A draft government memo explaining how the NHS contact-tracing app could stem the spread of the coronavirus said ministers might be given the ability to order “de-anonymisation” to identify People from their smartphones, the Guardian can reveal.
The health secretary, Matt Hancock, announced on Sunday that the UK planned to introduce an app that would enable people who developed Covid – 22 symptoms to “anonymously” alert other users to whom they had been in close proximity. “All data will be handled according to the highest ethical and security standards, and would only be used for NHS care and research,” he said.
However, the government document seen by the Guardian, headed “official – sensitive” and “draft – not yet approved”, suggests the NHS privately considered using the technology to identify users.
Produced in March, the memo explained how an NHS app could work, using Bluetooth LE, a standard feature that runs constantly and automatically on all mobile devices, to take “soundings” from other nearby phones through the day. People who have been in sustained proximity with someone who may have Covid – 19 could then be warned and advised to self – isolate, without revealing the identity of the infected individual.
However, the memo stated that “more controversially” the app could use device IDs, which are unique to all smartphones, “to enable de-anonymization if ministers judge that to be proportionate at some stage”. It did not say why ministers might want to identify app users, or under what circumstances doing so would be proportionate.
It added that alternatives to building an NHS app included “making use of existing apps and other functions already installed on people’s phones (eg Google Maps).”
A spokesperson for NHSX, the digital transformation wing of the health service, which is overseeing the development of the UK contact-tracing app, denied there were ever plans to de-anonymise data, or use data from apps such as Google Maps.
“NHSX is looking at whether app-based solutions might be helpful in tracking and managing coronavirus, and we have assembled expertise from inside and outside the organization to do this as rapidly as possible, ”the spokesperson said.
“To be very clear – there have never been plans to make use of existing apps and other functions already installed on peoples phones such as Google Maps and neither have there been plans to look to use the device ID of users in any app-based solutions. ”
NHSX plans to harness data for the government response to the coronavirus pandemic were made public after confidential documents, used by private contractors, were made accessible via an unrestricted portal that was seen by the Guardian .
On Friday, Google and Apple announced an unprecedented collaboration to provide the back-end technology that will enable governments to introduce contact-tracing apps that run on both iPhones and Android phones. Hancock did not specify which technology the government would use but said the NHS was “working closely with the world’s leading tech companies.”
Explaining how the NHS app would work, Hancock said: “If you become unwell with the symptoms of coronavirus, you can securely tell this new NHS app and the app will then send an alert anonymously to other app users that you ‘ ve been in significant contact with over the past few days, even before you had symptoms, so that they know and can act accordingly. ”
Advocates of contact-tracing apps argue they could prove a vital tool to help governments emerge from lockdown conditions currently restricting the movement of millions.
Others are asking whether contact-tracing apps can really work, given that such large numbers of the population will need to download and use the technology for it to be effective, the lack of reliable testing, and the risk that such an open system could be abused by people fabricating symptoms. Ross Anderson, a professor of security engineering at Cambridge University, recently wrote that “anyone who’s worked on abuse will instantly realise that a voluntary app operated by anonymous actors is wide open to trolling”.
GIPHY App Key not set. Please check settings