Google Apple Contact Tracing (GACT): a wolf in sheep’s clothes?
blog.xot.nl
blog.xot.nl
> GACT creates a dormant functionality for mass surveillance, that can be turned on with the flip of a virtual switch at Apple or Google HQ.
If you don't trust Google or Apple to do what they say they do then you need to stop using their OS and hardware. It is already the case that Google and Apple can push (more) surveillance into your device anytime. GACT does not change that.
> Which makes the whole GACT platform a smokescreen really, as exactly the strong oversight would be required if the GACT platform was not there, and apps requested special access to Bluetooth to implement their own contact tracing technology.
Not at all. Plausible advantages of GACT: a) Google and Apple don't have to evaluate the properties of each app's Bluetooth protocol; b) standardizing the protocol prevents Balkanization and makes tracing much more effective; c) Google and Apple are likely to implement it better.
Another problem with this article is that the criticism is not constructive. If we believe the conclusions of the article, then what? Is there a better way to leverage smartphones for contact tracing? Or should we abjure smartphone-powered contact tracing? Doing what instead? "This sucks" without comparing it to alternatives is not actionable.
Edit: and... five years later. “There was a mistake in the random number generator, all keys are discoverable”. Like, you know, the Intel Security Module.
Oh, and maybe this could also be used to avoid certain crimes such as terrorism?
You know where this leads to.
> Oh, and maybe this could also be used to avoid certain crimes such as terrorism?
> You know where this leads to.
Exactly, these capabilities won't go away. Today they are used for good but tomorrow? Not to invoke Godwin's Law but these contact tracing capabilities would have been a Nazi's wet dream.
Full open-source everything isn’t air-tight, but potentially a lot better than what we’ve got.
Also: as a mathematician, there is lots of value in a counterexample to part of a proof. Just that, even though the final result is true.
Not necessarily. They included in the article that we could use decentralized contact tracing instead; and, an article arguing against a feature doesn't need an alternative.
If a refrigerator were being released with a microwave, do I really need to provide alternatives to where I could put the microwave instead?
Among other arguments, it argues that contact tracing is a source of mass surveillance. That alone, for the appropriate crowd, is enough reason to not use it. There doesn't need to be an alternative because the alternative is _not having it_.
Just because a bunch of developers ended up wasting their resources on a feature that is a net loss for society doesn't mean that the feature needs to be released.
GACT is decentralized. The article is arguing against decentralized contact tracing.
> a feature that is a net loss for society
The article doesn't even try to make that argument, which is why it is not very good.
Perhaps similar or related, I'd read that Taiwan's using an alert system[1] that uses the absence of cell phone activity as a sign that it may be necessary to check on the owner.
Some places have digital access but in general the temperature measurement of bigger buildings are automated. But most places I went to had a paper form to fill out your details. I assume those are shared with law enforcement and CDC once one person who attended the building has been traced as a positive case and then all people and their contacts will be notified and tested.
There is no centralized government mandated central database that I know of. But I do know that once a crime happens they're quite good at tracing your public movements.
Contact tracing is clearly useful, but on it’s one does not change the basic reproduction numbers much. Look at South Korea which still has active infections despite active contact tracing and very successful social distancing.
Contact tracing COVID-19 is suplimental not a solution.
PS: As to my point, if you’re a grocery store employee in NYC you are likely to have been in contact with someone with COVID-19 in the last week. We can’t simply send all of them home, that’s the issue with contact tracing when a meaningful percentage of the population is infected. You need looser restrictions which reduces effectiveness.
“but not reduced it enough that contact tracing is likely viable”
For example, NYC has seemingly slowed the spread enough it’s possible to Test for and track new cases. But if you dig into their numbers 4,264 deaths are linked to COVID but where not tested prior to death. https://www1.nyc.gov/site/doh/covid/covid-19-data.page. They have little idea who’s currently infected and “ Due to delays in reporting, recent data are incomplete.”
Essentially they need a solid 2 weeks of minimal new cases. At which point they can start meaningful contract tracing, but contract tracing does not mean you can just get back to normal. Just slightly reduce the amount of isolation.
Remember, virus still doubles every 2-3 days under normal conditions. Without a vaccine or herd immunity, contact tracing alone does very little. It’s enough to reopen dental offices possibly hair salons, not schools.
If you want to live luxuriously, also put a netbook, X1 Carbon, MacBook Air, whatever, in your backpack, then you have Internet, too.
This is not an excuse for the outrageous tracking plans of Apple and Google, I just hope more people will do this as a reaction to those plans.
