UK Pursues Centralized Coronavirus Contact Tracing App, Rejects Apple-Google Solution

[MacRumors]

The UK's National Health Service (NHS) is moving forward with plans to create an app for tracking coronavirus exposure that does not rely on APIs created by Apple and Google, reports the BBC.

Apple and Google's Exposure Notification System​

Apple and Google's coronavirus tracking solution is decentralized for privacy purposes, while the UK wants a centralized solution. In the UK's version, the app logs data when people are near one another, using a computer server to determine who to send alerts to when a person is diagnosed with coronavirus.

Apple and Google's coronavirus API, by contrast, does not involve a central computer for routine collection of data and determination of contacts. Instead, only when a person has tested positive for coronavirus and consents to having their data uploaded to servers run by Apple and Google does information leave the user's phone. Once the user identifies his or herself as having tested positive, their anonymized identifiers will be added to the list downloaded by all other users, where any previous contact will be determined on-device.

The decentralized approach prevents government entities or malicious people from using server logs to track individuals and identify social interactions, but the NHS argues that a centralized approach will provide more insight into how COVID-19 spreads and it will allow for more control over who receives notifications.

"One of the advantages is that it's easier to audit the system and adapt it more quickly as scientific evidence accumulates," Prof Christophe Fraser, one of the epidemiologists advising NHSX, told the BBC.

"The principal aim is to give notifications to people who are most at risk of having got infected, and not to people who are much lower risk. It's probably easier to do that with a centralised system."

The UK has been pursuing its own tracking solution since before Apple and Google announced plans to build a coronavirus tracking solution that can be utilized by governments and health agencies worldwide.

Both the Apple/Google tracking APIs and the UK's separately developed app use Bluetooth, but without using the Apple/Google API, the NHS's app has to work around Bluetooth privacy limitations that prevent apps from accessing Bluetooth when running in the background.

According to the NHSX (The NHS's digital innovation unit), its engineers have found a way to make the app work "sufficiently well" on iPhones even when the app is not active on the screen. The solution involves waking the app up in the background each time the iPhone detects another device running the same software, with the app then executing code before returning to a dormant state.

This is more battery intensive than Apple's solution, which allows Bluetooth-based communication to happen in the background without an app needing to activate.

Several other countries were also pursuing contact tracing apps that did not use Apple and Google's technology, but have since agreed to adopt the decentralized tracking APIs. Germany, for example, was creating its own app that would use a centralized server design, but Apple refused to support Germany's plan and it saw heavy criticism from scientists. Along with the UK, France is also pursuing a COVID-19 tracking app that uses a centralized server, and has even asked Apple to ease Bluetooth restrictions.

Australia recently released a COVIDSafe app that does not use Apple's APIs, and issues with Bluetooth and Low Power Mode can prevent it from working. The app has to send push notifications to people to remind them to open it every once in a while, and it can cease to work if there are too many other Bluetooth apps running. It also results in more battery drain than normal, and in some situations, such as on public transport, users are instructed to leave the app open and running.

Australia's COVIDSafe app, via ABC News Australia​

Apple and Google plan to debut their exposure notification APIs in a beta capacity this week, which will allow public health authorities that have begun developing apps to deploy them. Last week, the two companies announced a number of privacy-focused changes to further protect users and prevent location-based tracking.

Article Link: UK Pursues Centralized Coronavirus Contact Tracing App, Rejects Apple-Google Solution

 

[jlwarlow]

Let’s see how well that works I can see Apple rejecting it for using too much battery

 

[macduke]

Yeah they can frick right off. Seems like a good way to get people to just leave their phones at home.

 

[johannnn]

"The solution involves waking the app up in the background each time the iPhone detects another device running the same software, with the app then executing code before returning to a dormant state."

"and issues with Bluetooth and Low Power Mode can prevent it from working. The app has to send push notifications to people to remind them to open it every once in a while, and it can cease to work if there are too many other Bluetooth apps running. It also results in more battery drain than normal, and in some situations, such as on public transport, users are instructed to leave the app open and running"

This is why one should use API's from Apple/Google. Fighting Apple/Google is never fruitful.

 

[ruka.snow]

Good luck to them getting anyone to install their app.

 

[calzon65]

I am so torn about these types of "tracking" apps, APIs, etc. I understand the vital importance to health and defeating COVID-19, but the uneasiness that comes from this kind of detailed analysis of human movement is scary.

 

[itsmilo]

wake up every time another iPhone is detected? So always? Are they aware how many people have iPhones? Sounds like a battery sucker. Also the way all these countries rush out their apps, I expect so many security holes to come along with.

i still don’t understand how any solution is gonna help.


Day 1: shopping at Walmart, taking the bus home
Day 2: going for a walk, taking the subway home
Day 3: spending it at home
Day 4: I feel a little down but eh it’s nothing
Day 5: hmmm its not getting better
Day 6: I call the doctor and they tell me to wait for a call back
Day 8: you are getting tested / you are not getting tested for reason „1234“

at any moment during day 1 and 4 I may have gotten sick or even before. How is the App gonna help anyone? Even if I get tested, how is the test result gonna end up from the doctors notice to my phone and from there to ANYONE that was near me in day X

is everyone gonna get a push notification like „you may or may not have been in contact with someone who may or may not have gotten corona on day x or maybe day y or not at all. Also we do not know where exactly“

 

[Seanm87]

Can we choose which one to partake in?

