Hacker News Reader

Comment by jedberg | Hacker News Reader

They already have the shiny button. They can compel cell phone companies to give this data to the government already, without you knowing about it.

At least this way you will get some control of the info and you'll know what was collected and have control of it's disclosure (for now).

In other words, this is no worse than what the government is already capable of, it just makes it easier for you to share the data with health care providers.

The government already has all these abilities.

View on HN

> They can compel cell phone companies to give this data to the government already

Bluetooth has a quite small range, which may give higher tracking precision (to anyone receiving the signal) than the data cell phone companies have.

The capability of using the Bluetooth stack for tracking is not new, this proposal limits the way that data can be used. See the cryptographic specification linked below.

The alternative would be GPS which some governments are looking at now. It might give higher precision with a grid of location data to enhance it, but I would assume the protocol prevents this eg by some randomization of ids?

GPS is completely unidirectional from satellites to receivers and thus the satellites cannot be used to track the receivers

The receivers can be made to report their GPS data back for tracking purposes.

What skuhn said. That is what the solution the Norwegian and Danish government is implementing is supposedly doing. Reporting the GPS data back to a central server. If you’re using iPhone.

https://www.simula.no/news/digital-contact-tracing-qa#How%20...?

Currently, yes, but "numerical results with a system operating at 39 GHz show that sub-meter 3D positioning accuracy is achievable in future mmW 5G networks" :)

https://arxiv.org/abs/1803.09478

Little did we know, 5G didn't cause Covid but Covid will cause 5G...

Bluetooth 5.1 devices can do both distance and direction, so if you have a bunch of beacons you can determine your location to sub-meter accuracy.

iPhones don't have Bluetooth 5.1 yet, and I'm assuming no Android phones either.

Qualcomm's latest flagship soc (865) with 5G has Bluetooth 5.1 support as far as I know.

This app appears to use peer to peer Bluetooth between phones, not beacons. The intention is to determine relative proximity between users, not absolute position.

Tracking isn't just by connection. Their point is that bluetooth tracking (by beacon or otherwise) is already a thing - many major retailers and franchises already do it.

It's ridiculously easy to turn any Bluetooth device into a beacon. All you have to do is configure the BLE advertising frame for the device and then set the device to advertise. I can turn my laptop into a beacon in about 5 minutes(some web searching to remember exact commands and formats).

Realistically, what does sub-metre accuracy help with "evil" (catch-all for all non-disease-related) surveillance that, say, a 5-10m is insufficient for?

"Evil" is a bit loaded, but what that level of accuracy does is let you say "this person was in front of the shelves for products X, Y and Z" as opposed to "this person was probably in the store".

Hyper localized association. Like, for example, a dissident organizing a local chapter of some organization who disperses information via in person hand offs of handwritten papers every. In this example, their hand off point, in a small town of tens of thousands, is the Saturday farmers' market that runs from 8 until 5 or so. They and their conspirators all went to the farmers' market regularly before so it's completely natural for them to appear within 5-10 meters of each other a few Saturdays a month (usually because the three most popular food trucks have long lines right next to each other). Except now "evil" can roll up the ringleader and see a pattern of who passed within an arm's reach every time the ringleader got a message from the head organization without actually spending the resources to surveil anyone in person.

"Evil" usually doesn't care enough about most people to spend significant resources surveiling them. The danger in dropping that threshold is that "evil" invents new ways to exploit any efficiency.

I'm pretty sure he was referring to cell tower location data, not bluetooth. Though cell tower location data has low resolution, in the order of a few 100 feet to several miles. Not useful for contact tracing.

5g, I have heard, allows more fine-grained positioning.

There is also another idea floating - let the phones emit an ultrasound - then the other phone can estimate proximity, by the volume or delays.

Thanks. I wasn’t using my battery anyways.

none of the proposed tracking methods are without additional battery consumption, as far as I can tell..

Just have everyone wear QR code name tags

that isn't a reason to be complacent about furthering governmental/corporate surveillance capabilities.

in fact, it should remind us to take away those prior surveillance capabilities, and demand any contact tracing system to give control to users and be fully off-limits to large power structures (e.g., only shared between users and researchers).

and being hard to do so is no excuse. we have millions of people we can work on the problem if it's so important to warrant such massive effort.

People are working on contact tracing, this takes care of one of the harder parts without dictating central control in a pretty sensible manner. Being wary of privacy adverse interests in this context is good but in this context makes little sense. This specification only touches the question of data leaving the device in ways that restrict what the outside party, in an RFC manner MUST wording, can do with the data.

It's pretty clear that we will get contact tracing applications in many parts of the world, regardless of any action Apple or Google might have taken. Might as well base it on something that does not compromise the user base wholesale.

The protocol is explicitly designed to not share information - the data does not contain location information, and the only thing that someone can do with that data is verify if they have seen some of the identifiers that were published by someone else.

They can compel, but also what they typically do is to purchase from them the data. That way they don't even need warrants. We tally need stronger regulations about sensitive information like that.

It's much worse because it won't have judicial oversight.

Unfortunately neither does existing location data collecting.

> At least this way you will get some control

doubt it.

> it just makes it easier for you to share the data with health care providers

I don't want to share any more information with these corporate heath care providers based on real world experience with them. Is that "allowed".

Reply on news.ycombinator.com