EDIT: I may have misunderstood the "no alternative", I assumed it was about the need to own a "smart" phone.
This is likely to be untrue in the immediate future. This is probably already true in places like China, where mobile payments are the norm.
As a personal example, and I know this does not yet apply to the US, but where I live it is impossible (or so inconvenient that it might as well be not possible) to do some banking operations without an Android or iOS device, as even accessing my bank's website requires me to have the app installed for token generation. I'm sure if I shopped around I could still find a smaller bank without such a requirement or live with the limitations, maybe finagle a way to use an emulator or something equally inconvenient, but I'm quite certain that this will not last and a smartphone will become essential. A lot of other things are also quite inconvenient without a smartphone around here.
I know the US and Europe have a distinct resistance to the smartphone (or even the computer) becoming required to live as anything but a homeless vagrant because their economies and infrastructure developed before smartphones were even an idea, which gives them the luxury to resist these technologies on moral grounds, or even on the grounds of not wanting to learn the new thing. On the other hand, countries whose economies developed in lockstep with cellular technologies and smartphones (China, India, much of Africa, South-East Asia, much of Latin America, etc.) don't have that particular luxury or simply take a much more pragmatic approach to the whole thing. In these places it is already incredibly inconvenient to get by without a smartphone and will likely become impossible in the near future, if it isn't already.
When smartphones and the internet do become essential to life, I can only hope that the laws of the land have managed to catch up by then. I am not particularly optimistic on this aspect, though, and I suspect it will take some kind of major disaster and/or abuse of human rights (or more likely, a series of them) to happen for another "age of enlightenment"-like period to happen, focused on information technology this time.
EDIT: spelling
Yeah. Because they can run out of power, they are easily damaged, and, generally, bug and exploit ridden.
A bank card is near indestructible.
I've seen this used at Wells Fargo ATMs.
Modern cards disable the magnetic stripe, and the chip is surprisingly secure.
https://www.cnet.com/news/homeless-not-phoneless-askizzy-app...
I do think making a smartphone a requirement for living is a genuinely catastrophic idea, not simply an ivory tower exercise nor conservativism. Requiring people to possess and carry with them at all times a computer with a myriad of sensors and an ever-broadcasting beacon not under their control seems terribly fragile, unnatural, caste-creating and cruel. It is worthwhile to fight this, despite it being undeniably convenient for some things.
YES
Since the Google Maps 'Allow 24/7 location tracing? Yes/Maybe Later' popping up once every other week, it is pretty clear that at least Google is willing to push surveillance as hard as possible. Once they have GACT built, deployed en masse and somewhat trusted by the public, it is not hard to infer they'll be willing to push any number of dark patterns to make it the de-facto reality for 99% of the population out there.
In summary: Yes, they can push any shit right now on your phone. No, they don't just push it yet because they are afraid of public / internal backlash. Yes, they'll do everything in their power to boil the proverbial frog and gradually reduce the backlash potential, and will eventually push the most invasive surveillance they can possibly conceive. And they are pretty imaginative.
Medium term bet: Within a year, Google will change GACT from opt-in to [de-facto] opt-out. For example by nagging you every two weeks: 'Protect your grandma life? Yes/Maybe Later'.
Most users are not your typical HN reader. Whatever is the default, or easy choice is the one that they are going to go for. Regulations were needed to forbid dark patterns with fishy defaults and pre-added items in the shopping car. People which profession is not related to computers may not have the time to spend analyzing and having a deep understanding of complex ethical computer problems.
> If you don't trust Google or Apple to do what they say they do then you need to stop using their OS and hardware.
I though that this argument was discarded long time ago. If I do not want to use Google nor Apple what are the alternatives? (I really mean it, it is not a cheap shot to your next argument, that is not a bad one) My bank has apps for iOS and Android, like my travel agency and even government. When so much depends on two providers choice is not really there.
That two points does not add much to your argument, as they are not good arguments in this or any situation. Leave them out next time and I think that your argument will gain more strength.
I agree that a constructive criticism is important, thou.
Which doesn't necessarily mean that the typical HN reader is right and most users are wrong. Many users will be prepared to sacrifice a bit of a "freedom" that HN users prize highly; that doesn't mean they're wrong to do so, just that their priorities differ.
I agree that this situation needs to be preserved. FWIW I worked at Mozilla for a long time because I was (and still am) enthusiastic about their mission, which is partly about making sure the Web remains a) a strong platform for such applications and b) not wholly controlled by Apple and Google. Part of that was doing FirefoxOS which mostly failed but curiously, via KaiOS in India, is also kind of succeeding.
