Would you install and use an NHS Covid tracking app?

[coanda]

pip t said:

coanda said:

bhstewie said:

John Locke said:

bhstewie said:

If that was their intention do you think they'd release the source code for the app so anyone can examine it and see for themselves exactly what the app is doing and what data it collects and what it does with it?

That's the thing when you make comments such as "in fact I have my doubts about that now".

People can literally look at the source code and prove those doubts wrong.

Which they have.

Do you also believe that wearing a facemask is good for you?

What does that have to do with anything?

If you don't work in IT and you don't understand what open source is and what it means so far as visibility of what the NHS app does just say so.

No shame in that there's plenty I don't know about other peoples line of work.

De-anonymisation is a thing.

https://en.m.wikipedia.org/wiki/Data_re-identifica...

https://www.google.com/amp/s/amp.theguardian.com/t...

https://www.ucl.ac.uk/data-protection/guidance-sta...

Tie what data is available in with other sources of information available to governments and local services and things may start to drop out of apparent nothing

It doesn't even need to be de-anonymised to the individual level. Should there be enough data to show trends then that could be enough to influence policy in a particular direction.

I was in the middle of writing yet another longish post going through exactly what data the app sends, in what circumstances, to whom, and explaining why it's impossible for the government or any other organisation to trace an individual through the app, or to share data on you from the app.

However I find myself distinctly out of energy for this. Believe what you wish to.

I will simply state that the app, as it stands, is not capable of providing data to anyone that could be used to trace or prosecute you. If that changes, it will fall foul of the rules around the Apple/ Google API, and will therefore no longer to able to be used for proximity alerts. There's plenty of other posts on this forum making the position clear, and plenty of documentation in the public realm should you wish to read further.

We'll see. You enjoy using your app.

[bitchstewie]

coanda said:

We'll see.

Respectfully there are times when "we'll see" isn't the answer.

People don't like to say "I'm wrong" which I get because I'm no different.

But the app just does not and cannot work like that.

[coanda]

bhstewie said:

coanda said:

We'll see.

Respectfully there are times when "we'll see" isn't the answer.

People don't like to say "I'm wrong" which I get because I'm no different.

But the app just does not and cannot work like that.

It is still the thin end of the wedge. Only time will tell how far this will be pushed.

[bigpriest]

coanda said:

It is still the thin end of the wedge. Only time will tell how far this will be pushed.

Why are you registered and posting on a forum where you're data is held and analysed by private companies if there is so much risk?

[coanda]

bigpriest said:

coanda said:

It is still the thin end of the wedge. Only time will tell how far this will be pushed.

Why are you registered and posting on a forum where you're data is held and analysed by private companies if there is so much risk?

Pretty stupid argument.

I have no choice if I want to interact.

That private company can't arrest me. It can't take money out of my bank accounts at whim, it can't limit my access to benefits, it can't see my driving license data, it can't see my security clearance information. It can't watch me if it wants to, it can't search my house if it wants to. It can't do lots of things a government can, if it wants to.

Edited by coanda on Sunday 18th October 17:49

[pip t]

coanda said:

We'll see. You enjoy using your app.

I'm not 'enjoying' it - I'm not even a huge supporter of the principle of an app - I'm just fed up of the constant inaccurate twaddle being spouted about it from some. Not aimed at you by the way.

coanda said:

It is still the thin end of the wedge. Only time will tell how far this will be pushed.

I completely understand that argument. Regardless of whether this app is privacy protecting, it's possible that things that happen in the future may not be. I also understand that the scanning of QR codes to enter venues etc is normalising something that may become more concerning in future. I don't dispute that.

However, none of that takes away from the fact that there's a colossal amount of misinformation around regarding the function and capability of the current app. What we have now has been demonstrated to be extremely privacy friendly. There are a lot of people, whether through ignorance or malice, claiming that it isn't.

I was just about to quote and comment on the extract from the Wired article that you'd posted, but you seem to have deleted it. Never mind. It's true that the server will see an IP address from you, that's unavoidable - it's how the internet works. However the NHS system strips the the IP address from the data at the server before it goes further into the database. If you're particularly worried about that, you can always run a VPN.

coanda said:

That private company can't arrest me. It can't take money out of my bank accounts at whim, it can't limit my access to benefits, it can't see my driving license data, it can't see my security clearance information. It can't watch me if it wants to, it can't search my house if it wants to. It can't do lots of things a government can, if it wants to.

