UK centralised contact-tracing app probably won't work well, may be illegal

https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/

by samizdis • 6 years ago

119 59 6 years ago

theregister.co.uk

samizdis• 6 years ago

Despite what the NCSC has continued to imply, the app will not, as it stands, work all the time on iOS and Android since version 8. The operating systems won't allow the tracing application to broadcast its ID via Bluetooth to surrounding devices when it's running in the background and not in active use.

drumhead• 6 years ago

They're testing app on the Isle of Wight now, we'll soon see how effective it is. If it doesnt work, then I'm assuming they'll fall back to the Apple/Google option?

jon889• 6 years ago

ahah, more likely the company (I think Palantir, might be wrong) will get paid anyway and won't care what the results are.

Endlessly• 6 years ago

Palantir’s contract for this is £1.

Google [palantir £1 nhsx] to confirm.

rjknight• 6 years ago

From https://www.bbc.co.uk/news/technology-52441428

The UK's coronavirus contact-tracing app is set to use a different model to the one proposed by Apple and Google, despite concerns raised about privacy and performance.
The NHS says it has a way to make the software work "sufficiently well" on iPhones without users having to keep it active and on-screen.
That limitation has posed problems for similar apps in other countries.
Experts from GCHQ's National Cyber Security Centre have aided the effort.

At the time, I definitely saw people assuming that this meant that some kind of exploit was being used to achieve access to Bluetooth while the app was inactive, even though regular APIs do not permit this. The new technical information doesn't directly address this point, though the Register article does suggest a plausible alternative, whereby one user with an actively-running app can cause the app to wake on other users' phones by sending out a Bluetooth LE broadcast. I've no idea how this would perform in practice.

lb1lf• 6 years ago

-I'd be surprised if some unknown exploit was being used to gain access to Bluetooth - basically, it would probably be too useful for other, more nefarious purposes, so it would be unlikely to be used in an app deployed to millions.

The Norwegian NHS equivalent had a similar app developed, running off-screen on both Android and iOS, using Bluetooth - though I have no idea how they pull it off.

Edit: The above paragraph is incorrect; my apologies. I did some research and found that the app only uses Bluetooth on iOS when the phone is unlocked; however the app itself may be off-screen.

While the phone is locked, it relies on GPS for positioning and presumably correlates location and time data to indicate whether you may have been exposed to an infected person or not.

Irrelevant anecdote - as I am typing this, Spotify put on The The's 80s hit 'Infected'. Hah!

Svip• 6 years ago

Germany turned on a dime, and is going to use the Google/Apple solution. Denmark is about to turn on the same dime, as our solution mirrored the Norwegian solution, but had the same iOS problems (I only read that the government was strongly considering the Google/Apple solution, but no verdict yet).

jamespeters168• 6 years ago

There are also some people raise privacy concern

aclelland• 6 years ago

Could someone explain how the new APIs that are being proposed by Google/Apple will actually be delivered to Android handsets? I'm running a 2 year old Android device which generally gets security updates 2-3 months behind Google devices. Will I be at the mercy of my phone manufacturer before I'll be able to use the new Google/iOS apps?

72deluxe2• 6 years ago

Not definitive but I think they push APIs out in Google Play Services, which is a big blob of an APK. They did this a few Android versions ago so that they could bypass the lack of OS updates from manufacturers.

barbegal2• 6 years ago

The technical aspects discussed are slightly wrong because they are different between iOS and Android.

The NHS has insisted its engineers have worked around this problem "sufficiently well" by waking the app after it detects itself running on a nearby phone emitting an ID: the software is blocked from sending out its ID when in the background but it can passively listen for IDs of apps still allowed to broadcast. However, this assumes there are a sufficient number of phones running the tracing app nearby still broadcasting to keep enough people's apps awake: there needs to be a critical mass of users while we're all supposed to be socially distancing. If two or more people pass each other and their apps have stopped broadcasting, the software will never know they came in contact.

Bluetooth LE has four main states: scanning, advertising, peripheral connection, and central connection. In order to exchange the data that the app needs it needs one device in the peripheral connection mode and the other in the central connection mode. This means one device must have previously been advertising and the other scanning. The two important states are advertising and scanning.

Android devices can advertise in the background but they can't scan reliably, they can do this for a short period of time enforced by the Android time limits on apps running in the background and possibly manufacturer specific power savings measures. These limits are not well documented and cause issues on any device using Bluetooth.

iOS devices can't advertise in the background, however they do advertise an Apple specific advertisement which can't be controlled by the app but can still be connected to. iOS devices also can't reliably scan in the background however they can scan more reliably for iBeacons (special adverts) [1]

Combined this makes it difficult to work well in the background, Android devices can't reliably connect to any device, iOS devices can't connect to each other but iOS devices may be able to connect to Android devices.

