4 ms·

Did the NHS have any good reasons why they weren't going to work with Google and Apple (who surely have more expertise for this)? Why not work on a single open

Did the NHS have any good reasons why they weren't going to work with Google and Apple (who surely have more expertise for this)? Why not work on a single open source iOS + Android app that is shared and used in all countries so we can get cross border tracing? If governments are concerned about Google and Apple getting access to data, what's the argument against the above where each country uses their own servers to store tracing data?

g_p 6y ago
The NHS wanted the ability to model "risk-from" a contact, rather than only "risk-to". In the decentralised approach, infected users upload a list of their own identifiers, these are broadcast, and everyone checks if they've been near one. There needs to be a threshold picked that will trigger to alert you - probably "contact-minutes" with an infected person. The NHS approach is less binary, as they believe based on the rate of spread that it's necessary to request people report symptoms and share their own anonymous contact log. Based on the level of exposure the "suspected individual" had with other known/suspected infected people, combined with the number of other known/suspected infected people you were near, your advice can be tailored. You might be told to isolate, but then you're asked to report symptoms regularly. Others in the same position as you will be doing so as well - there is potential here to actually tell people they no longer need to self isolate if the "group" don't have any symptoms emerging, based on the epidemiology and the rate people are believed to develop symptoms in the population. There's a good write-up of this actually in the NCSC security report and post - https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.pdf https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.... and https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contac.... It explains a lot about the rationale, and not only for security, also in terms of the approach and how the app is designed to work when people have symptoms etc.
- seanwilson 6y ago
  Thanks for that I'll have a read. Is there any discussion about other countries using this NHS app (the repo says MIT license)? Each country could customise the alert heuristic but it seems like a waste of resources for each country to code their own app for a global problem.
  - g_p 6y ago
    > Thanks for that I'll have a read. > Is there any discussion about other countries using this NHS app (the repo says MIT license)? > Each country could customise the alert heuristic but it seems like a waste of resources for each country to code their own app for a global problem. Not seen any other country talking about this yet although it only came out today in source form, and still is technically in limited beta. I imagine Australia and Singapore will be interested in the iOS Bluetooth in sleep workaround method, as that does appear to be novel and not really done before. If you implement the same basic API, it would be easy for another country to implement. The nice aspect of this design is that you can have an MVP (like UK has right now) while you evolve the more complex heuristics and models on the backend, and add those as you develop them. I'd agree it's a waste to build multiple apps, and I imagine countries will be looking at this approach now, and the value of an app with real working code, versus trying to build something. The Bluetooth protocol itself is designed to support multiple countries using it - the outer message contains a country code flag so you know which country's health system you'd need to communicate with in order to exchange info of a proximity event.
    - seanwilson 6y ago
      > the iOS Bluetooth in sleep workaround method Why do they need to find a workaround? Can't Apple tell them the best way or push an iOS patch to help?
      - g_p 6y ago
