The contact-tracing app, accuracy?

Today’s news is that the NHS is preparing to switch track to the Apple/Google app. Turns out that that the technology companies might be better at the technology after all.

Turns out that that the technology companies might be better at the technology after all.

Not the point for me. And the last major iOS update on the wife’s iPhone was full of bugs, so no, they’re not always better. And a few techie coder mates are pretty impressed with what Pivotal/VMware has managed to do.

But yeah, makes total sense to switch to the functionality provided by the phone OS if it’s reliable. Will be a while though until that’s fully released.

Just need to sort the legislation/data protection side now. I noticed yesterday medical records (not anonymised obviously) held by the NHS is already default opt-in for use for research and planning.

Don’t know if the UK app differs much from the one they are asking us to use here in Aus, but apparently it’s very flaky on Apple phones, to the point of it being virtually useless.

Don’t know if the UK app differs much from the one they are asking us to use here in Aus, but apparently it’s very flaky on Apple phones, to the point of it being virtually useless.

NEW @FT scoop today: NHSX has this week already started building a second contact tracing app, based on Google/Apple APIs, in parallel to homegrown version.
w/@SarahNev @helenwarrell @labboudles https://t.co/7rGwR0wYQb

— Tim Bradshaw (@tim) May 8, 2020

I’m not so fussed on the privacy side given how much Google, Facebook and even the government know about me. Though I trust the latter less with my data, but not that they have some secret agenda, just their incompetence.

My main concern is the accuracy. As said, distance measuring on BT seems very flakey. I could be told I should lock down fully for couple of weeks because signal suggested I was close enough for long enough to someone infected when I wasn’t, or someone behind a wall is infected. Could be my neighbour. Go to the supermarket, keeping as distant as possible, maybe wearing a face mask, but one person has the virus and everyone there is flagged. Even those in the next aisle to the infected person.

Don’t know if the UK app differs much from the one they are asking us to use here in Aus, but apparently it’s very flaky on Apple phones, to the point of it being virtually useless.

They seem to have tried their hardest, but I’m pretty confident they’ll move to Apple/Google when they can.

‘The NHS COVID-19 app appears to work correctly when running in the background on iOS devices, unlike the Australian COVIDSafe app’

https://reincubate.com/blog/staying-alive-covid-19-background-tracing/

A few people were suspicious the backend code isn’t published but says here they’ll do that too.

https://www.nhsx.nhs.uk/blogs/code-behind-nhs-covid-19-app/

My main concern is the accuracy. As said, distance measuring on BT seems very flakey.

Yeah. What the original post was about. Who knows. In theory, it’s doable. All determined from the Bluetooth LE signal strength.

For Apple phones you know exactly what the hardware is so could be quite accurate.

Android every type of phone is different. I think I read this is why the app looks at the phone model as they’ve determined the behaviour of BLE on various phones.

All clever stuff. Will prob still get false positives (and negatives) though.

One presumes they’re using a variation on the WHO model of ‘contact’, which (iirc) is within 1m for 15mins. Obviously they could decide to go with within 0.5m for 10mins or something. Not sure false positives because of that is something that will be a major factor.

I could be told I should lock down fully for couple of weeks because signal suggested I was close enough for long enough to someone infected when I wasn’t, or someone behind a wall is infected. Could be my neighbour. Go to the supermarket, keeping as distant as possible, maybe wearing a face mask, but one person has the virus and everyone there is flagged. Even those in the next aisle to the infected person.

In some of those examples, if you’re somewhere for 10 or 15 minutes there is elevated risk – like a neighbour or in a shop. In those instances, I’d want to know, but surely you’d get a test so you could minimise the isolation period?

This is where the clever Oxford Uni algorithm comes in.

Can maybe see the reason for the enduring ID people worry about. Does that allow the system to know about repeat exposure? e.g. you chat to the same postie or neighbour every day for 20 seconds, they then test positive so the app decides it’s worth you having a test due to the repeated exposure.

And a few techie coder mates are pretty impressed with what Pivotal/VMware has managed to do.

Yep it’s not bad stuff.

TBH I can see their code coming to an app near you after lockdown for more er frivolous activities 🙂

Early testing of the NHSX app has shown function issues on older iPhones, and a variety of Android phones running older iterations of the OS, which would be a significant issue considering how many cheap Android phones come with older versions of the OS pre-installed, so it’s this issue which has probably triggered the about-turn regarding the A/G app, and some people have also reported battery issues, batteries draining rapidly, etc.
A bit more info from The Register:
https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/
Sorry it’s a Daily Wail online article, but it does give a bit more detail about Android phones which seem to be having issues with the NHSX app:
https://www.dailymail.co.uk/news/article-8302943/NHS-building-new-Covid-19-contact-tracing-app.html?ito=rss-flipboard

Early testing of the NHSX app has shown function issues on older iPhones

Don’t forget the Apple approach won’t work at all if you can’t run iOS 13. So iPhone 6 or older is excluded.

