https://i.ibb.co/TRmZLHN/key-1280.jpg

Contract tracing to alert users of high risk exposure has been in the works in a number of countries for months now. I talked about Google and Apple’s joint effort to contribute to this movement, their stance on a decentralized approach would involve local exchange of identifier data to maintain a trail of users passed. Infected users would update their status to being infected, a new list of infected keys are then updated and synced to all devices, matching identifier data would then alert users if they were at risk of exposure. There will most likely be location and time data attached to these events and it is a system that relies on participation while giving a level of privacy to user data through design. 

While the project is designed to raise awareness to viral exposure and consequently allowing early self-isolation and testing, some governments seek to track gain more control over this data. I previously spoke about GApple’s stance on contact tracing and their response to the United Kingdom’s approach to building a contact tracing solution. NHSX are the lead in digital transformation of health and social care in the UK and unfortunately wish to opt for a centralized approach to contact tracing, even rejecting GApple’s movement towards to decentralization. Their cases around data aggregation and goal of warning high risk users in an efficient manner seems a little off the mark. Centralization data in the hands of NHSX, opens many attack pathways that hackers, private organizations and other malicious parties could exploit. 

Aside from privacy concerns, imposed energy loads due to active wake up devices throughout the day will most definitely impact battery life. Apple have introduced a passive communication protocol that will leave devices in sleep mode while executing handshake in a systematic manner, far more efficient to the current design of the NHSX’s approach. Such an application already faces scrutiny of its centralised design and inefficiencies. It makes me ask the question, how effective this project can be if participation will dwindle due to the chosen approach. If anything, it becomes detrimental to the supposed objective of alerting high risk citizens. The NHS has faced multiple data breaches over time and their current direction to developing a digital solution does not instil confidence. Multiple open letters from scientists, cryptographers and computer scientists have been created to voice a movement towards decentralized proximity tracing. 

DP^3T is such a project, one that seeks to maintain privacy and security. Details here: https://github.com/DP-3T/documents 

Link to joint statement:

https://twitter.com/martinralbrecht/status/1255504622665547777

I hope that privacy and security through design will be adopted over convenience of data collection. It’s also important that such a project have a clear and transparent roadmap of its end of life as the pandemic reaches its conclusion over time. 

Sources 
https://www.businessinsider.com/uk-nhsx-rejects-apple-google-coronavirus-app-model-2020-4


<center><b>Lockhart Tech Blogs</b>
https://i.ibb.co/6YNhq76/lockhart-logo.png</center>