Comment by tastroder | Hacker News Reader

Comment by tastroder | Hacker News Reader

Parent Full thread

> Does the randomization happen at each new invocation of Bluetooth?

Doesn't matter. https://content.sciendo.com/view/journals/popets/2019/3/arti... - note that this is seemingly aptly published in a conference on privacy. Yes, what you want to use bluetooth for would likely work but we've worked a decade or so to prevent it.

You'll likely realize from my other comment that I dislike the general idea of this but honestly, I don't get the approach from a technical perspective. The idea is an app for smartphones, right? You have all kinds of sensors on those besides BT, e.g. WiFi, GPS. Comparing timestamped movement profiles would give you much better matching than approximating this stuff via BT environments, which these days at least theoretically are designed to explicitly prevent your use case and just seem to limit yourself artificially. The reason you dismissed geolocation is perfectly valid but that also applies to Bluetooth identifiers if you treat them as reliable indicators. If I get a (hashed or not) BT ID of infected persons, I can identify those - at the very least if their device is in my vicinity. And not only while this issue is active but afterwards. You would have to protect that data just as much, putting another ding in the "potential privacy implications" of the approach.

The privacy issue is complex. My take on it is quite simple:

I personally wouldn't mind if my (possibly randomized) BT address was made public, potentially identifying me as currently COVID-19 infected - heck, we will probably all have been on that list in a year or two as things stand today.

What someone (not me, of course) would probably mind, however, is if the geolocation data was used instead - and it showed what clubs I went to during the last 14 days.

> What someone (not me, of course) would probably mind, however, is if the geolocation data was used instead - and it showed what clubs I went to during the last 14 days.

And my point remains that, from a privacy perspective, that distinction is artificial and misleading. Your phone in this mode is seeing BT/BTLE devices all the time, which is why this (or WiFi / GPS profiling) work. On my route to work I pass by dozens if not more BT devices with static location, somebody with detailed log data over a few days will be able to mark both locations in a pretty fine grained manner. The proposed process is not and can not be anonymized sufficiently. Correlation is cheap these days, with big enough adoption a company with enough incentive or something like wigle.net for bluetooth devices will appear and the data will be misused. That might not present a viable problem in the short term during the current outbreak but the long term implications of tracking like this need to be discussed before releasing such a tool to the public.

There's other issues, e.g. a more direct and immediate scenario where Alice knows Bobs bluetooth MAC, as well as an infected in likely proximity, and dumps fake data into your service in order to quarantine him.

Your comments are very interesting, and I'd like more input/thoughts about such issues.

However, from your description of the Alice/Bob part, I'm still confused whether you realize that nobody is (or can be) quarantined in the proposed scheme?

The case you describe would, as I understand it be: "Bob is then advised by his own app not to visit his parents and be careful about not infecting others". A bad joke, sure, but not something that can "send him into quarantine", since nobody on the server side knows that he is in any danger.

I may be missing your point here - but if I am, please clarify and bare with me;-)

The point of that scenario was that, if the app takes off it it could quickly turn from a bad joke scenario to one with real impact. Either by Bob taking the reasonable step of self quarantine, unnecessary test + fearful waiting time, or in the worst case the app could be, like it's Chinese equivalent, used to restrict Bob's movement by others at checkpoints. Severside knowledge is pretty irrelevant if an armed guard or angry mob wants you to show the app before letting you get your Sunday brunch.

Reply on news.ycombinator.com