        > > the iOS Bluetooth in sleep workaround method > Why do they need to find a workaround? Can't Apple tell them the best way or push an iOS patch to help? Apple seem to take the view governments should use their decentralised approach, or not do it, and don't seem to have been willing to help governments do this without using their "joint approach" with Google. I am normally the first to back anything decentralised. But in this case, the stated goals of the app (from a very good NCSC writeup I've linked elsewhere in these comments) simply don't work with a decentralised approach (namely being able to do risk-from calculation, not just risk-to, and being able to gather and model from symptoms whether others should keep isolating or can go back to normal). Given Apple said it wouldn't help anyone not wanting to go "their" way, it's quite reassuring to see that engineers do what they do best, finding a new workaround, and making details of it available for any other devs... Perhaps Australia can use this in their app now to fix their issues with Bluetooth and iOS.
Mvandenbergh 6y ago
From one of their strategy documents: "We believe that any likely decentralised model (because there are many) will have the following impacts in the UK: -Move the health response from ‘react to symptoms’ to ‘react to clinical test results’: We cannot currently find a way to manage malicious notifications, or possible amplification attacks, in a decentralised model without authentication. Consequently, notification must be uniquely tied to an authentic clinical test. This generates a dependency on the digital authentication of clinical testing … " I hadn't thought about that but that might be quite a big flaw in the Google+Apple approach. If central verification is required in that model, it introduces a delay step which might make it a lot less effective. SARS-CoV-2 seems to be transmissible very early relative to symptoms so this central notification step would need to incredibly quick (fast enough that I don't think you could wait for someone to be swabbed and PCR+ even with a very efficient testing service which the UK does not have).
- g_p 6y ago
  I posted this in reply to another comment, but yes this does appear to be the flaw of the Google/Apple approach. Assuming the incubation time is just over 5 days (seems a broad consensus here), and someone is at their most infectious in the day or 2 prior to this (not sure if this is yet broadly agreed, but some studies are suggesting this [1]) Imagine that person A is infected on day 1. On day 4, A met with B and C. A experiences symptoms a few hours into day 6. With a decentralised approach, you really need the certainty of a test before uploading anything, to stop Sybil-like attacks. Most probably, A would be tested the following day (day 7), and get a result (while isolating at home) a few hours into day 8. Meanwhile, B and C are walking around in the population, on day 7 and 8 (days 3 and 4 of their own infection, the time they are likely to be most infectious). They get asked to return home, and probably experience symptoms the next morning. In the NHS approach, when A experiences symptoms on day 6, they report this via the app, and are told to get home and self-isolate. B and C might also be asked to isolate, based on their contact with A, at this time (as well as their general perceived risk from any other infected individuals they might have had distant contact with - the NHS app can consider multiple potential sources of infection to an individual, and aggregate the risk). This gets B and C at home and isolated on day 2 of their own infection, and has them at home during their 2 most infectious days. If neither gets symptoms, and others exposed to A don't develop symptoms either, the daily "how are you feeling" polling via the app for symptoms will be able to capture that based on lack of symptoms, there likely wasn't exposure, and the group can leave self-isolation. Testing then augments this for more certainty, but this model does appear to be quite novel and unique, and near impossible to do in the decentralised approach (especially some of the more complex parts like deciding how likely A is to spread the virus, based on A's own exposure to infected people in A's recent past, and the date A reports symptoms). When taking this into account, I'm not sure how a "testing-based" model can work, unless there's pre-emptive screening being done. I don't think many countries have the capacity to pre-emptively screen asymptomatic people with the regularity and coverage you'd need to benefit from reacting to test results. [1] https://eu.usatoday.com/story/news/nation/2020/04/17/covid-19-patients-most-contagious-1-2-days-before-symptoms/5143641002/ https://eu.usatoday.com/story/news/nation/2020/04/17/covid-1...

