App-based solution for Covid-19: What can go wrong?!
In the midst of a global pandemic, data-driven solutions have become vital in tracking and controlling the spread of the virus. Several countries, including China, South Korea and Singapore have effectively used app-based contract tracing to contain the virus and curb the rate of infection.
The UK Government and the NHS are also preparing to launch an app following the example of TraceTogether, a Bluetooth-powered app created in Singapore, which was used over 800,000 times and proved to be highly successful in managing the outbreak.
How will the NHS app work?
The smartphone app that the NHSX (NHS unit for data and technology) is working on will rely on the citizens of the UK to download and self-report regularly. If you start to have the symptoms of Covid-19, you report them to the app, which then sends anonymous alerts to other app users that you have been in close contact with. These alerts are meant to notify people that they might be infected too and asks them to follow relevant guidelines even before they get any symptoms. Subsequently, if someone tests positive for coronavirus, they must update the app again and the users who had been in close proximity will get a notification to self-isolate for 14 days.
Currently, two versions of the app are being negotiated:
Technical Challenges
For the app to function properly, it will require over 50% of the population to start using it. Yet, it is unclear how the government will deal with the large number people who do not own smart phones. According to OFCOM “22% of UK adults do not have a smartphone, rising to 45% of adults over 55, and figures on device ownership for young children vary wildly.” Relying on this data will not only give misleading understanding of the situation, but will also increase inequalities, especially if such data can be used for a person to be detained. It will be equally hard to deal with those living in shared accommodations, as it might be ineffective to differentiate between people who live in a single block of flats.
Privacy Risks
Technology-enabled solutions are extremely important in disseminating useful information and increasing citizen awareness on how to fight the pandemic, but we should not ignore the risks that this app might pose towards fundamental human rights such as privacy and data protection.
A group of “responsible technologists” recently published an open letter to the CEO of NHSX and the Secretary of State for Health and Social Care outlining the risks, as well as what considerations must be made in the process of launching the contact tracing program. The authors of the open letter talk about the need for more openness about who will build the app, how it will be monitored, what safeguards will be put in place for privacy as well as more clarity on how this data will be collected and processed later.
GCHQ's National Cyber Security Centre (NCSC) names a few specific risks coming from the app. For example, if unencrypted data is stored on centralized servers, it can potentially be used by law enforcement agencies to determine when people met. Furthermore, generating new ID code once a day, instead of once every 15 minutes can make it possible to determine how much time individuals spent together or what the nature of their relationship is, which can eventually be used for “social control”.
The app will collect large sets of medical data, which can, in many cases become patient-identifiable information. In the presence of current legal framework, it is unclear how the app will collect or process this data, who will have access to it now or in the future or when it will be deleted. Unlike Australia, where the legislation strictly mandates deleting the data after the crisis, such data in the UK can be stored for a disproportionate amount of time or used for irrelevant purposes. Therefore, strong legal safeguards are required to prevent officials using the data for purposes other than identifying those at risk of being infected.
Apart from the legislation, the NCSC also suggests shifting from the “centralized” model, where contacts are matched on a computer server, to a decentralized model, where matching instead happens on individual phones.
“There can still be bugs and security vulnerabilities in either the decentralised or the centralised models," said Thinking Cybersecurity chief executive Dr Vanessa Teague. "But the big difference is that a decentralised solution wouldn't have a central server with the recent face-to-face contacts of every infected person. "So, there's a much lower risk of that database being leaked or abused.