[1] https://developer.apple.com/documentation/corelocation/deter...

72deluxe2• 6 years ago

It'll be interesting to see how often it gets killed due to the heavy-handed battery management of some vendor's phones: https://dontkillmyapp.com

jka• 6 years ago

Regarding communication from Android devices - BLE connections may be difficult, but as I understand it, BLE broadcasting is a workable alternative.

I'm by no means an expert, and would refer to the TCN Coalition's current explanation of their approach to cross-platform device communication:

https://github.com/TCNCoalition/TCN/blob/37add39f7ddb91fade9...

barbegal2• 6 years ago

Thanks for the link. They assume that Android devices can scan in the background but my experience is that whilst this is theoretically achievable, the experience is unreliable in practice. See this guide which shows how to make things more reliable https://openpathsupport.zendesk.com/hc/en-us/articles/360024...

And they state that for iOS in background mode:

A nearby Android device acts as a bridge. It receives TCNs through “central” write operations and adds them to a rotating list to broadcast alongside its own TCN.

Which doesn't sound that reliable or accurate.

IshKebab• 6 years ago

On Android the broadcasting bit is fine. But to effectively scan for advertisements you need to start a foreground service and actively scan for them continuously. That will keep the phone awake all the time and rinse your battery. It also don't really work very well because Android's Bluetooth stack is shockingly unreliable.

iOS is much much better. You can scan for iBeacons (a restricted subset of advertisements) continuously in the background and it works extremely well. Their Bluetooth stack is a million times faster and more reliable than Android's. But I'm pretty sure there is no way to scan for, or broadcast non-iBeacon advertisements in the background.

There are waaaay too many gotchas to do this reliably without OS support.

steffandroid• 6 years ago

Android devices can advertise in the background but they can't scan reliably, they can do this for a short period of time enforced by the Android time limits on apps running in the background and possibly manufacturer specific power savings measures.

Since Android 8.0 there are no time limits for background scanning if you're calling startScan() with a PendingIntent. It's not 100% reliable, particularly on devices which aren't on stock Android as you mention, but it works reasonably well.

gorgoiler• 6 years ago

In the article, regarding the site of John Snow’s famed epidemiological discovery of cholera in 19th century London water supplies:

There is a plaque and a [water] pump, and the John Snow pub opposite

The plaque and pump were removed several years ago, much to my dismay as an amateur London tour guide.

The pump was then reinstated in 2018 but it was still jaw dropping that such a landmark was removed in the first place.

https://lookup.london/john-snow-water-pump/

Quite interesting

AJRF4• 6 years ago

The John Snow pub is great, it's so cheap!

drcongo5• 6 years ago

Surprised to realise it's now 11 years that I've been boycotting it. https://www.theguardian.com/uk/2011/apr/15/john-snow-kiss-in...

dTal• 6 years ago

It was apparently removed due to redevelopment, and the pump is not the original anyway. Given they later reinstated the memorial, this isn't quite the act of historical vandalism it may first appear.

DanBC2• 6 years ago

It all sucks.

HSJ (a specialist news source for healthcare in the UK) has an article here: https://www.hsj.co.uk/technology-and-innovation/exclusive-wo...

I might have installed something created by Google and Apple, or by NHS X. But I'm not going to install this thing.

Ben Warner a data scientist advises the govt & sits on SAGE meetings. His brother called Marc. Who's also also very pally with Dominic Cummings. Surprisingly he won a £250m NHS contract not long ago. Now he has the contract for NHS tracking app. This needs to be questioned.

https://twitter.com/JonJonesSnr/status/1257369738281463809?s...

NEW: Critics, including doctors & MPs, are warning that govt is using the pandemic to accelerate the privatisation of the NHS without proper scrutiny. "Deloitte, KPMG, Serco, Sodexo, Mitie, Boots and the US data mining group Palantir are all involved.'

https://twitter.com/Mandoline_Blue/status/125741028793165824...

drcongo5• 6 years ago

This should be the top reply in this thread.

hazeii• 6 years ago

Speaking of Ben Warner, I see his and Dominic Cummings names are missing from the recently-disclosed list of participants in SAGE [0].

I also note that exactly 2 participants decided not to disclose their participation.

[0] https://www.gov.uk/government/publications/scientific-adviso...

Silhouette6• 6 years ago

The technical explanation[1] provided by the NCSC is a lot more interesting than the casual write-up on El Reg, IMHO. As a strong advocate of privacy and limiting government surveillance, I was somewhat reassured reading those details.