Yes, press and public pressure will push us to use Apple/Google – which will reduce what the app can do I think, delay go live, but improve the chance of takeup.

Don’t forget the Apple approach won’t work at all if you can’t run iOS 13. So iPhone 6 or older is excluded.

Depends on Apple they could put out patches to earlier IOS versions, they’ve done it for security patches in the past.

In the NHSX app nothing obviously jumped out at me that they were using anything 13 specific (no combine or swiftui) and I think it’s targeted to run on min of iOS 11

And that, Mister Anderson, is the sound of inevitability.

Outsourcing firm Serco has apologised after accidentally sharing the email addresses of almost 300 contact tracers.

Doesn’t a “you’ve been near someone” app really just tell you that EVERYONE needs to stay away from EVERYONE else?

I mean, I’ve just been to the supermarket, i’d guess i’ve been resonably close to something like 100 people over th3 45min i shopped for. And those 100 people, have each been in contact with another 100 people. Before long, everyones phone will bing up a message saying “isolate” won’t it?

(Which is why the “full” lockdown type actions work to slow (and perhaps halt but maybe not) the spread of the virus)

What am i missing?

What am i missing?

The risk of virus transfer is only significant if you have been within 2 metres of someone for 15 minutes.

needs to stay away from EVERYONE else?

I mean, I’ve just been to the supermarket, i’d guess i’ve been resonably close to something like 100 people over th3 45min i shopped for. And those 100 people, have each been in contact with another 100 people. Before long, everyones phone will bing up a message saying “isolate” won’t it?

No – it only joins the dots if one of the parties has positive test (or possibly confirmed symptoms). Assuming the community prevalence is low it shouldn’t trigger often even if you do manage to mingle far too closely and for far too long to 100 ppl in Tesco. The prevalence in the community a few weeks ago was 1:400, assuming its fallen since then and people with symptoms self isolate the number of infected people wandering Tesco must be something like 1:1000, and you won’t be close enough to all of them for long enough to trigger the app (and not everyone will have the app). The more an app alert inconveniences the user the more likely they uninstall (eg if you keeping having to ram a swab up your nose and self isolate waiting for results) so there will be a fine balance on how long and how close the phones need to be to avoid too many false positives. You might hope that the app would act as a useful encouragement to stop people interacting (perhaps it could show your personal interaction rate v everyone else) but I expect that’s not on the radar right now.

@cougar has highlighted my exact concern. Privacy and security is part of what I do for a living and a lot of that filters through to my personal life.

I don’t entrust social media platforms with my information any more than I’d entrust a shambolic organisation such as Serco.

‘For the greater good’ only goes so far.

I will not sign-up to the NHSX system but would to the Apple-Google one.
UK govs for years have failed dismally in developing and implementing IT systems resulting in multi billion £ write-offs and abandoned schemes.
Add Serco into the mix and the centralised nature of the NHSX system.
Apple-Google now claim that have resolved the initial problems with their system
https://www.bbc.co.uk/news/technology-52740131

How long before hancock announces a change of direction?

I do not pretend to understand the tech behind this but from the little I do understand the NHSX app has serious privacy issue more so that the google one. I for one will not download it

So yet again, if you don’t install the app will you cooperate with the manual contact tracer who calls you and takes down pretty much the same personal details that end up in either the same system or a (currently) less scrutinised back end?

Oh and bear in mind that one of the most common security issues with it systems comes from the person in the loop either being careless (eg ccing a bunch of email addresses rather than bccing them) or acting maliciously, so the manual system isn’t some magically better option.

Damned if you do, damned if you don’t?

So yet again, if you don’t install the app will you cooperate with the manual contact tracer who calls you and takes down pretty much the same personal details that end up in either the same system or a (currently) less scrutinised back end?

Totally different propositions. If contact tracer calls me today, I self isolate, I get tested, then if positive I tell them who I’ve had contact with. At that point I am a known risk to them and I’ll happily share details. That’s totally different to preemptively tracking me, and ignoring all the privacy concerns people expressed during the design phase because you want that data…

UK govs for years have failed dismally in developing and implementing IT systems resulting in multi billion £ write-offs and abandoned schemes.
Add Serco into the mix and the centralised nature of the NHSX system.

I do not pretend to understand the tech behind this but from the little I do understand the NHSX app has serious privacy issue more so that the google one. I for one will not download it

Using the Apple/Google API only replaces the bespoke/central contact tracing and notification element of the NHSX app. The rest of the app could still ask for personal info, store it centrally, analyse data, merge the data with other NHS data, still involve outsourcers (Serco) etc.

That said, I will use it.

OK, for the non installers how about this proposal:

The current NHSX app stores the data on your phone (admittedly unencrypted in the current version, oops) until you authorise it to upload to the central server after developing symptoms and testing positive. So it logs contacts locally but you keep hold of that data until you opt not to.

