing the code (which NHSX have done) - Enabling reproducible builds[2] so that users can confirm they have an authentic binary build of the source code [1] - https://developer.android.com/about/versions/marshmallow/android-6.0-changes#behavior-hardware-id https://developer.android.com/about/versions/marshmallow/and... [2] - https://reproducible-builds.org/ https://reproducible-builds.org/
    - antpls 6y ago
      I may be misunderstanding this thread, but what the parent is saying is that the BLE permission in Android was _never_ meant for privacy focused contact tracing, and you are saying this is not a secret. This is why Google and Apple developed the Exposure API, which is more private because it doesn't save as many metadata than the classical BLE permission, and at least Google does _not_ allow apps to declare both the Exposed API and the location permission at the same time. This gives more guarantee to the users than just trusting the app developers. In other words, any serious privacy-focused contact tracing apps should use the Google/Apple Exposure API, and not a custom made solution on tops of the older BLE permissions. However, I still think digital contact tracing, even private, is a bad idea.
urbandw311er 6y ago
I don't think you understand the technology or the privacy architecture. The location permission you refer to is related to Bluetooth and is standard. Just because the collected data is stored centrally it does not mean that it is not anonymised. And finally I would suggest the Guardian is not the best place to get a balanced view of privacy implications! I think it's an odd situation to be in where a foreign company is able to hold an elected government to ransom over its healthcare provider's technology choice.
- kolleykibber 6y ago
  Could you let us know if you are involved in this work?
erinaceousjones 6y ago
> I suspect this app, in this form, is DOA and will be quickly replaced. Even if they do somehow roll it out widely, there are concerns in [2] about its effectiveness working in the background. That particular issue is a bit of a niche case, which I argue is rendered less of a problem by behavioural psychology. If your devices are locked with screen off for long periods of time, you're probably at home, or generally not moving. The kind of people who are going to willingly download an app onto their smartphone like this are probably going to be actively using their devices enough throughout the day that the app can at least get a _reasonable_ sample. The best use of the data gathered from this app is supporting mass scale epidemiology, after all -- tracking contact rates on public transport and so on. This is also specific to iOS devices. Given that the current UK market share is roughly 50/50 between iOS and Android, it's unlikely your device is _only_ going to encounter other iOS devices daily, so the Android "wake up iOS devices" workaround comes into play here. > The app requests location permission on Android, something that Google doesn't allow when using their implementation. I think this is going to be less of an issue than you think it is -- even lots of tech-savvy people gleefully accept app permissions without really caring about it. It's not ideal, but Google/Android could have simply made a separate permission for bluetooth beacons instead of piggybacking on FINE_LOCATION, and have had several years to do so, yet have not chosen to do so. Every now and then there's some tech-blog outrage piece that gets into mainstream media about how "[social media] app is always listening because it asks for mic permissions" and lots of otherwise privacy conscious people just kinda shrug and carry on with it. Bit different with a government-backed app, I know. Which is why I'm glad the infosec community will be tearing into this - it's one thing open-sourcing the code, and I trust NHSX themselves, but for all we know it's been intercepted by GHCQ on its way to the app stores... Disclosure: nah, I don't have anything to do with the app, though my last 3 comments on HN have been defending it. Working in a research council, I just like seeing civil service software projects done in-house. The NHS has suffered horrifically in the past from putting out IT/software contracts out to tender to private companies, horrible waterfall dev, millions of pounds wasted. Stuff like NHSX, the team behind uk.gov and the parliament petitions site are a breath of fresh air, and I'd like it to be future proof that no you don't need to outsource everything to private companies, cough cough like trusting Google and Apple's "decentralised" (how is it decentralised??? There's no p2p networking, you're still eventually uploading data to their private databases...) approach. Outsourcing stuff to private companies is how the current gov have completely fucked this whole thing up, after all.

ealexhudson 6y ago

Location permission is a technical requirement for using Bluetooth in this way because of beacons. Lots of people keep saying the app can't work due to restrictions. Maybe, I'm not sure that has really been shown yet. A lot of the criticism doesn't really withstand the light of day.

