Failures of scandal-hit Serco: How private contractor leading UK's coronavirus contact-tracing programme is beset by controversy

  • Serco faced claims in 2013 it overcharged the government for electronic tagging
  • It was later fined £19.2million in a settlement with Serious Fraud Office in 2019 
  • Hampshire-based firm also faced allegations of abuse at its immigration centre 
  • In 2018, Serco sparked fury after it emerged it planned to evict hundreds of asylum seekers from private accommodation in Glasgow without court orders
  • Here’s how to help people impacted by Covid-19

They are the scandal hit firm at the centre of the government's maligned contacting tracing efforts.

But Serco, which is one of the companies contracted to train call centre staff for the government's 'vital' contact tracing scheme, has hit the headlines for the wrong reasons in the past.

The Hampshire-based private contractor has been hit by a string of controversies in the past few years, including claims in 2013 that it had charged the government for electronically monitoring people who were either dead, in jail, or had left the country.

Yesterday, Serco, whose chief executive is Sir Winston Churchill's grandson Rupert Soames, faced fresh criticism after accidentally sharing the email address of 300 of its recruits for the government's contract tracing efforts.  

Serco, which is one of the companies contracted to train call centre staff for the government's 'vital' contact tracing scheme, has hit the headlines for the wrong reasons in the past

Serco, which is one of the companies contracted to train call centre staff for the government's 'vital' contact tracing scheme, has hit the headlines for the wrong reasons in the past

Serco, which is based in Hampshire (pictured: Serco's head office) has been hit by a string of controversies over the years, including claims in 2013 that it had charged the government for electronically monitoring people who were either dead, in jail, or had left the country

Serco, which is based in Hampshire (pictured: Serco's head office) has been hit by a string of controversies over the years, including claims in 2013 that it had charged the government for electronically monitoring people who were either dead, in jail, or had left the country

Yesterday, Serco, whose chief executive is Sir Winston Churchill's grandson Rupert Soames (pictured), faced fresh criticism after accidentally sharing the email address of 300 of its recruits for the government's contract tracing efforts

Yesterday, Serco, whose chief executive is Sir Winston Churchill's grandson Rupert Soames (pictured), faced fresh criticism after accidentally sharing the email address of 300 of its recruits for the government's contract tracing efforts

But the blunder, which will do little for the confidence of millions of Britons who will be asked to hand over their personal details as part of the contact tracing system, is far from the first time Serco has faced criticism.  

In July 2013, Serco, along with security firm G4S, who are also in the running to provide call centre staff for the contact tracing app, were accused of overcharging for their work tagging criminals. 

RESEARCHERS IDENTIFY 'SECURITY FLAWS' IN NHSX APP

Security researchers have highlighted a number of potential flaws in the coronavirus contact tracing app.

The issues have been flagged to the National Cyber Security Centre (NCSC), which is involved in the app's development, and it said it is in the process of fixing them.

The researchers also warned legal protections around data use are needed in order to better protect personal privacy on the app, which is currently being trialled on the Isle of Wight.

They say data associated with the app should be protected by legislation 'from use by law enforcement, or any usage not directly related to Covid-19 prevention'.

Harriet Harman, chair of the Joint Committee on Human Rights, said on Tuesday that new laws to protect the privacy of personal information gathered by the app are a 'no brainer'.

Ms Harman, who has prepared a Bill on the issue which is ready for introduction, said assurances by Health Secretary Matt Hancock do not provide any protection after he wrote to her saying the Government believes legislation is unnecessary because there is already the Data Protection Act.

In their study of the contact tracing app, which was shared with the NCSC last week, security researchers Professor Vanessa Teague and Dr Chris Culnane identified a number of issues, including a weakness in the app's registration process which could be exploited by hackers and used to manipulate data or create logs of fake contact events.

It also highlighted a flaw which means storing unencrypted data on a user's phone could potentially be used by law enforcement agencies to determine when two or more people met.

The research added that generating new random ID codes for users once a day, rather than every 15 minutes like in other systems, makes it theoretically possible to determine intimate details about an app user's lifestyle, such as whether they 'woke up and went to bed with the same person, or more revealingly, if they did not'.

Dr Ian Levy, technical director of the NCSC, thanked the researchers and confirmed the app development team is addressing all the issues raised.

'The intent of being open before national launch was to show what the app will do, how it will do it, and to get some peer review from security and privacy researchers,' he wrote in a blog post.

'Thank-you to everyone who's taken the time to look at the design and the beta code and provide us with useful feedback, whether that's directly, on GitHub or through the NCSC's vulnerability disclosure programme.

'Everything reported to the team will be properly triaged (although this is taking longer than normal).'

Dr Levy added the NCSC would not comment on specific legal issues raised by the researchers.

In a further statement, a spokesman for the NCSC said: 'Responsible security researchers are an overwhelming force for good and their feedback was openly requested for the quickly developed beta app.

'It was always hoped that measures such as releasing the code and explaining decisions behind the app would generate meaningful discussion with the security and privacy community.

'We look forward to continuing to work with security and cryptography researchers to make the app the best it can be for the public.'

