No tracking. No cookies
Subscriptions
Subscriptions
Amazon Web Services Wins COVID-19 Contact Tracing DealDespite Data Sharing Concerns
Questions have been raised about whether Amazon could be required to share UK contact trace data with the US Government, reports Stephen Komarnyckyj
Amazon Web Services (AWS) is being employed to develop software for the UK’s COVID-19 contact tracing website by Public Health England (PHE). The contract, which is worth £313,262, was published on 11 September and awarded without other firms having the opportunity to compete.
PHE was able to bypass EU regulations for procurement because of the contract’s relatively low value. However, the manner in which the award was made raises questions about how effectively the Government is procuring services for COVID-19.
AWS was awarded the contract on 11 May and began work on 12 May, according to information on the Government contracts website. However, the notice does not include a contract document. It’s unclear how AWS’s performance will be measured and what steps the Government can take if the company fails to deliver.
People who have tested positive for COVID-19 use the Government’s contact tracing website to input the details of individuals they have been in contact with, so they can be asked to self-isolate.
AWS won a similar contract to provide contact tracing software for the Australian Government in April 2020. However, the Australian Law Council raised concerns that the firm might not be able to protect personal data held on its servers from US courts.
The CLOUD Act 2018 is US legislation which requires American cloud service firms to hand over data, wherever in the world it is stored, if subpoenaed in the US. This is of course a relatively high threshold to meet: there must be a warrant issued by a US court, under the belief that law enforcement has reasonable grounds to request the information, and that the information directly relates to a crime.
However, the UK arm of AWS is legally controlled by Amazon.com, Inc which is a US corporation subject to American law. So, it could be compelled to hand over the data, if a US court asked it to do so.
The Australian Government insisted that it would protect the personal data of its citizens held by AWS. However, it is unclear whether the UK Government can give a similar undertaking. Indeed, given the UK’s wish to obtain a trade deal with the US in 2021, the British Government might be pressured into accepting that the CLOUD Act applies to data held in the UK.
AWS claims on its website that it often challenges requests for data made by foreign governments, including the US. “We assess whether the request would violate the laws of the United States or of the foreign country in which the data is located, or would violate the customer’s rights under the relevant laws,” the website reads.
“We rigorously enforce applicable legal standards to limit – or reject outright – any law enforcement request for data coming from any country, including the United States.”
Contact Tracing Conundrum
While the Government’s contact tracing website is up and running, there has been less success with its much-debated, accompanying app.
On 10 September 2020, Scotland launched a contact tracing app which uses the same software as the Republic of Ireland. The app, developed by Irish software firm NearForm, is also being adopted in Northern Ireland and has already been downloaded over 600,000 times.
There are obvious issues with people traveling between England and Scotland using different contact tracing apps that will not work in both countries. However, while the Scottish Government picked a simple, workable solution from those available, Westminster’s attempts to develop a contract tracing app have been chaotic. The NHS trialled its own contract tracing app on the Isle of Wight in May 2020 but it has only just been scheduled for launch in England and Wales on 24 September.
The delay could have been avoided if, for example, the UK Government had adopted the German contact tracing app in June 2020, which could have been downloaded freely from the web without spending a penny on developing unique software. Indeed, several other countries had developed contact tracing apps which the UK could have adopted early in 2020.
Alternatively, Westminster could have worked with the devolved administrations in Northern Ireland and Scotland to ensure that the same contact tracing software was adopted across the United Kingdom.
A lack of coordination across the UK and the delay in launching the app has arguably cost lives and may yet lead to more needless deaths.