NHS’s UK contact tracing app, scheduled for mid-May, has been postponed until June due to security issues.
UK contact tracing app postponed due to security issues
The NHS app has at least seven security flaws detected by security researchers Dr. Chris Culnane and Vanessa Teague. First, there is a lack of data encryption. A lack of data encryption allows user data to become accessible to the UK government outside of COVID-19-related purposes.
Next, security loopholes could allow hackers to intercept COVID-19 exposure notifications. Hackers could stop these notifications altogether or send out fake notifications instead. Hackers could intercept phones and send out a false confirmation of COVID-19 when the phone user doesn’t have it at all.
Last but not least, the random ID only changes once every 24 hours. This gives hackers an entire day to hack into user phones. With that amount of time, users could easily predict a user’s random ID and illegally enter into their phone system.
Such a timeframe for hackers makes app users vulnerable. The purpose of random ID is to prevent hacking, and a “random” ID doesn’t stay “random” if it lasts too long. As a result, the NHS app needs frequent ID changes throughout the day.
NHS app allows privacy loopholes, by design
The NHS app allows privacy loopholes by design by way of “centralized” architecture. Essentially, the app requires UK users’ contact data to be saved to some sort of server or database. The problem with this, however, is the same as that of the unencrypted data loophole.
It allows the UK to retrieve such information once the COVID-19 pandemic is over. Additionally, the UK government could maintain access to user phone data and thus, user phones, even after the pandemic ends. The purpose of centralized contact tracing is to keep info until the pandemic ends, not to continue accessing user data indefinitely.
The NHS app and its centralization are in stark contrast to Google and Apple’s contact tracing solution (exposure notifications). Google and Apple’s solution is decentralized, saving user contact-tracing info to users’ phones.
Google and Apple require developers and health authorities to use their API in accordance with their rules. Chief among them is to maintain user privacy and use phone data in accordance with that effect. After the pandemic, Google and Apple, like NHS, intend to toss the data.
However, unlike the privacy loophole of the NHS app (unencryped data), Google and Apple’s exposure contact data is encrypted. And, above all this, Google and Apple’s user random IDs change every 15 minutes, not every 24 hours like the NHS solution.
The NHS app is an alternative to Google and Apple’s API because NHS didn’t want to give Google, Apple, and the US Government access to user data.
Other contact tracing solutions include China’s Close Contact Detector and Singapore’s TraceTogether apps, as well as Australia’s COVIDSafe.