That means that even with the NHSX app you could just have it running to be notified if you happened to be at risk from someone you don’t know (so manual tracing would fail), but then opt not to upload your own contact data if you did test positive and use the manual tracing instead. That’s moved your own use a bit closer to the Google/Apple model, it’s probably less benefit to the nation’s health, but does it assuage a privacy concern?

admittedly unencrypted in the current version, oops

Both iOS and Android have defaulted to encrypted storage on the device for ages, haven’t they?

That’s moved your own use a bit closer to the Google/Apple model, it’s probably less benefit to the nation’s health, but does it assuage a privacy concern?

From experience, it won’t. Folks usually end up saying ‘well, that’s what they tell you they are doing’. Whatever you propose, they then counter with a theoretical worst case. I reckon people have already decided yes or no, the technicalities of how the app works is largely irrelevant.

Glad to hear they are very focused on security and protecting personal details. Shame about the email leaks that show a basic lax attitude towards security and personal details. Oh something seems wrong there.

No, not a major breach but a bloody school boy error symptomatic of an approach and experience level within the program

No – it only joins the dots if one of the parties has positive test (or possibly confirmed symptoms)

I thought the UK app allows a user to self report without having a positive test result?
Which means people could report false positives because they have symptoms of other illnesses, or malicious users could simply use the app to anonymously generate alerts.

I thought the UK app allows a user to self report without having a positive test result?
Which means people could report false positives because they have symptoms of other illnesses, or malicious users could simply use the app to anonymously generate alerts.

From people who’ve used it…

‘The app prevents false reports by providing users with symptoms with a reference code: that code is then associated with formal test results before action is taken’

So at a minimum, your symptoms need to have been reviewed and a code issued to you.

I think the advice it gives people you’ve been in contact with ramps up depending if it is just symptoms or an actual positive test.

The difference between a human track and trace and the app is the human track and trace will only have your data if and when needed. The app will have all your movement data with zero safeguards and indeed the tories are attempting to removed data protection safeguards.

There is no way on earth I am going to have an app that allows that much of my data to be held by people I do not trust.

So at a minimum, your symptoms need to have been reviewed and a code issued to you

I looked your quote up at http://www.netimperative.com/2020/05/07/first-look-nhs-covid-19-tracing-app-put-to-the-test/ to get more details:

If a user reports symptoms, the app provides a number to call to arrange a test, along with a reference code. The idea is that the test result is then associated with the user’s reference code. Were a user to falsely report symptoms, confirmation would not happen without the NHS updating the test result to match the user’s code.

So the app would only alert if you return a positive test after notification and your positive result has been cross referenced to the original alert. That addresses the false reporting issue, but effective alerting is going to be heavily dependent on being able to turn around tests as quickly as possible and cross reference the results.

Agreed. It all becomes pretty impractical unless the testing process is efficient. Our achilles heel from day 1, really hope they get it sorted.

Well now.

Breaking news: government refuses to back law to protect privacy of people using NHS contact tracing app

You can trust us with your data, says @MattHancock https://t.co/5LNKWnKXN8

— Adam Wagner (@AdamWagner1) May 21, 2020

Now that is a dumb decision – there’s clearly a sizeable chunk of the population who need more reassurance about data privacy for this app, and they’ve not only failed to give that reassurance but have added the potential to perceive this as confirming that the intentions for these data are not pure. Bravo (not).

Both iOS and Android have defaulted to encrypted storage on the device for ages, haven’t they?

For Android some low end devices lack the hardware and power to do encryption other than in software so some manufacturers disable it out of the box. Especially ones a few years old.

There are also still 4.4 devices out there. Particularly used by old folk or as hand-me-downs to kids. Though likely the app won’t run on them anyway.

It didn’t work – https://www.bbc.co.uk/news/technology-53095336

The NHS has been testing both systems against each other, over the course of the past month.

The centralised version trialled on the Isle of Wight worked well at assessing the distance between two users, but was poor at recognising Apple’s iPhones.

Specifically, the software registered about 75% of nearby Android handsets but only 4% of iPhones.

but was poor at recognising Apple’s iPhones.

FFS – no shit Sherlock!

So Hancock has jus said the failure of the app is not their fault but Apple’s?!? You mean the issue that everyone flagged up from the beginning?

Unbelievable the brass neck he has.

How much truth is there in the rumour that the developers were pals of Cummings?

Or was it just the horrible **** at Serco?

Apparently Apple say that HMG have not been in contact regarding ‘hybrid model’ Matt Hancock announced yesterday

From the Guardian

In its report today, the Times said sources at Apple claimed they were no informed of the announcement or consulted about the plan to work together.

“We don’t know what they mean by this hybrid model. They haven’t spoken to us about it,” a source said.

Apple was also said to have queried the claim that its model was less accurate at measuring distance than the government’s own NHSX model.

“It is difficult to understand what these claims are as they haven’t spoken to us. But the app has been downloaded by 6 million in 24 hours in Germany, the Italians have had it going since Monday, the Dutch government and Irish government have it, and there has been no issue about proximity detection.”

Anyone surprised?