Here I agree with you. There's a world of difference between the potential consequences of your data being used by private companies for advertising, and the government holding it. I do get fed up of the argument of "well FB, Twitter and Google can track you anyway so it doesn't matter."

Edited by pip t on Sunday 18th October 17:58

[coanda]

pip t said:

coanda said:

We'll see. You enjoy using your app.

I'm not 'enjoying' it - I'm not even a huge supporter of the principle of an app - I'm just fed up of the constant inaccurate twaddle being spouted about it from some. Not aimed at you by the way.

coanda said:

It is still the thin end of the wedge. Only time will tell how far this will be pushed.

I completely understand that argument. Regardless of whether this app is privacy protecting, it's possible that things that happen in the future may not be. I also understand that the scanning of QR codes to enter venues etc is normalising something that may become more concerning in future. I don't dispute that.

However, none of that takes away from the fact that there's a colossal amount of misinformation around regarding the function and capability of the current app. What we have now has been demonstrated to be extremely privacy friendly. There are a lot of people, whether through ignorance or malice, claiming that it isn't.

I was just about to quote and comment on the extract from the Wired article that you'd posted, but you seem to have deleted it. Never mind. It's true that the server will see an IP address from you, that's unavoidable - it's how the internet works. However the NHS system strips the the IP address from the data at the server before it goes further into the database. If you're particularly worried about that, you can always run a VPN.

coanda said:

That private company can't arrest me. It can't take money out of my bank accounts at whim, it can't limit my access to benefits, it can't see my driving license data, it can't see my security clearance information. It can't watch me if it wants to, it can't search my house if it wants to. It can't do lots of things a government can, if it wants to.

Here I agree with you. There's a world of difference between the potential consequences of your data being used by private companies for advertising, and the government holding it. I do get fed up of the argument of "well FB, Twitter and Google can track you anyway so it doesn't matter."

Edited by pip t on Sunday 18th October 17:58

I've read and know enough about how governments and security agencies work to get what they want at almost any cost to know that there are ways and means around any of the stated claims to this - hell when you can write code to jump an airgap to get to a laptop through its speakers, you can pretty much do whatever you want. That could include things like capturing those IP addresses, it could include getting the pseudo-anonymised data held on servers too. And then there's leaving data around that should have been deleted but wasn't....USB keys on trains etc. All the usual ways of getting data apply here too.

I deleted that para because I couldn't be sure the wired article specifically relates to the current NHS track and trace app or the earlier NHSX one. So, appreciate that.

Yes, the 'well this is what you give to facebook arguments..." are specious. Facebook et al just want to make money off me.

All of my comments relate to the bigger picture. Not specifically to this track and trace app - it's what part this track and trace app will play in the future of this and other countries.

Edited by coanda on Sunday 18th October 18:12

[Graveworm]

coanda said:

I've read and know enough about how governments and security agencies work to get what they want at almost any cost to know that there are ways and means around any of the stated claims to this - hell when you can write code to jump an airgap to get to a laptop through its speakers, you can pretty much do whatever you want. That could include things like capturing those IP addresses, it could include getting the pseudo-anonymised data held on servers too. And then there's leaving data around that should have been deleted but wasn't....USB keys on trains etc. All the usual ways of getting data apply here too.

I deleted that para because I couldn't be sure the wired article specifically relates to the current NHS track and trace app or the earlier NHSX one. So, appreciate that.

Yes, the 'well this is what you give to facebook arguments..." are specious. Facebook et al just want to make money off me.

All of my comments relate to the bigger picture. Not specifically to this track and trace app - it's what part this track and trace app will play in the future of this and other countries.

Edited by coanda on Sunday 18th October 18:12

Since the "security services" have such capabilities, without the app, why would they need to subvert the app?

[b0rk]

coanda said:

De-anonymisation is a thing.

https://en.m.wikipedia.org/wiki/Data_re-identifica...

https://www.google.com/amp/s/amp.theguardian.com/t...

https://www.ucl.ac.uk/data-protection/guidance-sta...

Tie what data is available in with other sources of information available to governments and local services and things may start to drop out of apparent nothing

It doesn't even need to be de-anonymised to the individual level. Should there be enough data to show trends then that could be enough to influence policy in a particular direction.

