UK coronavirus tracking app - discussion

[Sunray]

You're missing the point. It doesn't matter how long it takes them to develop the thing. It takes months or years or infinite time to deploy to devices. On Android it has to go through the OEM like Samsung or whoever. Probably the majority of devices are out of active support. The situation is better on iOS but you only need look at version distribution to see the lag.

It cannot.

I was making reference to future pandemics, once in the OS's of everyone's phones it can be reactivated as a useful tool to help track and trace. I hope I never see another in my lifetime, but I think they are a fact of life until we figure out how to prevent all viruses.

 

[mauvais]

I was making reference to future pandemics, once in the OS's of everyone's phones it can be reactivated as a useful tool to help track and trace. I hope I never see another in my lifetime, but I think they are a fact of life until we figure out how to prevent all viruses.

You were on about how it can be deployed this month. It can't, not in majority numbers, and that's within the set of people lucky enough to have the latest phones. There is no quick fix for C19.

As for dedicated devices, I can't really be bothered to repeatedly make the same point, but the general purpose smartphone is not an ideal platform for this job, even if it became more tailored to it in terms of OS support. The set of devices in operation is much too fragmented, the battery life is shit, people are busy doing other and often contradictory things with their phones, if they even have one, etc etc. - smartphone adoption is saturated, but the specifics of it are much more complicated.

Since you can buy a new phone for £20 or less, you have a rough idea of the minimum cost of mass manufacture. A dedicated device solves most of the problems. If governments were serious about doing this for the whole population, rather than it being a nice-to-have dressed up as essential, they would be looking at something like this.

 

[Sue]

That'd be the entire board wiped out in one fell swoop...

 

[Part-timah]

If you read the document it explains in detail how it's totally anonymous, it really is.

That’s a very naive statement. Bless.

 

[Sunray]

That’s a very naive statement. Bless.

Just because you say something doesn't make it true.

 

[2hats]

From:

Coronavirus: Security flaws found in NHS contact-tracing app

The UK's National Cyber Security Centre acknowledges problems identified by an independent report.

www.bbc.co.uk

Problems with the NHSX app highlighted:

• No checking of Authority Public Key
• InstallationID and the HMAC key spoofing and privacy issues
• Overly long lived BroadcastValues undermines privacy
• Interaction monitoring facilitates re-identification
• Keep alive ping facilitates tracking beyond design window
• Log uploads are not encrypted
• Log data is not encrypted at rest

Details:

Security analysis of the NHS COVID-19 App

Detailed security analysis of the NHS COVID-19 App by Chris Culnane and Vanessa Teague

www.stateofit.com

Amusingly NCSC's analysis admittedly not quite so thorough:

GCHQ's National Cyber Security Centre (NCSC) told the BBC it was already aware of most of the issues raised and is in the process of addressing them.

 

[weltweit]

Anyone seen any feedback from the users in the IoW anywhere?

 

[Badgers]

Going well then...

Plans for contact-tracing in doubt as app not ready until June

Deputy chief scientific adviser suggests track-and-trace stopped in March due to lack of capacity

www.theguardian.com

 

[Badgers]

Going well then...

Coronavirus: Serco apologises for sharing contact tracers' email addresses

Outsourcing giant Serco has apologised for the data breach, which affects almost 300 people.

www.bbc.co.uk

 

[weltweit]

Going well then...

Plans for contact-tracing in doubt as app not ready until June

Deputy chief scientific adviser suggests track-and-trace stopped in March due to lack of capacity

www.theguardian.com

And I thought the IoW trial was underway?

 

[Sue]

So before there was mention of using Environmental Health staff for contact tracing as they have some experience of this type of work/can't currently do a lot of their usual stuff.

Obviously there wouldn't be enough of them to do all of this but iirc they mentioned 5000 people who could be redeployed to this. Anyone know what happened with that?

Eta Looks like they fucked it up...

UK missed coronavirus contact tracing opportunity, experts say

Thousands of council workers could have been deployed by the government but were not asked

www.theguardian.com

 

[Badgers]

So before there was mention of using Environmental Health staff for contact tracing as they have some experience of this type of work/can't currently do a lot of their usual stuff.

Obviously there wouldn't be enough of them to do all of this but iirc they mentioned 5000 people who could be redeployed to this. Anyone know what happened with that?

Eta Looks like they fucked it up...

UK missed coronavirus contact tracing opportunity, experts say

Thousands of council workers could have been deployed by the government but were not asked

www.theguardian.com

Going well then...

 

[William of Walworth]

festivaldeb works for the Council here, and from some talk on Monday, it seems that there's going to be significant numbers of Council employees redeployed to tracing-related phone work.

When, and which ones?

Completely uncertain so far, but deb (who'll be sticking with her WFH job) will be keeping a keen ear out to hear more about this, as several of her colleagues will most likely be involved.

I was wondering whether any other local-authority-working Urbans might have heard anything similar in other councils.

