England ditches central database model for test-and-trace apps in favour of Apple/Google approach
- Reference: 1592495855
- News link: https://www.theregister.co.uk/2020/06/18/uk_ditches_central_database_model/
- Source link:
The decision follows news that the app, once said to be a key part of the government's test-and-trace system, [2]wouldn't be ready until at least winter this year .
[3]According to the BBC , the government's plan to pinpoint phones with specific identifiers and match those within Bluetooth proximity on a central database are being dropped for Apple and Google's "decentralised" approach. In the model favoured by the IT giants, matches take place on users' handsets.
The shift has won support from privacy campaigners, who were concerned that a central database of phone identifiers could be open to abuse.
Jim Killock, executive director of the Open Rights Group, said: "People need to trust the app, and it needs to work. Some countries using decentralised matching have already released their apps. It will also work across borders.
"We are still worried that employers and others may try to force people to use the app. A safeguards bill could help by making this unlawful," Killock said.
It is debatable whether NHSX, the department responsible for developing the app, made the U-turn because of concerns over privacy or difficulties in getting it to work. Both Dell's VMware GO Pivotal and Swiss consultancy Zühlke Engineering won [4]contracts dating from March onwards for work on the NHSX app. The government reportedly asked the devs to look at switching to the Apple/Google model [5]back in May .
Australia's contact-tracing app still basically borked on iOS, says new bug report – and GAPPLE API version tested [6]READ MORE
Yesterday, Lord Bethell, Minister for Innovation at the Department for Health and Social Care, [7]told the Science and Technology Committee the app would be ready "for the winter".
"There are technical challenges. We're getting the app right and we are really keen to make sure that we get all aspects of it correct, so we're not feeling under time pressure," he said.
But the change in policy on the app model could affect the data's value to future scientific research.
When the government first proposed the app in April, Professor Christophe Fraser, one of the epidemiologists advising NHSX, [8]said : "One of the advantages is that it's easier to audit the system and adapt it more quickly as scientific evidence accumulates. It's probably easier to do that with a centralised system."
In the approach taken to the test-and-trace app proposed by Google and Apple, phones generate completely distinct and random identifiers for each interaction. The random nature of these identifiers makes it more difficult to profile an individual from a key. Because just 14 days' worth of keys are retained, only data needed for track and trace is retained. It would be harder for a hacker to trace an individual's movements from the data, compared with a central database model.
In separate news, [9]The New York Times has claimed the work done by outsourcers on the UK's current call centre-based test-and-trace programme has already cost the taxpayer £108m.
At the same time, Wikipedia founder Jimmy Wales has offered to roll out the German Corona-Warn-App in the UK in a short time at "zero cost to the taxpayers". "If the government can't pull themselves together, we can," [10]he threatened in a tweet .
NHSX has so far declined The Register 's invitation to comment.
During England's COVID-19 daily briefing at 17:00 local time (16:00 UTC) today, Baroness Dido Harding, [11]christened the queen of carnage for her hacking-marred tenure at the helm of TalkTalk , is set offer her version of events on both the app and the test-and-trace programme – which she leads, readers will be assured to know. ®
Sponsored: [12]Kubernetes: Your Hybrid Cloud Strategy
[1] https://www.theregister.com/2020/05/21/apple_google_coronavirus_api/
[2] https://www.theregister.com/2020/06/18/uk_test_trace_app_winter/
[3] https://www.bbc.co.uk/news/technology-53095336
[4] https://www.contractsfinder.service.gov.uk/Notice/Attachment/242425
[5] https://www.theguardian.com/technology/2020/may/07/uk-may-ditch-nhs-contact-tracing-app-for-apple-and-google-model
[6] https://www.theregister.com/2020/06/16/covidsafe_update_ios_issues_persist/
[7] https://www.theregister.com/2020/06/18/uk_test_trace_app_winter/
[8] https://www.bbc.co.uk/news/technology-52441428
[9] https://www.nytimes.com/2020/06/17/world/europe/uk-contact-tracing-coronavirus.html
[10] https://twitter.com/jimmy_wales/status/1273540187163852801
[11] https://www.theregister.com/2015/10/27/talktalk_incident_management_review/
[12] https://go.theregister.com/tl/1956/-8472/kubernetes-your-hybrid-cloud-strategy?td=wptl1956
Re: Had to happen
And like the back-and-forth on the utility of wearing masks in the U.S., the zig-zagging is probably going to hold back general uptake of the tracking app, because people will have heard that there are serious privacy problems with the overall tracking app/process.
