NHS coronavirus app: memo discussed giving ministers power to 'de-anonymise' users

A draft government memo explaining how the NHS contact-tracing app could stem the spread of the coronavirus said ministers might be given the ability to order “de-anonymisation” to identify people from their smartphones, the Guardian can reveal.

The health secretary, Matt Hancock, announced on Sunday that the UK planned to introduce an app that would enable people who developed Covid-19 symptoms to “anonymously” alert other users to whom they had been in close proximity. “All data will be handled according to the highest ethical and security standards, and would only be used for NHS care and research,” he said.

However, the government document seen by the Guardian, headed “official – sensitive” and “draft – not yet approved”, suggests the NHS privately considered using the technology to identify users.

Produced in March, the memo explained how an NHS app could work, using Bluetooth LE, a standard feature that runs constantly and automatically on all mobile devices, to take “soundings” from other nearby phones through the day. People who have been in sustained proximity with someone who may have Covid-19 could then be warned and advised to self–isolate, without revealing the identity of the infected individual.

However, the memo stated that “more controversially” the app could use device IDs, which are unique to all smartphones, “to enable de-anonymisation if ministers judge that to be proportionate at some stage”. It did not say why ministers might want to identify app users, or under what circumstances doing so would be proportionate.

It added that alternatives to building an NHS app included “making use of existing apps and other functions already installed on people’s phones (eg Google Maps).”

A spokesperson for NHSX, the digital transformation wing of the health service, which is overseeing the development of the UK contact-tracing app, denied there were ever plans to de-anonymise data, or use data from apps such as Google Maps.

“NHSX is looking at whether app-based solutions might be helpful in tracking and managing coronavirus, and we have assembled expertise from inside and outside the organisation to do this as rapidly as possible,” the spokesperson said.

“To be very clear – there have never been plans to make use of existing apps and other functions already installed on peoples phones such as Google Maps and neither have there been plans to look to use the device ID of users in any app-based solutions.”

NHSX plans to harness data for the government’s response to the coronavirus pandemic were made public after confidential documents, used by private contractors, were made accessible via an unrestricted portal that was seen by the Guardian.

On Friday, Google and Apple announced an unprecedented collaboration to provide the back-end technology that will enable governments to introduce contact-tracing apps that run on both iPhones and Android phones. Hancock did not specify which technology the government would use but said the NHS was “working closely with the world’s leading tech companies”.

Explaining how the NHS app would work, Hancock said: “If you become unwell with the symptoms of coronavirus, you can securely tell this new NHS app and the app will then send an alert anonymously to other app users that you’ve been in significant contact with over the past few days, even before you had symptoms, so that they know and can act accordingly.”

Advocates of contact-tracing apps argue they could prove a vital tool to help governments emerge from lockdown conditions currently restricting the movement of millions.

Researchers at the University of Oxford, who have been advising NHSX on the app, published a paper in the journal Science last month concluding that traditional contact tracing of those with Covid-19 was of limited use, in part because it can be spread by those who are asymptomatic and pre-symptomatic.

Instead, the researchers argued, a contact-tracing app could speed up the process by automatically notifying contacts of people diagnosed with Covid-19. Prof David Bonsall, a senior researcher at Oxford University’s Nuffield Department of Medicine, told the Guardian that “we see it as the only alternative to … applying isolation to the whole population.”

Privacy International has said a Bluetooth LE system would be far less intrusive than other forms of tracking, such as using GPS or wifi data, because it would only keep a record of which devices had been near one another, rather than their actual locations.

However, the draft memo raises questions about the use of contact-tracing apps if they are introduced without sufficient safeguards or transparency. The notion of “de-anonymisation” of users, in particular, would appear to contradict advice given by the Information Commissioner’s Office (ICO) that identifying individuals from their location data may breach privacy law.

The deputy information commissioner said in a recent statement that data protection laws were not infringed as long as location data was “properly anonymised and aggregated”. An ICO spokesperson told the Guardian: “When personal data can be identified, organisations must comply with data protection law, including putting the appropriate safeguards in place to protect people’s information.”

However, the creation of apps to battle Covid-19 raise unprecedented questions about privacy. Edward Snowden, the whistleblower who exposed the US National Security Agency’s mass surveillance programmes seven years ago, has said the coronavirus could be exploited to usher in an era of bio-surveillance that persists even after the pandemic has ended.

If you have been affected or have any information, we'd like to hear from you. You can get in touch by filling in the form below, anonymously if you wish or contact us via WhatsApp by clicking here or adding the contact +44(0)7867825056. Only the Guardian can see your contributions and one of our journalists may contact you to discuss further.

Others are asking whether contact-tracing apps can really work, given that such large numbers of the population will need to download and use the technology for it to be effective, the lack of reliable testing, and the risk that such an open system could be abused by people fabricating symptoms. Ross Anderson, a professor of security engineering at Cambridge University, recently wrote that “anyone who’s worked on abuse will instantly realise that a voluntary app operated by anonymous actors is wide open to trolling”.