The UK’s NHS isn’t doing anything to quash fears that the new coronavirus tracing app is going to be a privacy nightmare – in fact, it’s doing the opposite.
First, the app development is being overseen by Dido Harding. It’s almost as though everything Harding runs is prone to leaks. Harding was TalkTalk’s CEO during a period when the platform experienced a large leak of user data, one of the biggest data breaches in UK history. (TalkTalk is a UK-based internet service provider.)
Second, a Google Doc that details issues with the app was accidentally made public, leaking concerning details about the app to anyone that had the link.
The leaked document detailing possible functions for a future version of the app, among which the collection of users’ accurate location data stands out – something that app developers had promised would never happen.
The document is dated March 25 2020, which suggests that this could be an old idea, but because a staff member reviewed it again on May 12, the possibility has arisen that the development of some of these characteristics is being considered.
Although the document was set to private again, the information had already been documented in detail. These include the possibility that users will be asked to include personal location data, such as zip code or demographic information. This data would be used by the NHS to determine which locations require the allocation of resources.
Another feature would allow each user to report their current COVID-19 status by dividing it into five categories: quarantine, self-isolating, social distancing, shielding, and none. The system would be inspired by a measure applied in China to control the pandemic after the quarantine was removed, which offers different freedoms to citizens depending on their status.
Other slides in the document called “Product Direction: Release One” revealed that health officials wanted to develop a platform that used official data to ensure user trust, but they faced multiple legal and logistical problems that made the feature impossible, so they finally opted for the self-reporting of symptoms.