 

[Part-timah]

From:

Coronavirus: Security flaws found in NHS contact-tracing app

The UK's National Cyber Security Centre acknowledges problems identified by an independent report.

www.bbc.co.uk

Problems with the NHSX app highlighted:

• No checking of Authority Public Key
• InstallationID and the HMAC key spoofing and privacy issues
• Overly long lived BroadcastValues undermines privacy
• Interaction monitoring facilitates re-identification
• Keep alive ping facilitates tracking beyond design window
• Log uploads are not encrypted
• Log data is not encrypted at rest

Details:

Security analysis of the NHS COVID-19 App

Detailed security analysis of the NHS COVID-19 App by Chris Culnane and Vanessa Teague

www.stateofit.com

Amusingly NCSC's analysis admittedly not quite so thorough:

But it’s totally 100% privacy protecting how could this be?! ;-)

 

[Sunray]

Apple and Google completed the work for their exposure notification system. It's not an App, but allows health care systems to develop an App more easily.

Apple releases iOS 13.5 beta with coronavirus exposure notification (Updated: Google too)

Apple has released a beta version of its iOS operating system for iPhones, adding the coronavirus exposure notification system it co-developed with Google.

venturebeat.com

The tech giants, in their paper, do say its just another cog in the pandemic machinery, not a way to solve the issue.

 

[Badgers]

Going well then...

 

[Buddy Bradley]

Going well then...

Matt Hancock was on the news this morning telling everyone that the contact tracing assessment would be done by "doctors" and "trained clinicians"...

 

[Mogden]

I won't be installing it for now. I did read a few posts on Twitter saying the IOW trial app had "gone missing". There wasn't enough context for me to establish what that means and I can't find it now but given the history of NHS technology developments, it's best to steer clear. The London Ambulance Service disaster was drummed into me during my degree and there have been instances since. It's not the privacy issue so much as the false assurances it will create. There is no substitute for isolating regardless of the technology.

Even if we had the same app as South Korea, or anyone else with relevant technological success, their more conformist attitude won't work the same for our beer brigades who will be top off, swigging Stella in the park at the first sniff of being allowed out properly.

 

[Mogden]

Going well then...

Twitter is alight with minimal wage people who have been ousted from roles by Covid, now getting back to work by becoming a thankless phone monkey for this.

 

[Teaboy]

There is no substitute for isolating regardless of the technology.

Yeah, spot on. This seems to be the most important thing coming out of all of this.

Even if we had the same app as South Korea, or anyone else with relevant technological success, their more conformist attitude won't work the same for our beer brigades who will be top off, swigging Stella in the park at the first sniff of being allowed out properly.

Dunno where you live, but this started weeks ago in SW London. Though it tends to be Italian beers and Prosecco.

 

[Mogden]

Yeah, spot on. This seems to be the most important thing coming out of all of this.



Dunno where you live, but this started weeks ago in SW London. Though it tends to be Italian beers and Prosecco.

I'm in Derby mate, it's been going on throughout but I thought I'd be generous

 

[brogdale]

From the state's own 'privacy' notice:



Obviously not dodgy as fuck.

 

[Lord Camomile]

Very stupid question almost certainly already covered: has it been routine for countries' track and trace methodology to rely on the public downloading an app?

I know it's impossible at this stage, but my impression was "track and trace" generally meant when someone tested positive, they asked them where they've been and then spoke to everyone who had been in the same place at the same time.

Just want to make sure I have a full grasp of how incompetent and irresponsible our government has been.

 

[Mogden]

From the state's own 'privacy' notice:

View attachment 215069

Obviously not dodgy as fuck.

Oh dear So basically we'll keep all data from the app for 20 years then.

It's all identifiable. There is no such thing as anonymous in this instance anyway. I don't have to be shown the Colonel Mustard card in Cluedo to know if he is the murderer, I can use deduction and the same applies.

 

[souljacker]

You do all realise that this new thing is nothing to do with the app?

 

[brogdale]

You do all realise that this new thing is nothing to do with the app?

Yep.

https://contact-tracing.phe.gov.uk/help/privacy-notice

If you engage with the Serco/DidoHarding scheme your own details kept for 20 years & anyone else's data you offer up for 5.
Maybe Cummings sees a trade opportunity?

 

[Mogden]

You do all realise that this new thing is nothing to do with the app?

They're still hoping to introduce it as part of the measure to get infected people to isolate. They're presenting false assurances. I was speaking to someone at the weekend who has only just received their 12 week isolation letter.

 

[Teaboy]

Very stupid question almost certainly already covered: has it been routine for countries' track and trace methodology to rely on the public downloading an app?

I know it's impossible at this stage, but my impression was "track and trace" generally meant when someone tested positive, they asked them where they've been and then spoke to everyone who had been in the same place at the same time.

Just want to make sure I have a full grasp of how incompetent and irresponsible our government has been.

Apparently the app is just one aspect of track, trace and isolate. It's what some countries have been doing since day 1, even the UK did it a bit before we threw in the towel because the systems were not in place.

The app is just a novel and new way of trying to make this system work better. Currently I'm not sure whether any country has used a version successfully.

 

[littlebabyjesus]

It's never going to happen, is it? Now they're saying the plan all along was to start the system without the app and introduce it later, which is obvious bollocks. What's the betting in a couple of weeks' time that mysteriously the app will never be mentioned again?

 

[brogdale]

Reckon they'll get some amusing contact lists if they ring up anyone in/near Barnard Castle!