aboringusername 6y ago
The problem is, there's no way to disassociate the two flaws with this: 1: people see "government app wants your location" 2: the government possibly using that location access at a later time I don't want to accept location on a government app, and the UK has some history with facial recognition cameras and other privacy invasive laws. So there's no way for me to know this location is only for them to use BT LE and they won't make an API call to getLocation and uploadLocationToServer. I assume once you grant location permission even for BT LE purposes it can be (ab)used in some other way. They've made their own bed with their actions, public confidence might not trust an app like this with a permission like that.
- bigfudge 6y ago
  I agree with you and won’t be installing the app. However I think you may Misjudge public mood on this. If told this ends the lockdown early it will at least be downloaded by a lot of people. Whether they keep it running when it hammers their battery is another question.
- ngcc_hk 6y ago
  Totally agreed. You cannot trust a government as there would not be oversight. An independent one with explicit safeguard against anybody other than health tracing not contact tracing will be possibly first stage. Still abuse is possibly even then. But get the institution barrier right first before we talk about technical issues.
- jka 6y ago
  It's probably exactly your concern about the ability for apps with network access to upload user data that led the Android team to introduce the locations permissions for BLE identifier scanning. Without a location requirement, an app could claim to use only Wi-Fi and BLE permissions, yet it could combine beacon scanning and data access to de-anonymize user locations. This permission requirement was introduced in Android 6.0 (see the release notes[1]) in October 2015, so it's been around for a while. If you have some suggestions around how to improve the tracking of permission usage (static analysis? run-time requests (preferably avoiding times when users are under duress and likely to click 'OK' by default)?) then you may wish to file some requests with them and/or contribute to other projects that you feel are taking a better approach. Your concerns around trust in app developers -- regardless of whether they are a government or any other entity -- are best handled by two means: - Open sourcing the code (which NHSX have done) - Enabling reproducible builds[2] so that users can confirm they have an authentic binary build of the source code [1] - https://developer.android.com/about/versions/marshmallow/android-6.0-changes#behavior-hardware-id https://developer.android.com/about/versions/marshmallow/and... [2] - https://reproducible-builds.org/ https://reproducible-builds.org/
  - antpls 6y ago
    I may be misunderstanding this thread, but what the parent is saying is that the BLE permission in Android was _never_ meant for privacy focused contact tracing, and you are saying this is not a secret. This is why Google and Apple developed the Exposure API, which is more private because it doesn't save as many metadata than the classical BLE permission, and at least Google does _not_ allow apps to declare both the Exposed API and the location permission at the same time. This gives more guarantee to the users than just trusting the app developers. In other words, any serious privacy-focused contact tracing apps should use the Google/Apple Exposure API, and not a custom made solution on tops of the older BLE permissions. However, I still think digital contact tracing, even private, is a bad idea.

urbandw311er 6y ago

I don't think you understand the technology or the privacy architecture. The location permission you refer to is related to Bluetooth and is standard. Just because the collected data is stored centrally it does not mean that it is not anonymised. And finally I would suggest the Guardian is not the best place to get a balanced view of privacy implications! I think it's an odd situation to be in where a foreign company is able to hold an elected government to ransom over its healthcare provider's technology choice.

kolleykibber 6y ago
Could you let us know if you are involved in this work?

erinaceousjones 6y ago

> I suspect this app, in this form, is DOA and will be quickly replaced. Even if they do somehow roll it out widely, there are concerns in [2] about its effectiveness working in the background. That particular issue is a bit of a niche case, which I argue is rendered less of a problem by behavioural psychology. If your devices are locked with screen off for long periods of time, you're probably at home, or generally not moving. The kind of people who are going to willingly download an app onto their smartphone like this are probably going to be actively using their devices enough throughout the day that the app can at least get a _reasonable_ sample. The best use of the data gathered from this app is supporting mass scale epidemiology, after all -- tracking contact rates on public transport and so on. This is also specific to iOS devices. Given that the current UK market share is roughly 50/50 between iOS and Android, it's unlikely your device is _only_ going to encounter other iOS devices daily, so the Android "wake up iOS devices" workaround comes into play here. > The app requests location permission on Android, something that Google doesn't allow when using their implementation. I think this is going to be less of an issue than you think it is -- even lots of tech-savvy people gleefully accept app permissions without really caring about it. It's not ideal, but Google/Android could have simply made a separate permission for bluetooth beacons instead of piggybacking on FINE_LOCATION, and have had several years to do so, yet have not chosen to do so. Every now and then there's some tech-blog outrage piece that gets into mainstream media about how "[social media] app is always listening because it asks for mic permissions" and lots of otherwise privacy conscious people just kinda shrug and carry on with it. Bit different with a government-backed app, I know. Which is why I'm glad the infosec community will be tearing into this - it's one thing open-sourcing the code, and I trust NHSX themselves, but for all we know it's been intercepted by GHCQ on its way to the app stores... Disclosure: nah, I don't have anything to do with the app, though my last 3 comments on HN have been defending it. Working in a research council, I just like seeing civil service software projects done in-house. The NHS has suffered horrifically in the past from putting out IT/software contracts out to tender to private companies, horrible waterfall dev, millions of pounds wasted. Stuff like NHSX, the team behind uk.gov and the parliament petitions site are a breath of fresh air, and I'd like it to be future proof that no you don't need to outsource everything to private companies, cough cough like trusting Google and Apple's "decentralised" (how is it decentralised??? There's no p2p networking, you're still eventually uploading data to their private databases...) approach. Outsourcing stuff to private companies is how the current gov have completely fucked this whole thing up, after all.