In particular, that paper identifies several specific threats to the operation of the system, some of which have not been widely discussed in the media and a few of which raise potential concerns about decentralised systems as proposed or recently adopted elsewhere.

TL;DR: Yes, there are some rational privacy concerns about the NHS app being centralised in nature. However, the people designing this system aren't morons and there is no perfect solution that is invulnerable to all conceivable attacks and abuses.

[1] https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1....

sigwinch283• 6 years ago

Although there are no perfect solutions, there are systems which willingly connect to and distribute contact data to government servers, and there are systems which do not.

Silhouette6• 6 years ago

As the paper notes, there are also systems that are vulnerable to various kinds of abuse by malicious actors and there are systems that are not. The price of using an unauthenticated, distributed system instead is likely to be greater vulnerability to some of those forms of attack and/or a dependency on verifiable test results that causes possibly very damaging delays in sending out notifications.

dingaling• 6 years ago

However, the people designing this system aren't morons

I don't think anyone insulted them as such. Bur smart people can sti make unwise decisions under the pressures of time, politics and conflicting requirements.

TheSpiceIsLife• 6 years ago

Smart people implementing intentionally nefarious systems.

FartyMcFarter• 6 years ago

However, the people designing this system aren't morons

That is exactly the problem. I fully trust the designers and implementers of this system to know how to exploit the data for "unintended" purposes at any point.

szc• 6 years ago

There is a separate Hacker News thread on an "article" that points to this PDF -- https://news.ycombinator.com/item?id=23074447

The summary, from my perspective is that this approach is terrible.

It builds a social graph. If you get sick, and a LOT of people are going to get Covid-19, then you reveal your social graph.

There are "technical" parts of the description that do not make sense -- why is your "phone model number" important, Covid-19 doesn't care. Why is that data being collected?

If you read closely, an "installation ID" is created and ends up being recorded. This is a unique tracking identifier. When you get sick, you reveal this ID and put a name to it -- along with a "fuzzy" geographic location.

Now that I've looked at the PDF, some of the crypto includes the "Country Code". Which is "recoverable" on the server side. The trite explanation for that is "and the country code allows for multiple countries to interact".

Why is "Country Code" in the crypto and not in the questions you ask the patient?

[edit: to remove bad linking] I do not believe this is a good design.

Caveat, it is far, far easier to criticize than it is to create a good design.

Silhouette6• 6 years ago

Where in the technical document does it say anything about a "phone model number"? It explicitly describes what data is to be sent at the different stages, and I see no mention of anything like that.

Where does it say anything about associating a name with the installation ID?

The risk of potentially commingling the graph built from notifications with other data sets is explicitly acknowledged and discussed, and is obviously the big drawback of a centralised notification system like this. Precautions to be taken to prevent abuse are also discussed.

It seems to me that most of your objections here, and in your comment on the other thread, are attacking straw men and ignoring the technical details and logical arguments presented in the document.

djaychela• 6 years ago

There are "technical" parts of the description that do not make sense -- why is your "phone model number" important, Covid-19 doesn't care. Why is that data being collected?

Off the cuff, I would think it would be useful to give some idea of the Bluetooth range of the device being used? There may be performance changes or mitigations needed for whatever it is they're planning to allow this to work?

galadran• 6 years ago

GCHQ's technical design document is here: https://www.ncsc.gov.uk/report/nhs-covid-19-app-privacy-secu...

Some observations on their design:

They refresh the identifiers broadcast by each device every 24 hours. So any 3rd party can track an individual using the app for 24 hours before they rotate their identifier. No privileged access required.

The payloads look huge (>100 bytes), so it looks like every interaction needs to be connection based (i.e. pairwise) rather than broadcast based (one to many). That's going to be hell on the battery.

They broadcast a country code in plaintext, so any international deployment would reveal the probable nationality of nearby users. Can't see that ending well.

They hold a master key which they can use to reveal the identifier of any individual using the system. Significant risk of mission creep e.g. a warrant / subpoena to reveal who was near person X during the time period Y.

AJRF4• 6 years ago

Anyone from the Isle of Wight here to confirm how they are installing it for iOS specifically? I've not seen it in the iOS App Store and am very curious to see if they are side loading it.

amaccuish• 6 years ago

Saw screenshots on the news last night, it's being done using TestFlight.

AJRF4• 6 years ago

Oh okay - thank you for answering.

yadco• 6 years ago

'the disastrous “herd immunity” policy'. I think it is to early to say that before seeing how countries that locked down earlier do in the comming months.

drcongo5• 6 years ago

The UK has 0.0859% of the global population and 11.43% of global covid-19 deaths.

