Thread by @robahoneyman

Thread #dominiccummings #covid
1. Dominic Cummings highlighted that Faculty did not develop the original "app", which is true, it was primarily VMWare - Pivotal.

2. However, whatever happened behind the scenes, Faculty were engaged to work on the Covid data store and apparently with significant influence. The extracts in thread tweets below from their contract here confirm this:

cdn-prod.opendemocracy.net/media/document…

3.
Strategy and Oversight
"Specifically ensuring central decision makers have access to the information they need to manage the response to the crisis. The Faculty team will work with Palantir to triage and prioritise these requirements, allocating resources ..."

4. “The modelling and simulation workstream is focused on generating short, and long term forecasts, about the spread of COVID-19, and the impact that has on resources across the healthcare system.”

5. “The Faculty team will be collaborating with an epidemiological research group, at Oxford BDI, to develop their simulation tool in order to meet the objectives of the COVID response group.”

6. I daresay Faculty were trying to help the Covid effort, even though they were maybe given shortcuts to contracts without full tender and were a private sector business making profit.

7. The concern was not that Faculty "developed the app", or that they made all data capture and processing decisions in isolation, or that decisions were necessarily made for unethical reasons.

8. The concern was that data requirements were driving app functionality requirements and overriding privacy concerns. This remit then required introduction of privacy workarounds and deviations from component reuse and best practices.

9. Data requirements would have been defined by product owners / domain experts (NHS / Researchers) and from advice of Covid data and analytics teams (of which Faculty were apparently a / the "strategic" part).

10. The data capture requirements may have been well intentioned, for research reasons, as mentioned by the NCSC, who apparently recorded so in a document from the time, however it was at the expense of trade offs around app user / patient privacy and functionality.

11. See old tweet from the time highlighting some of the motives identified by NCSC.

https://twitter.com/robahoneyman/status/1257946646542979072

NCSC doc
ncsc.gov.uk/blog-post/secu…

12. If trying to maintain data privacy the best option is to not collect data in the first place. Even with good intentions problems with data processing, storage, security and anonymisation can occur and there is an ongoing increase in risk.

13. Examples:
▪️ Anonymisation can sometimes be reversed
▪️ Time and cost overheads can undermine efforts to fully anonymise and secure data e.g. in large analytics stores where expedience can then take precedence

14.
▪️ Scope creep for data held under broad terms and long-term retention
▪️ Old data stores can be remain after failure to decommission (e.g. Equifax UK user data old test database hosted in the US)
▪️ It is a centralised target for adversaries even if well maintained

etc etc

15. Dominic Cummings glorified data analytics used in a cause taken against a large section of the UK population, and furthermore being careful not to overstate, with some ethical concerns apparently unanswered / ignored.

16. His other well-known statements and activities during 2019-2020 did not enhance his public image.

17. Even if the intention was honourable during the Covid crisis:

▪️ there were legitimate technical and privacy concerns around data capture and processing
▪️ Dominic Cummings had broken many people's trust and so anyone associated with him stood in this shadow

18. Whether or not Faculty were partly or strategically 'responsible' for data decisions relating to the app, directly or through downstream data design requirements, they were involved at some level and under the Brexit / Cummings spotlight.

19. The truth may be that bad decisions were made around privacy, user experience and best practice (bluetooth issue) through a somewhat legitimate, but bullish, desire for more data. A desire which proceeded without fully considering users, showstoppers and app popularity.