 

Advertisement

Reports revealed that up to one in six of the 18,000 tags the government was billed for every day were not real.

The tags had been placed on criminals who were either dead, in jail or had left the country, it was claimed.

The accusations prompted Whitehall to scrutinise every government contract given to the two private firms.  

Serco and G4S were both stripped of their respective contracts by the government over the claims.

G4S agreed to pay back more than £100million in 2014, while Serco was fined nearly £19.2million and pay costs of £3.7million in 2019 as part of a settlement with the Serious Fraud Office. 

In September 2013, just months after the tagging allegations emerged, a Serco-run immigration centre was stung by sexual abuse allegations after a 23-year-old Roma woman claimed she was assaulted.

The woman - who wasn't identified - was awaiting deportation at Yarl's Wood in Bedfordshire after committing an unspecified crime.

Two male members of staff were sacked a month later due to 'inappropriate behaviour' with a detainee.

Despite the troubles, the Home Office awarded Serco £70million in 2014 to keep operating Yarl's Wood for another eight years.

In August 2014, campaigners claimed Serco was among a list of private contractors who used immigrant detainees for cheap labour.

Corporate Watch, the organisation behind the report, alleged Serco, G4S and others were 'exploiting their captive migrant workforce'.  

The Guardian reported some detainees held at detention centres were paid as little as £1 an hour.

Serco claimed at the time that the paid work was voluntary and in accordance with strict government rules.

Just months later, in January 2015, a refugee charity claimed female immigrants being held at the Serco-ran Yarl's Wood were 'treated like animals and sexually abused by staff'.

Women for Refugee Women said females held at the centre were watched by male staff in intimate situations including when using the toilet.

The charity interviewed 38 women who were recently or currently detained in Yarl's Wood.

Six women claimed staff had made sexual suggestions and three alleged they were touched sexually. Seven reported being physically assaulted.

Serco hit headlines once again in November 2017, when leaked Paradise Papers revealed a law firm branded Serco a 'high risk' client for its troubled past.

The Guardian reported that concerns had been raised about Serco's 'history of problems, failures, fatal errors and overcharging'.

In August 2018, Serco sparked fury after it emerged it planned to evict hundreds of asylum seekers living in private accommodation in Glasgow without court orders.

Officials provide free housing for asylum seekers until their applications are accepted.

Serco paused the move to evict tenants whose application was denied after the criticism over the planned action, the BBC reported.

The firm was taken to court over the move, which furious activists described as a form of 'housing apartheid'.

But Scotland's highest court ruled in November 2019 the eviction of asylum seekers without court orders was lawful.

Yesterday, Serco was forced to apologise today after accidentally sharing the email address of 300 of its recruits.

The blunder will likely be a confidence blow for Britons who will be expected to hand over their private details to companies like Serco in the coming weeks as the country exits lockdown. 

It came as the Government's test and trace plan was embroiled in fresh chaos yesterday, with a cabinet minister admitting the NHSX app won't be ready for weeks.

Contact tracers are already working in countries like Belgium, above, in the UK, 21,000 people have signed up to help track Covid-19

Contact tracers are already working in countries like Belgium, above, in the UK, 21,000 people have signed up to help track Covid-19 

The Government will launch a widespread contact tracing scheme to track down people who have been in touch with infected patientsz

The Government will launch a widespread contact tracing scheme to track down people who have been in touch with infected patients

Justice Secretary Robert Buckland said during a round of interviews today that the contact tracing app - which was promised to be rolled out from mid-May - would not be ready until at least next month.

Meanwhile Sitel, the other company involved in training contact tracing call centre recruits, faced criticism yesterday.

HOW WILL CONTACT TRACERS WORK ALONGSIDE THE APP? 

The bulk of contact tracing work will be contracted out to at least two companies, including Serco, who are being asked to provide 15,000 call centre staff. 

They will designated specific areas of the country and will receive alerts when NHSX app users come into contact with suspected patients.

It is their job to phone these people and advise they self isolate and be vigilant about changes in their health and about social distancing. If they become ill, they will be tested.

If a contact becomes infected, the same process begins for them and their social network. The idea is to keep track of how the virus moves through social circles and to try to stay a step ahead of it and prevent wider spread. 

Ministers have also promised an additional 3,000 former doctors and nurses who have been recruited from the pool of retired NHS staff who volunteered to return to help during the pandemic.   

They will be able to provide medical advice to confirmed and suspected patients.  

The tracers will make a list of people considered to have been put at risk by the patient, and those people will be notified that they might have the coronavirus.    

The NHSX app would need more than 70 per cent of the UK population to download and use it for it to be effective.

But ministers say physical contact tracing will make up for the shortcomings of the app if update is below 70 per cent.

Advertisement

The  privately owned contact centre company headquartered in the United States, last month faced questions from Labour MP, Luke Pollard, after claims from a whistle-blower suggested staff were not properly social distanced while working at one of its Plymouth call centres. 

But yesterday it came under fire over claims call centre recruits for the government's contact tracing system were paid for three days, despite doing 'virtually no work and receiving little training'.

