Disruptive Proactivity

It’s notable from the NCSC blog and detailed paper which user needs it makes harder, resulting from the DHSC’s public statements the new app doesn’t expect to be true.

What should the pre-vaccine-normal look like for a user?

Here’s your main interaction with the app after setting it up:

• Your phone goes ping as you’re walking to the tube, and alerts you that you may have been exposed. 

As you have no symptoms, and because alerts or advice do not constitute decisions, what should you do?

1. You stop by (ideally outside) the local pharmacy and take a covid test (by the time it will be normal to walk down the street to the tube again, there should be enough covid tests available for you to do this; but DHSC have to deliver, and NHSX doesn’t seem to think they will).

2. A (socially distanced) long coffee later, you know your result and have evidence on which to take a clearly defined action (either carry on to the tube if negative, or turn round and go (/stay) home if positive). 

3. If you tell your app that you’ve had a negative test, it shouldn’t notify you again if the exposure it is notifying you about is much older than your most recent negative test.

If those steps can’t happen, the overall covid response remains terrible; if those steps can happen, then many of the protections and threat models that NCSC/NHSX cite as their reason for their approach are irrelevant (but NCSC/GCHQ do like their central authorities for other political reasons).

Now we have seen the app screenshots, as built, NHSX is not yet at the point of facilitating that process: you’ll have no way to know whether you need to take another test tomorrow despite the one you took yesterday…

If No10/DHSC’s public statements were treated as accurate inside NHSX, then there would be an expectation of enough testing for people to take an informed action on a notification – instead NHSX/NCSC have created a complicated threat model designed by computer people rather than public health people. (There are things they could do about that, but there is no evidence of those things, and it would breach their promises about only holding anonymised data etc)

— 

An aside on the ICO’s role: they may be in a complex position, but handing the advisory role to the Centre for Data Exploitation and Intrusion (with their track record of cheerleeding anything anyone in Government wants to do) and the sycophantic aspects of civil society craving corporate recognition (and the funding) would be catastrophic for non-pandemic times. The ICO is far from perfect at time, but a new model set up in a rush would be even worse. 

—

Edits: point 2 was clarified and links added.

It was uniquely powerful user research which demonstrated the bureaucratic brutality of the old carers allowance forms, and which changed that system for the better.  The user research philosophy undoubtedly works when you have a benevolent hierarchy interested in helping people, but will that describe the new Government?

If ‘user research is a team sport’, it has become increasingly necessary to check that everyone is actually playing for the same side. The institutions have adapted and now undermine good intent in favour of internal interests – user research is little more than a push poll used to justify what institutions wanted to do anyway.

The same applies to algorithms and AI – user research can find an argument to justify anything, no matter how harmful. Algorithms are used to justify choices that no human would be willing to justify to a court.

The data you need to run efficient and effective digital services is the same data you need to run just digital services. From the perspective of justice, the 13 data items identified by Dr Byrom serve as the indicators of potential discrimination in digital (justice) services. Instead, we focus on narratives from user research which don’t necessarily cover all real world user needs, and often policy just hopes that user research has caught everything.  

None of this is new or silo specific, it shows up across data and digital, from AI to algorithms, from business models to ‘patient involvement’. NHSX recently put out a call for “Patient Voice Advisors” – 2 people to cover the entire NHSX remit is ambitious, but will likely result in appointing professional astroturfers rather than engaged patients and real users for real questions. But it ticks the civil service boxes for involvement, and if each civil servant involved knows that every business model they propose will get gamed (they do and they will), they can still ignore it because it’s not their problem to solve.

The user research mantra of ‘you are not your user’ is entirely true, but contains an implicit assumption that those reading or commissioning the research care about the difference at all (or, more harshly, care about their users at all). Doing anything without user research is a crapshoot; but that doesn’t mean something based on user research can deliver something good – good is sometimes excluded by deliberate policy choice.

It is better to do user research than not – but it has to be both read, and not kneecapped at the beginning to only look at things that are politically palatable, and disincentive the other things. It is far easier to give technical assistance to those who already understand justice and the rule of law, than it is to teach Mark Zuckerberg about discrimination.

There is now an entire community who have to be served by UC who hear ‘service design’ and think of the vindictiveness of DWP’s choices in delivery – that is what service design and user research has delivered for them. Those people see the harms of ‘digital first’ from Government – and those harms are all digital is for them. It may be a well oiled machine for policy and well designed services, but what is the machine being used for?

GDS is part of the Government, (obviously), which sometimes causes political trouble at the office. Code for America avoided that problem by not having Political leadership – CfA is a not for profit who works for the people (and for a summary of the consequences of the distinction between the two, see the opening paragraph of the preface to Edward Snowden’s book). 

Where is the equivalent of ‘getCalFresh’ for Universal Credit? A better question is which organisation would you think of to build (and run) it? How would we know if it’s good?