Academics at the University of Birmingham are among a group of 173 UK scholars to have signed an open letter expressing concerns over the NHS's planned COVID-19 contact-tracing app.
Computer science, data and legal experts from the University’s College of Engineering and Physical Sciences, College of Arts and Law and College of Social Sciences, say the app could endanger users by creating a centralised store of the public’s sensitive health and travel data that could be used by hackers, the state or private sector to “spy on citizens' real-world activities”.
They have called on NHSX, the state-run health service's app-developing and digital policy quango, to "publicly commit that there will not be a database or databases, regardless of what controls are put in place, that would allow de-anonymization of users of its system".
They also seek NHSX to explain “how it plans to phase out the application after the pandemic has passed to prevent mission creep”.
Due for release in the coming weeks, NHSX's contact-tracing app will be the official way that everyone's contact with COVID-19-positive people will be tracked. A contact tracing application is a mobile phone application which records, using Bluetooth, the contacts between individuals.
The app will emit an electronic ID from a person’s phone and receive the IDs of other phones with the app installed. If someone develops the coronavirus, everyone who came into contact with that person will receive an alert. The NHSX app will beam that contact data back to government-controlled servers.
In the letter, the academics said: “It is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance.”
Academics at the University of Birmingham who have signed the letter are: Professor Mark Ryan, Professor Karen Yeung, Dr David Galindo, Professor Falvio Garcia, Dr David Oswald, Dr Sam Thomas, Professor Sylvie Delacroix, Dr Rachael Dickson, Dr Adam Harkens, and Professor Ganna Pogrebna.
The letter adds: “We urge that the health benefits of a digital solution be analysed in depth by specialists from all relevant academic disciplines, and sufficiently proven to be of value to justify the dangers involved.
“We believe that any such application will only be used in the necessary numbers if it gives reason to be trusted by those being asked to install it.
“We understand that the current proposed design is intended to meet the requirements set out by the public health teams, but we have seen conflicting advice from different groups about how much data the public health teams need.
“We welcome the NHSX commitment to transparency, and in particular Matthew Gould’s commitment made to the Science & Technology committee on 28 April that the data protection impact assessment (DPIA) for the contact tracing application will be published.
“We are calling on NHSX to publish the DPIA immediately, rather than just before deployment, to enable (a) public debate about its implications and (b) public scrutiny of the security and privacy safeguards put in place.”