The British will not be able to ask NHS administrators to delete their COVID-19 tracking data from government servers, said Matthew Gould, CEO of the NHSX digital arm, to MEPs this afternoon.
Gould also told Parliament's human rights committee that data collected from the British via the NHSX COVID-19 contact search application would be “pseudonymized” – and appeared to leave the door open for the sale of this data for “research”.
The government contacts search app will be rolled out in Britain this week. A demo seen by The register showed its basic functions in front of the consumer. The key is a large green button that the user presses to send 28 days of contact data to the NHS.
Written by the NHSX technology arm, the British contact search application breaks with the international convention of opt for a centralized data collection model, rather than keeping the data on users' phones and only storing it locally.
In response to questions from Scottish nationalist MP Joanna Cherry this afternoon, Gould told MEPs: “Data can be deleted as long as it is on your own device. Once downloaded, all data will be deleted or completely anonymized. by law, so they can be used for research purposes. “
The anonymization of this data was successfully demonstrated in 2015, as we reported at the time.
Although Gould said the NHSX app would automatically delete contact data that isn't uploaded to government servers, he explained:
The register understands that the application has been completed and tested, with the previously announced Isle of Wight test which will begin in the latter part of this week.
Addressing the same committee, Information Commissioner Elizabeth Denham reiterated to members of the House that her office “did not sign on an application.” Despite being closely questioned about his inverted ferret's previous statements that “the starting point for contact tracing should be decentralized systems”, she said this afternoon that she wanted the ICO to be a “critical friend” of the NHSX.
Denham added that if enough members of the public complained about the application, the NHSX had given the Information Commissioner's office permission to “conduct a voluntary audit of the application and the systems – if applicable.” She shrugged: “The functionality of the application is up to the government to decide … it's not up to me to decide, it's up to me to advise on how to mitigate some of these potential risks.”
Sounds good to us, says a branch of GCHQ
The National Cyber Security Center has also been moved to defend the NHSX, senior technician Ian Levy telling the world in a blog post late in the afternoon that there is nothing to fear because smart people took hours to make sure it was reasonably secure.
He entered a full description of how pseudonymization works in the application, starting with the unique 128-bit user ID generated after installation:
Each time your phone approaches the phone of another user of the application, “the date and time, the package received via BLE, the strength of the sampled signal, the total duration of the encounter” are “stored in safe ”on your own mobile device. You then donk the big green button to send all of this data to the NHS for research.
If you are a victim of COVID-19 and tell the application that you are sick “, the application will download the anonymous recording of your proximity events to the NHS server. From each of the encrypted blobs recorded, the server can recover fixed data but anonymous installation ID for each device you were close to. “
Thanks to the large output variations between different Bluetooth Low Energy chipsets in different handsets, this data is used – along with the phone model identifier collected by the application – to determine an approximate distance proxy.
Levy ended his readable blog post (available on the NCSC website) by urging the British to “please install the app and use it”. El Reg suspects, regardless of public health issues, that its commissioning date will be a key moment to see how much the public has faith in the government and public service of the day. ®
Webcast: Build the Next Generation of Your Business in the Public Cloud