Still, baby steps I guess.
Re: Had to happen
Because the arrogant bastards don't want to admit they may have killed people.
Re: Had to happen
>Why did they have to be so obstinate and waste so much time?
Because up until a few weeks ago the T&T systems decisions were being taken by NHSX. NHSX is a tiny body run by an ex-spook invented out of nowhere last year to offer tech point solutions to hard problems. This means in practice they have been principally funnelling money to a small company called Faculty, who are to all intents and purposes the commercial arm of the Vote Leave campaign's analytics team - this means they're Dominic Cummings's mates.
They drafted in Palantir to help. This was done at no additional cost - it was a natural emergency, naturally - but Palantir and Faculty (and others) would retain rights to IP developed during the T&T engagement. This would include derived machine learning models and statistical analyses. All based on the most sensitive data we could possibly have - minute by minute accounting of where you've been and who you've been near, cross referenced with your confidential NHS data and then handed over to the Home Office and to the least ethical companies in data and analytics.
T&T decisions were recently moved under Dido Harding who (and this is important) reports to NHS England, who operate on a proper statutory basis - NHSX report to the minister directly, so have no real supervision or oversight or purpose. Dido might not have the best reputation in these parts, but she is not a complete idiot and NHSE are almost certainly more concerned with building a functioning T&T system than they are in trying to harvest all our secrets for nefarious uses.
Re: Had to happen
Ah yes, NHSX. Matt Hancock's technology vanity project. The GDS of the National Health Service - long on blue sky thinking, short on implementation. In fact some of the senior GDS bods went across to it, if I recall correctly.
As a former TalkTalk customer I'm no fan of Dido Harding, but if the governance is as you say then even she's probably going to be an improvement.
Re: Had to happen
>but if the governance is as you say then even she's probably going to be an improvement.
Quite. And it's easy to take the lazy option and just go "Ar well this is just how government IT works isn't it?", but this is so, so much worse. In contrast to this debacle, HMRC staff and their commercial suppliers knocked out the furlough scheme infrastructure from scratch, to spec in 10 weeks with absolutely no major issues in delivery or operations. That was a genuinely "world-beating" system - larger in scale and ambition than anything anyone else has done in that kind of timescale or with that volume of money on the line.
Government should be singing from the rafters on how successful that project has been, and how they had within the last few years carefully moved away from the monolithic external supplier model (i.e. the one NHSX uses) to a hybrid, in-sourced model where contractors are brought into civil servant-led teams allowing them to work quickly, to scale and actually deliver on government priorities. Instead we've got ministers being sent out to bat to defend NHSX's wholesale abrogation of their responsibilities, saying nonsense like "we backed both horses" or blaming Apple for "not changing their model".
NHSX and their partners have real blood on their hands over this, and I hope everyone who works there thinks long and hard about this. Public sector IT is not a game. Playing with your Powerpoints and your pitches is fun - making some money off the government talking shit about machine learning is fun. But at the end of the day these are real lives and people - lots of people - have died.
Re: Had to happen
Wait, you're saying HMRC can do something very successfully if they pull their finger out of their arsehole?
Re: Had to happen
"There are technical challenges."
Talking to people we know a lot have said that they tried the app but ditched it due to draining the battery and in some cases making the 'phone hot to the touch. Added to the fact that it appears to not work with the iPhone as the OP titled this thread it had to happen.
Use an API tailored to the task
Rather than trying to hack your way around the security restrictions of iOS and Android? That and use an internationally approved model with privacy baked in. HMG must be fuming that they can’t get their hands on all that juicy data. Oh well, people might actually be prepared to use it then.