 

[justinhill]

The Apple/Google solution isn't decentralized... the basic explanation of the scheme literally illustrates a person who has tested positive uploading their broadcast keys to a cloud. The distinction here is anonymity, not centralization.

 

[Veinticinco]

I’m not surprised if NHS managers and IT are involved. This is an organisation that still has faxes and pagers still in use. No I’m not kidding.

 

[2984839]

That's because the UK government is the malicious entity Apple and Google were trying to stop.

Once again: this is not about the virus. It never has been. Governments are using it as an excuse to do what they always wanted anyway

 

[Loge]

According to the BBC article:

Experts from GCHQ's National Cyber Security Centre have aided the effort.

 

[2984839]

According to the BBC article:

Should read that GCHQ danced a jig and had an orgasm at the thought of it.

 

[cardfan]

Hopefully there’s an option to get this tracking crap off phone.

 

[Tork]

Ugh, I hope they change their minds and implement Apple's and Google's superior solution. Regardless, I hope everyone installs it to protect themselves and their communities. If Apple or Google wanted to track you, they already can. No new privacy concerns with this. And it's a vital component of the only way to begin opening things up on a wider scale vs waiting 12-18+ months for vaccine development, testing, manufacturing, and mass-scale administration.

 

[Emanuel Rodriguez]

I’m not surprised if NHS managers and IT are involved. This is an organisation that still has faxes and pagers still in use. No I’m not kidding.

The British will never admit that the NHS has room for improvement, regardless of the stats. They focus more on protecting the NHS, when in reality the NHS should be protecting them. It's a strange situation without a doubt.

The usual retort is something along the lines of "supporting the healthcare workers", but I don't think anyone would actually disagree with that. If you really support the healthcare workers, give them a system which lets them do their jobs.

 

[PJWilkin]

I believe the UK government ( ie Mr Cummings ) has links to Palintir

As such they (and GCHQ ) probably don’t want our data to be anonymous

 

[HiRez]

Hopefully there’s an option to get this tracking crap off phone.

Apple and Google have said the code will be removed once the virus is past, although who knows what that means exactly, and of course you just have to trust them on it. With the non-Apple/Google solutions, they're just apps so I don't think they can force you to keep them on the phone (or even download them in the first place).

I definitely trust an Apple//Google solution over these more local attempts though, they sound janky as hell (combined with being rushed out) and those entities are probably way behind the rest of the tech world in terms of security and privacy. I figure if Apple and Google can agree on something it's probably OK because they don't usually agree on much when it comes to privacy.

 

[calvin2006]

I’ll get rid of my iPhone and go back to a landline if this happens. Not giving up my privacy or freedom for some dubious temporary safety. Resist.

 

[Solomani]

Yeesh. Trace and tracking of COVID19 is DOA before it even started.

 

[foobarbaz]

I am so torn about these types of "tracking" apps, APIs, etc. I understand the vital importance to health and defeating COVID-19, but the uneasiness that comes from this kind of detailed analysis of human movement is scary.

I'm very much against tracking. But the Google/Apple API is a pretty sound compromise between utility and privacy. There is no mass analysis possible, since nobody keeps your contacts except your phone. I give it a thumbs up.

The Apple/Google solution isn't decentralized... the basic explanation of the scheme literally illustrates a person who has tested positive uploading their broadcast keys to a cloud. The distinction here is anonymity, not centralization.

No, both solutions are anonymous.
In the Apple/Google API, the notification of infected users is centralized, because it has to be. But the contact matching happens only on the phone. That's the important part. In the UK model, everybody uploads their (theoretically anonymous) contacts.

If for some reason de-anonymization is possible (e.g. by observing multiple invidual bluetooth signals in the real world), the decentralized approach is still safe, while the centralized approach reveals all contacts.

 

[now i see it]

Researchers, scientists, epidemiologists and governments will love getting this tracking data. But the data will always be old news and won't protect people from contracting the virus.

I think we're at this stage (of grasping at straws) because we're pretty much powerless against the virus.

 

[smythey]

Do I trust Apple enough to install an app using their API? - Probably

Do I trust the UK government enough to install their app that doesn’t use the API? - Probably Not

 

[[AUT] Thomas]

George Orwell is likely turning in his grave...

As I said in one of my earlier postings, this API will reveal the true intentions of governments... q.e.d.
[automerge]1588012346[/automerge]

Researchers, scientists, epidemiologists and governments will love getting this tracking data. But the data will always be old news and won't protect people from contracting the virus.

That's also true for video surveillance.
That's not going to protect you from anything, but it likely helps quickly identifying someone, allowing a quicker arrest and thus preventing further damage.

 

[J.Dillinger]

I am so torn about these types of "tracking" apps, APIs, etc. I understand the vital importance to health and defeating COVID-19, but the uneasiness that comes from this kind of detailed analysis of human movement is scary.

Assuming you own or use a cell phone, your anonymous movement is and has been tracked via cell towers for the last several years.