I don't think it's too early to say.

eiji• 6 years ago

That sentence has no scientific meaning whatsoever. In January China had 99% of all global deaths. But hey, Kieren McCarthy from San Francisco is an "Inter all-rounder" journalist and surely a person with profound insights into virology to make grand remarks like that.

Mvandenbergh3• 6 years ago

Interesting. Everyone seems so sure that DP-3T (the protocol that Google and Apple are adopting for their API) will work sufficiently well that the use of the PEPP/ROBERT protocol which is being used by NHSX, the French, and the Italians will be unnecessary. Since DP-3T discloses less information about your social graph to the central party (although in some edge cases more about your social graph to everyone in the network) this would mean that DP-3T is superior.

Clearly if they both work well, then the one that discloses less data is better.

It is important that we maintain context here: these are both "minimally disclosive" protocols which were designed to transmit as little information as possible while being effective tools. Compare this with the absolutely pervasive tracking being done in South Korea and other places. The difference is that NHSX and the designers of PEEP/ROBERT thinks that a higher level of disclosure is required than DP-3T to be effective. At the moment, we do not know if either of these will work, so it's not the case that we can say: "they both work, therefore only a surveillance state would pick the one that discloses more information". It is a balance and that will always lead to different people making different decisions.

I suspect we will know this week whether the app as currently setup will work from the IoW trials. If it doesn't work, kills the battery, etc. then I hope NHSX has a DP-3T alternative in the background. Given current levels of infection in the UK, this will become important in the last week of May onwards for releasing lockdown measures so they have a few weeks to get a solution that works.

tomduncalf• 6 years ago

Great comment, nice to see some rational/balanced thinking on this.

To me it seems overly paranoid to suggest that the UK government would be doing this merely so they could track citizens movements or whatever - and I'm pretty sure the intelligence services are capable of doing that already if they want to. There are definite upsides to their approach from a surpressing the infection point of view, obviously they believe they are worth the trade-offs.

It will be interesting to see how the trial plays out vs. other countries using the Apple/Google approach. I don't think the government would risk having another potential large failure in handling this crisis if the evidence clearly points to the Apple/Google approach being better.

I did see a quote yesterday to the effect that nothing is set in stone and they can change the approach they are using if necessary, can't find the source right now.

DanBC2• 6 years ago

To me it seems overly paranoid to suggest that the UK government would be doing this merely so they could track citizens movements or whatever

I agree, but don't ignore the rest of the argument, which is that the beta versions of the app failed the requirements to be included in the NHS App library; they're using weird version control so NHSX can't do correct tests on the app; it's already failed some security testing; and the contract was awarded to someone on Sage, who has a brother that works for Cummings.

kitd• 6 years ago

Further more, any contact tracing app that uses a technological solution is limited in its usefulness anyway. Viral transmission is not well modelled by radio packet transmission. Bruce Schneier has views on this [1], as do the Uni of Cambridge Digital Research team who consulted on the NHS app [2].

In fact, this is a benefit of the centralised matching model proposed by the NHS. The algorithm, eg number of packets received, time window in which they are received, can be tailored to improve the model.

But in any case, using Bluetooth to model virus transmission risks becoming a massive red herring.

[1] https://www.schneier.com/blog/archives/2020/05/me_on_covad-1...

[2] https://www.lightbluetouchpaper.org/2020/04/12/contact-traci...

Mvandenbergh3• 6 years ago

True. Jonathan Van-Tam was saying in the daily briefing a few days ago that they are definitely not relying on this as a magic bullet, there will have to continue to be substantial old school manual contact tracing.

I think if we did know exactly the mechanics of transmission then we could afford to be super minimalist about how much data was disclosed and restrict it only to the very least required. The problem is that we don't know what that minimum is. I think one difference between critics of this approach (and indeed Google/Apple) and the NHSX/Ministerial decision makers here is that the former are not accountable for controlling transmission. If it doesn't work then they tried to help and regrettably it didn't work. The latter are trying to thread a course between how many people will die, how many years we'll be paying off debt or suffering from economic chaos, and privacy implications. That doesn't mean we can just ignore the latter, that is too easy and only leads in one direction, but it also means that decision makers have to balance competing concerns.

If it were me (but I am neither an expert nor do I have the full set of data that they do) I would pursue the same course as they are but also have a team working on an alternate implementation as a plan B. I would also make binding public commitments about what we would do with this data, introducing new statute law if really required. Again though, that's easier said than done because they don't yet know exactly how they'll need to use this data.

UK centralised contact-tracing app probably won't work well, may be illegal

Related Stories