An important question here is: will this framework go away once the pandemic is over? Something tells me it won't.
It's not a "can we put the genie back in the bottle" scenario if the genie is wearing a bright warning vest announcing its presence everywhere. You can directly measure if it's still there. All other concerns are not technical ones. If you acknowledge digital contact tracing to be a thing, this is better for privacy than any other proposal so far. The framework is designed to prevent abuse even in case it would not go away.
Given the broad powers passed recently in the UK they could make having this app a legal requirement to go in any shop if they wanted, and whether apps can be uninstalled reasonably is down to whoever controls the OS.
Would it not make sense to require everyone who is able to to install and use this? Or require Google and apple to force install it?
I would still maintain that this nightmare scenario is a problem with any particular government that would implement and misuse such measures, not with an anonymization effort for the BTLE stack. We absolutely should push back against the former and insist on what's missing for a full system to be implemented in a sensible manner without infringing on basic human rights, that's a worthy hill to die on, this particular aspect is not.
If they can legally mandate an "app" they can mandate me having a device to run said "app".
It'd be absolutely absurd to mandate you having a spy with you at all times to exist in society.
"Sorry, don't have a phone, kthx", "Sorry, my phone doesn't use gapps, it's using a custom ROM", and what about these Linux phones?
Yeah, that's not going to work.
Seems like a pretty good system to me.
So long as all data remains on the physical device at all times and any access or export is _always_ actively initiated by the user, I don't see how it makes the current situation any worse. An abusive government can already subpoena or otherwise monitor all the network providers.
The advantage that this tracking proposal provides is that it unfurls contact tracing from one node. Until now, authorities have had to work from a large dataset ( all phones on a mast at a particular time ) inwards; now they can start with one node of interest and expand outwards.
Combined with some other 'temporary' pandemic measures, such as the legal requirement to carry your phone at all times, this provides a huge benefit to any authority.
In such a hypothetical scenario, how is making this (currently opt-in) framework mandatory any different from requiring you to install a government provided app? Such a government app could trivially log sensor and GPS data, yielding a _far_ more detailed view. The point is that the mere existence of this framework doesn't make the situation any worse than it already is.