Hancock is, at this very second, on national television saying words to the effect of:
"We found that our app works well on Android devices. But, Apple software prevents iPhones, being used effectively for contact tracing
...
So as it stands, our app won't work because Apple won't change their system"
This should not have come as a surprise, Matthew, given Apple warned every country on the planet in no uncertain terms that they would not let anyone break the Bluetooth security model unless they played by the new rules. This warning was given at the end of _April_. This wasn't Apple not playing ball or being obstinate. This was your idiots at NHSX being so arrogant they believed they'd be allowed to harvest everyone's data without purpose, and that Google and Apple would just play along.
Google and Apple. Those are the people looking down on what you had planned for our data. That's the level you're at. Own it, don't dare try and shift the blame for this.
Google and Apple should have written the apps themselves and then published it out.
Then you would have one app that works no matter where on the planet you happen to be and everyone is covered anonymously.
Yes I am prepared for the downvotes
This is not a stupid idea, and some of this has happened. But the missing bit is that you need to be able to verify someone has tested positive, otherwise people could just maliciously claim to be infected to menace their neighbours, safe in the blanket of anonymity we've fought for the system to have. So there needs to be a degree of engagement with the relevant local health authority to allow people to prove they have actually tested positive - probably with some kind of one-time authentication code.
There's also a requirement for the local authority to set up the intermediate publish/subscribe infrastructure for the notification process itself - Gapple want no part in that.
I really wish they'd find some adults to take charge
Pandemic planning, emergency stockpiles, lockdown timing, care homes. ventilator challenge, personal protective equipment, school reopening, track 'n trace, UK entry controls only when it became pointless, and now the app
It would be amusing if it hadn't already cost tens of thousands of lives.
If it has cost £108M that is more than the vaccine development program!
... which is completely ridiculous for a (relatively) small software project...
(The government has given the Oxford vaccine group £20M to do the trials - OK Astrazenica are putting some money in now for the later phases particularly outside the UK and ramping up the production trials but still nowhere near another £88M)
Re: If it has cost £108M that is more than the vaccine development program!
I think you'll find creating several hundred million vaccines, that may not work, is a tad more expensive than 88million.
Re: If it has cost £108M that is more than the vaccine development program!
Yes. And IF it doesn't work (which I really hope it does!), AZ are proceeding at risk and won't get paid by anyone else. No government money goes to them...
They have also said they will sell it "at cost" for the duration of the pandemic - they're gambling that they are going to make their money when the pandemic is over and people need a booster ever 1,2,5,... years (it isn't known how long the antibodies will last yet, obviously, for a new vaccine!).
Re: If it has cost £108M that is more than the vaccine development program!
AFAICT, the £108M is for the [1]contract with Serco to provide the "human" infrastructure of barely-trained customer service agents. The contract was effectively given to Serco, it seems, as it seemed unlikely anyone else had the ability to roll out the required number of people quickly. The CEO of Serco said that the contract would help in [2]cementing the position of the private sector companies in the public sector supply chain , so they've generously allowed themselves only a small profit margin.
Not to be confused with the £108M that went to a small [3]pest-control company to supply large amounts of PPE .
Also not to be confused with the £108M spent on [4]3 contracts for Brexit ferry services , including the infamous firm with no ships.
It's curious that this figure comes up again and again in relation to "emergency" procurement that doesn't seem to go through the normal tendering process.
But we'll all be too busy admiring Boris's Union Jack sky-penis to notice any of that.
[1] https://www.nytimes.com/2020/06/17/world/europe/uk-contact-tracing-coronavirus.html
[2] https://www.theguardian.com/society/2020/jun/04/nhs-track-and-trace-system-not-expected-to-be-operating-fully-until-september-coronavirus
[3] https://www.crowdjustice.com/case/108million/
[4] https://twitter.com/JolyonMaugham/status/1273603897668624391
Duplicate article
Don't you hacks check to see if someone else has already covered this?
Had to happen
It was just a question of time. Why did they have to be so obstinate and waste so much time?
Sigh