Although it's not stated by the author, one simple and low-cost approach is to take more time for further discussion and review before accepting deployment of a system like this.
To those who might argue that we "don't have time to delay" and need to rush this functionality out, then I would respond that a rushed solution can often be worse than doing nothing -- especially if there is no easy way to roll it back.
Therefore my personal suggestions would either be to take more pause before accepting and deploying a single solution like this, or to enact stringent and specific time bounds on the rollout.
That is a reality-independent objection that can apply in any situation and delay anything indefinitely.
Lots of experts say that a robust digital contact-tracing solution (as part of a multipronged contact-tracing effort) could provide big health and economic benefits, the sooner the better. That doesn't mean we should have no discussion and review, but it does mean we should expedite them. We have at least a month before Google and Apple start rolling out their stuff, let's make the most of it.
My primary concern is related to maintaining pleasant social interaction and a reasonable balance of power on a time horizon of five years and beyond.
To me it's hard to imagine that a continuous digital record of human interactions that is subject to a proprietary protocol and implementation would be the safest situation to end up in.
That's "simple and low-cost" in the sense that doing nothing is simple and low-cost, usually. But it's not an "approach" to anything. It's also not low-cost considering thousands of people are dying every day.
It doesn't seem to me that there are easy solutions for this problems that offer better privacy that we haven't yet thought about for lack of time.
I'm not suggesting delaying forever, and I do realize that there is human impact at the moment. I would not refer to the value of life in monetary terms that way.
There may not be easy solutions but there are plenty of other contract tracing technologies[1] that experts have been discussing, developing and critiquing.
I am suggesting that we allow those experts the time they need - no more, and no less - to get their work done to a sufficient level and report their findings to decision-makers.
After that feedback is gathered it could become apparent that deploying GACT as a closed-source, time-unbounded OS-level feature with app approval restricted to two companies situated in one nation of the world is less than ideal.
That could allow nations to collectively ask for changes to the proposal, with solidarity in their concerns and expert evidence to back it up.
[1] - "Unified research on privacy-preserving contact tracing and exposure notification", https://docs.google.com/document/d/16Kh4_Q_tmyRh0-v452wiul9o...
Even if Google or Apple are _capable_ of doing something evil, you can stil prevent them from excersing that power by not setting an example that it's okay to do so.
Genuinely, it's not Google nor Apple that I fear doing something evil here.
Google will try to give me more targeted ads, without giving that detailed data to their app developers, but instead just making their demographics tools better.
Apple will do what they think will help the circumstance.
I fear the government doing evil with it, especially under the guise of good.
"Hey, we found this terrorist's phone number, turns out he has an Android device. Give me every person that's been physically near him in the last 24 hours"
"Hey, these 37 people were at a protest, where do they spend their off time?"
Well, sure; if it didn't have walls, it wouldn't be a castle.
Some castles rely entirely on their own walls
And then they'll do it anyway a few years later, when you're not looking. Just look at Google's introduction and continuous tightening of SafetyNet requirements.
And what the hell can you do? Switch to buying Apple, who set the gold standard for this crap years ago? Switch to Purism, which BankID (practically mandatory for life in Sweden, sadly) still hasn't been ported to?
You get a chance and you take it. All things bring you towards success one step at a time, as unsatisfying as it might feel.
How realistic is to expect populace to exclude their choice of smartphones that are the dominant ones in market?
Yes we should, if we complain about surveillance of Uighurs in China:
https://www.ft.com/content/dfec4ac4-6bf5-11e9-80c7-60ee53e66...
Speaking of China, ironically they are already running out of new patients:
https://www.thestreet.com/investing/gilead-cancels-second-re...
So probably Apple and Google have to hurry to use covid as an excuse to push their new data collection solution.
The problem arises because once it is widespread flipping it to mandatory for all phones is trivial. Check YES to agree to our new Privacy Policy ;)
We've seen opt-out abused before so it is down to whether you feel you can use a platform known for not respecting your choices.
Often times, it's a simple boolean value, do you want to trust that bool will stay the same, always?
Perhaps I should have said "since the Red Scare" or "since the War on Drugs"
In fact the end of McCarthy came after McCarthy. That particular abomination universally being understood as one the darkest periods is also progress.
I’m also somewhat certain the idea of any net loss of freedom over the last 50 years would be considered a bad joke by anyone not cis/white/hetero/male. Into the 70s, you weren’t allowed to take a job or have a bank account without your husband’s permission.
And if you insist on limiting this to just the freedoms of the all-American white bro: the Boomer generation was still subject to the draft. Spending two years in an Asian rainforest in perpetual danger of dying would seem to be quite worse, liberty-wise, than... whatever you're calling "authoritarianism".