The trainee contract tracer, who asked to remain anonymous, revealed he was employed as a 'Work at Home Customer Service Adviser' after applying through the job website Indeed.

The man was invited for a day of online training run by outsourcing firm Sitel on Sunday, where there was just one trainer for around 100 tracers.  

'We had a chat [box] where we could ask him questions, but the first hour and a half of the training was just people writing, 'I can't hear anything',' he said.

The trainees were told they were being hired as agents in the contact-tracing team acting as the first point of contact for suspected COVID-19 cases.

The man added: 'After the full day of training, people were still asking the most basic things. Someone also asked what they should do if they spoke to someone whose relative had died of the virus and he said we should look on YouTube where there are lots of videos about empathy and sympathy when talking to someone.'

'Then I looked at the rota and it said I was starting the next morning at 9am.'

The man logged in first thing on Monday to an email telling him to standby for instruction. He did nothing all day, but was assured he would still be paid.

One female recruit told the Guardian she had spent three days trying and failing to log into the Sitel system, despite Matt Hancock's assurances it was already up and running smoothly.    

Another told the BBC: 'I've never been so bored in my life, it is an extremely expensive way to sit around doing nothing for the state.'

A spokesperson for the Department of Health and Social Care insisted recruits were being thoroughly trained before being asked to make calls. 

 Health Secretary Matt Hancock announced on Monday that 21,000 tracers would be receiving 'rigorous' and 'detailed' training needed for the important role, seen as crucial for getting the country back up and running.  

Contact tracers are being employed to track down people by phone or email who have been exposed to an infected coronavirus patient to advise them to self-isolate.

They are set to be deployed along with the NHSX coronavirus app, which alerts users when they have been close to someone with the illness.  

Health Secretary Matt Hancock said earlier this month that the goal was to roll out the regime in 'mid-May', but following a series of blunders has since refused to set a date.

A number of potential security flaws suggesting the software can be easily hacked have been flagged to the National Cyber Security Centre (NCSC), which are thought to be partly to blame for the hold-up.

Justice Secretary Robert Buckland conceded yesterday that the scheme may not be ready for another month. 

Health Secretary Matt Hancock said earlier this month that the goal was to roll out the regime in 'mid-May', but following a series of blunders has since refused to set a date

Health Secretary Matt Hancock said earlier this month that the goal was to roll out the regime in 'mid-May', but following a series of blunders has since refused to set a date

The NHSX app is another critical piece of the puzzle.

People will be asked to download the software, and it will use bluetooth to detect whether they have been near anyone who has been diagnosed.

They can then be told to isolate to stamp out flare-ups of the disease.

The director for Public Health Sheffield Greg Fell warned that test and trace is 'fundamental to breaking chains of transmission and reopening society'.

He admitted he did not 'know the final details of how it will work', and insisted properly trained staff would have to do the 'heavy lifting work'.

Mr Fell highlighted the dangers of relying on the app and call centres alone, saying detailed engagement with communities was key.

'That can't be managed only by people working in a call centre 250 miles away,' he told BBC Radio 4's Today programme.

Downing Street again refused to give a date for when the new contact tracing programme will begin.

The blame game was also in full swing this week as a Cabinet minister claimed blunders in the coronavirus response were down to 'wrong' science advice.

Therese Coffey insisted the government had just been following the guidance from experts as she fended off damning criticism from MPs over 'inadequate' testing.

The Science and Technology Committee found hospital staff, care home workers and residents were put at risk because of a lack of capacity for screening 'when the spread of the virus was at its most rampant'.

Routine testing for those with symptoms was abandoned on March 12, when the government shifted to its 'delay' phase, with checks reserved for hospital patients and health staff.

HOW THE APP WILL WORK: STEP-BY-STEP 

  1. The user will download the app onto their smartphone once it becomes available in their area.
  2. To register someone must put in the first half of their postcode, which shows the town or borough they live in.
  3. They will then be asked whether they have a new, continuous cough or a fever - the two main signs of COVID-19. If no, nothing will happen. If yes, they will be told to order a coronavirus test. 
  4. The user will be told to keep their Bluetooth switched on at all times and the app will run in the background without them doing anything.
  5. When they go out, the app will keep a log of every time it comes within Bluetooth range of another phone with the app. This will be anonymous, with each app registered to a code rather than a person or address.
  6. If and when someone develops COVID-19 symptoms they will be helped to order a test through the app and every code that their app has logged a contact with will be warned of a potential infection in their network. The people with those codes will be told to self-isolate until the test result comes back.
  7. If the result is positive, anyone who receives an alert because they have been close to the patient will be told to self-isolate for at least seven days and to order themselves a test if they start to feel ill.
  8. If the result is negative everybody will be told to carry on as normal.

Notes: The app will rely on people being honest about whether they are ill.

It is not clear what will constitute a close enough contact for someone to be notified about possible COVID-19 infection. The general rule is if you are within 6'6' (2m) of someone for 15 minutes or more, but the Department of Health said a 'complex risk algorithm' will decide.