Thread by @Tom___Scott

THREAD: Could a track & trace app be useful in helping to control future waves of #Covid_19?

Yes, but it’s only a small part of what’s needed. What’s more, the govt’s approach to this runs counter to much expert advice & raises very serious concerns about data privacy… 1/

2/ Last week 177 cybersecurity & privacy experts, including many leaders in their fields, signed an open letter warning of the ways in which data gathered by the app could be used for surveillance by the state or private corporations.
businessinsider.nl/cybersecurity-…

3/ But surely the govt would not allow this to happen? Well, look at the corporations that are already involved in the NHSX coronavirus data project.

Palantir – owned by far-right US billionaire Peter Thiel & a contractor for the CIA and ICE in the US…
techcrunch.com/2015/01/11/lea…

4/ Palantir personnel are also known to have worked with Cambridge Analytica – responsible for the biggest data abuse scandal in history.

This was detailed in evidence to the Commons DCMS Committee by whistleblower Christopher Wylie in 2018.
cnbc.com/2018/03/27/pal…

5/ Leading the govt initiative is Faculty AI.

Ben Warner, its former commercial principal & brother of Faculty’s CEO Marc Warner, worked with Dominic Cummings at Vote Leave, found by the ICO to have committed serious breaches of data law.
ico.org.uk/about-the-ico/…

6/ The ICO also found that AIQ, the Canadian company closely linked to Cambridge Analytica that Vote Leave used to target UK voters in 2016, had processed people's data "for purposes which they would not have expected".
thedrum.com/news/2018/09/2…

7/ Ben Warner went on to run the Conservative Party’s private election modelling before being recruited to work for Number 10 by Dominic Cummings, with whom he’s known to have attended SAGE meetings.
theguardian.com/world/2020/apr…

8/ The government has assured people all data will be anonymised.

But a memo seen by the Guardian suggests this may not be the case, & that data may be de-anonymised “if ministers judge that to be proportionate at some stage”.
theguardian.com/world/2020/apr…

9/ Are there better & less potentially invasive ways of using smartphone technology for contact tracing?

Indeed there are & other governments are following these. The open-source DP-3T system developed by scientists at European universities, for instance.
techcrunch.com/2020/04/06/eu-…

10/ Or there’s the joint initiative by Google and Apple to develop privacy-preserving contact tracing technology.
technologyreview.com/2020/04/14/999…

11/ Germany has recently dropped its efforts to build a centralised contact tracing app and, in common with many other European governments, has decided to adopt a decentralised architecture less open to potential abuses…
techcrunch.com/2020/04/27/ger…

12/ One other thing we might learn from Germany is that such an app on its own is far from enough – we need well-resourced teams of human contact tracers at local level.

This is also emphasised by Singapore & other countries already using such apps…
nature.com/articles/d4158…

13/ …whereas Grant Shapps suggested in interviews today that the app could *replace* much of the need for human contact tracing – & perhaps justify the government’s failure to invest in this, or to revive underfunded local govt public health teams that have such expertise.

14/ The government’s approach to its app project seems to be informed by two extremely dangerous principles:

– British exceptionalism (why should we learn anything from other countries?), and

– Jobs for political cronies, no matter how discredited or disreputable

15/ So what principles should it be following? Well...

1)Transparency: It must be clear how any data gathered will be used & who will have access to it. Software used should be open source. This would make the app much more likely to be trusted – & hence improve uptake.

16/

2) Anonymisation of data: Personal data gathered must not be used, or be open to being used, to identify individuals - either by the state or by corporate interests that may be involved in developing the technology and/or processing the data.

17/

3) Choice of responsible partners: Not-for-profit partners, such as those that developed the DP-3T system, have much to offer. If private-sector partners are involved, they must have a clean track record & demonstrable commitment to protecting the privacy of personal data.

18/ Who has govt chosen to run call centres for its track & trace app? None other than Serco, whose record is littered with serious abuses of trust - incl. mismanagement of refugee detention centres, out-of-hours GP services & electronic tagging (for which it was fined £19.2m).

19/ The govt's app also appears to fall foul of human rights & data protection laws. Four eminent specialists in human rights & data law have published their opinion of it here:
matrixlaw.co.uk/news/legal-adv…