Look if the government fancied doing a bit of mass population surveillance there are easier ways then asking the populous to download an app, as general hint the way mobile networks work mean the operator always knows where a given handset is at anytime the handset is on. De-anonymisation is more a problem with commercial datasets and commercial users where as the articles all note multiple anonymous datasets can be aggregated to create deanonymised set. Technically doing so would be against GDPR.

[davhill]

Correct me if I'm wrong - as I'm sure you will - I saw a little piece on the Beeb news site in the small hours.
It was saying something about the police having access to the app and using it with a view to fines and/or
prosecutions.

I checked again around noon and it's disappeared.

Or I might have dreamed it.

In any case, I've uninstalled the app.

[bitchstewie]

davhill said:

Correct me if I'm wrong - as I'm sure you will - I saw a little piece on the Beeb news site in the small hours.
It was saying something about the police having access to the app and using it with a view to fines and/or
prosecutions.

I checked again around noon and it's disappeared.

Or I might have dreamed it.

In any case, I've uninstalled the app.

The Police do not have access to the app.

Please spend five minutes on Google.

[i4got]

Parts of this thread make me feel like I've woken up in the film Idiocracy.

[rxe]

Does the app internally log the fact that it has told you to isolate? Or is that a pop up with an “OK” that leaves no trace on the phone?

[dundarach]

I read it too: https://www.bbc.co.uk/news/uk-54586897

[i4got]

dundarach said:

I read it too: https://www.bbc.co.uk/news/uk-54586897

Did you read this bit in the article?

"Police will not have access to data from the NHS Covid-19 app. The app is anonymous so the government does not know who has been sent instructions to self-isolate."

[bitchstewie]

dundarach said:

I read it too: https://www.bbc.co.uk/news/uk-54586897

"Police will not have access to data from the NHS Covid-19 app. The app is anonymous so the government does not know who has been sent instructions to self-isolate."

[grombot]

bhstewie said:

dundarach said:

I read it too: https://www.bbc.co.uk/news/uk-54586897

"Police will not have access to data from the NHS Covid-19 app. The app is anonymous so the government does not know who has been sent instructions to self-isolate."

For now....

[bigpriest]

coanda said:

bigpriest said:

coanda said:

It is still the thin end of the wedge. Only time will tell how far this will be pushed.

Why are you registered and posting on a forum where you're data is held and analysed by private companies if there is so much risk?

Pretty stupid argument.

I have no choice if I want to interact.

That private company can't arrest me. It can't take money out of my bank accounts at whim, it can't limit my access to benefits, it can't see my driving license data, it can't see my security clearance information. It can't watch me if it wants to, it can't search my house if it wants to. It can't do lots of things a government can, if it wants to.

Edited by coanda on Sunday 18th October 17:49

Sorry, it may well be a stupid argument, just trying to understand your thinking. If you're so concerned about what the Government could do, surely they wouldn't hesitate to use the data held by private companies if they wanted to. Didn't a change in legislation nearly open up ISP's data to the Government?

[bitchstewie]

grombot said:

For now....

Yes for now.

Should we advise people how to act now based on what you think may happen in the future?

This is ridiculous.

[pip t]

rxe said:

Does the app internally log the fact that it has told you to isolate? Or is that a pop up with an “OK” that leaves no trace on the phone?

Yes and no. Yes it logs it, within the app. Delete the data in the app, or the whole app, and it deletes the log with it. It needs the log internally to keep the 'countdown' function of how long you need to self isolate for. If you've deleted the app/ data in the app, there would be no further record of it.

grombot said:

For now....

What data from the app do you suppose the police will have access to in the future? And how do you propose they'll get it?

bigpriest said:

Sorry, it may well be a stupid argument, just trying to understand your thinking. If you're so concerned about what the Government could do, surely they wouldn't hesitate to use the data held by private companies if they wanted to. Didn't a change in legislation nearly open up ISP's data to the Government?

Yes, that's the flaw in that argument (And it's an argument I'm a proponent of too). See Snowden for state level capabilities. There are legal safeguards in place, and to be honest the main risk is from your ISP rather than Google/ Facebook/ Twitter etc, but you're right, if governments want access to data it's perfectly possible for them to get it.

Edited by pip t on Sunday 18th October 19:25

Edited by pip t on Sunday 18th October 19:25