g_p 6y ago

The NHS wanted the ability to model "risk-from" a contact, rather than only "risk-to". In the decentralised approach, infected users upload a list of their own identifiers, these are broadcast, and everyone checks if they've been near one. There needs to be a threshold picked that will trigger to alert you - probably "contact-minutes" with an infected person. The NHS approach is less binary, as they believe based on the rate of spread that it's necessary to request people report symptoms and share their own anonymous contact log. Based on the level of exposure the "suspected individual" had with other known/suspected infected people, combined with the number of other known/suspected infected people you were near, your advice can be tailored. You might be told to isolate, but then you're asked to report symptoms regularly. Others in the same position as you will be doing so as well - there is potential here to actually tell people they no longer need to self isolate if the "group" don't have any symptoms emerging, based on the epidemiology and the rate people are believed to develop symptoms in the population. There's a good write-up of this actually in the NCSC security report and post - https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.pdf https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.... and https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contac.... It explains a lot about the rationale, and not only for security, also in terms of the approach and how the app is designed to work when people have symptoms etc.

seanwilson 6y ago
Thanks for that I'll have a read. Is there any discussion about other countries using this NHS app (the repo says MIT license)? Each country could customise the alert heuristic but it seems like a waste of resources for each country to code their own app for a global problem.
- g_p 6y ago
  > Thanks for that I'll have a read. > Is there any discussion about other countries using this NHS app (the repo says MIT license)? > Each country could customise the alert heuristic but it seems like a waste of resources for each country to code their own app for a global problem. Not seen any other country talking about this yet although it only came out today in source form, and still is technically in limited beta. I imagine Australia and Singapore will be interested in the iOS Bluetooth in sleep workaround method, as that does appear to be novel and not really done before. If you implement the same basic API, it would be easy for another country to implement. The nice aspect of this design is that you can have an MVP (like UK has right now) while you evolve the more complex heuristics and models on the backend, and add those as you develop them. I'd agree it's a waste to build multiple apps, and I imagine countries will be looking at this approach now, and the value of an app with real working code, versus trying to build something. The Bluetooth protocol itself is designed to support multiple countries using it - the outer message contains a country code flag so you know which country's health system you'd need to communicate with in order to exchange info of a proximity event.
  - seanwilson 6y ago
    > the iOS Bluetooth in sleep workaround method Why do they need to find a workaround? Can't Apple tell them the best way or push an iOS patch to help?
    - g_p 6y ago
      > > the iOS Bluetooth in sleep workaround method > Why do they need to find a workaround? Can't Apple tell them the best way or push an iOS patch to help? Apple seem to take the view governments should use their decentralised approach, or not do it, and don't seem to have been willing to help governments do this without using their "joint approach" with Google. I am normally the first to back anything decentralised. But in this case, the stated goals of the app (from a very good NCSC writeup I've linked elsewhere in these comments) simply don't work with a decentralised approach (namely being able to do risk-from calculation, not just risk-to, and being able to gather and model from symptoms whether others should keep isolating or can go back to normal). Given Apple said it wouldn't help anyone not wanting to go "their" way, it's quite reassuring to see that engineers do what they do best, finding a new workaround, and making details of it available for any other devs... Perhaps Australia can use this in their app now to fix their issues with Bluetooth and iOS.

Mvandenbergh 6y ago

From one of their strategy documents: "We believe that any likely decentralised model (because there are many) will have the following impacts in the UK: -Move the health response from ‘react to symptoms’ to ‘react to clinical test results’: We cannot currently find a way to manage malicious notifications, or possible amplification attacks, in a decentralised model without authentication. Consequently, notification must be uniquely tied to an authentic clinical test. This generates a dependency on the digital authentication of clinical testing … " I hadn't thought about that but that might be quite a big flaw in the Google+Apple approach. If central verification is required in that model, it introduces a delay step which might make it a lot less effective. SARS-CoV-2 seems to be transmissible very early relative to symptoms so this central notification step would need to incredibly quick (fast enough that I don't think you could wait for someone to be swabbed and PCR+ even with a very efficient testing service which the UK does not have).

g_p 6y ago
I posted this in reply to another comment, but yes this does appear to be the flaw of the Google/Apple approach. Assuming the incubation time is just over 5 days (seems a broad consensus here), and someone is at their most infectious in the day or 2 prior to this (not sure if this is yet broadly agreed, but some studies are suggesting this [1]) Imagine that person A is infected on day 1. On day 4, A met with B and C. A experiences symptoms a few hours into day 6. With a decentralised approach, you really need the certainty of a test before uploading anything, to stop Sybil-like attacks. Most probably, A would be tested the following day (day 7), and get a result (while isolating at home) a few hours into day 8. Meanwhile, B and C are walking around in the population, on day 7 and 8 (days 3 and 4 of their own infection, the time they are likely to be most infectious). They get asked to return home, and probably experience symptoms the next morning. In the NHS approach, when A experiences symptoms on day 6, they report this via the app, and are told to get home and self-isolate. B and C might also be asked to isolate, based on their contact with A, at this time (as well as their general perceived risk from any other infected individuals they might have had distant contact with - the NHS app can consider multiple potential sources of infection to an individual, and aggregate the risk). This gets B and C at home and isolated on day 2 of their own infection, and has them at home during their 2 most infectious days. If neither gets symptoms, and others exposed to A don't develop symptoms either, the daily "how are you feeling" polling via the app for symptoms will be able to capture that based on lack of symptoms, there likely wasn't exposure, and the group can leave self-isolation. Testing then augments this for more certainty, but this model does appear to be quite novel and unique, and near impossible to do in the decentralised approach (especially some of the more complex parts like deciding how likely A is to spread the virus, based on A's own exposure to infected people in A's recent past, and the date A reports symptoms). When taking this into account, I'm not sure how a "testing-based" model can work, unless there's pre-emptive screening being done. I don't think many countries have the capacity to pre-emptively screen asymptomatic people with the regularity and coverage you'd need to benefit from reacting to test results. [1] https://eu.usatoday.com/story/news/nation/2020/04/17/covid-19-patients-most-contagious-1-2-days-before-symptoms/5143641002/ https://eu.usatoday.com/story/news/nation/2020/04/17/covid-1...