It does legitimize it and that is a very important thing. Right now, pushing this kind of thing covertly would be disastrous if (when) it is discovered. With GACT, it's already there so it's presence alone is not suspicious and can be enabled surreptitiously.
> Or should we abjure smartphone-powered contact tracing?
Yes, in its present state, I think we should. We've done without smartphone-powered contact tracing before so it is clearly not essential. In its current form, it is worse than the alternative of traditional contact tracing.
We can't trust Apple/Google to manage the anonymous data behind Contract Tracing but we can for our photos, phone calls, messages, web history, app data and GPS locations.
And we have to be fearful because this anonymous data is somehow going to be linked by Apple/Google to real persons and used for mass surveillance. But yet they could have done this for years without needing GACT as an excuse.
I'm not sure why this is being downvoted. See https://covid19-static.cdn-apple.com/applications/covid19/cu...:
"The Contact Tracing Bluetooth Specification does not use location for proximity detection. It strictly uses Bluetooth beaconing to detect proximity."
1. the telcos have months - if not years - of LAC update data stored for every phone. They know where you sleep, who visits and where you work and shop;
2. they analyse the CDR for every call/SMS send and received (caller and receiving party cells) [look at your spam SMS with a jaundiced eye];
3. they 'ping' thousands of phones* daily to trilaterate the location to metres (and/or A-GPS, TDOA, etc.)
4. they analyse the voice and data handover records.
* The preferred way to do this with a veneer of deniability is for the authorities to add in a few phones into the known associates list of phones to be monitored in an otherwise legitimate drug or terrorist warrant. They judges will never know (and certainly don't ask).
I believe there are other ways to fight viruses, we (the world) should invest massively in biological R&D to better understand, protect, control and heal our body rather than track people. Tracking people is a low-level solution that misses the bigger picture.
Maybe this will be possible in 50 or 200 years, but the world we currently live in is not ready to both track people and respect basic human rights, in my opinion.
By the way : same argument is valid for nuclear weapons. Why don't we accept that all countries get nuclear weapons? Because it would be dangerous in the wrong hands.
Not doing participating yet continuing to move about society as it starts to reopen, prior to a vaccine, seems more morally problematic in my mind.
Just because our rights are already eroded doesn't mean we should give up the fight and disable our freedom.
Nobody said we should trust Google/Apple with any of that. This tracking of our anonymous data should only be allowed to be unencrypted by warrant. All data produced by the device stored on the cloud should be encrypted, unaccessable to Google and Apple.
Instead of blindly trusting corporations, we could implement regulations, allowing oversight and preventing unreasonable searches.
In any case, I use an Android phone and Google can't access my photos, calls, messages, web history, app data, or GPS locations. I've chosen a radio firmware which completely disables the GPS.
Looks like it's about time to get rid of Google completely from my Google phone.
I used to work at a telco and we absolutely knew your location based off base station triangulation. And we knew who you called and messaged and who was nearby to you.
i.e. most folks in favor of GACT adoption see the alternative path, of using actual location data without opt in and operated by the government, as a scarier erosion of privacy.
You cannot use this system to determine if two people have been in contact. It doesn’t have the capability.
All you can tell is if one person who explicitly participates in the system has had contact with one or more of any of the other people who explicitly participate in the system who indicates they are infected, but not which people.
My understanding is that given someone else's daily key, it can tell you whether you were in contact with that specific key.
So anonymity relies on not knowing who had that key. But the (as yet unspecified) authority collecting "infected" keys will certainly know who submitted what, so you are relying on their secrecy.
If you assume a malicious app installed on both party’s phones, then you might be able to do it... but then again, if you have that you don’t really need this system to track contacts.
(I think on one side, you’d have to collect the daily keys and associate them when a person’s identity. Then, when you want to check a contact, you would then need to trigger an “infection” because otherwise the keys don’t leave the device. This requires user interaction, BTW, so there would be some kind of special social engineering effort to get someone to report themself as infected or else you the phone needs to be unlocked in the possession of a malicious party — or you have to hope to get “lucky” in that the person actually gets infected within 14 days of the timeframe of interest.
For the other party, you’d have to feed only the specific ids of the known people you want to check against to the matching API — it only tells you if there’s a match, not which match, so unless you’re checking only one, you’d have to use a process of elimination to work it down to a specific person. I wonder if that API might be throttled, though, or otherwise limited to make that less effective.
With the requirement to have malicious, cooperating apps on both sides you don’t need the Apple/Google system and you could get more useful info, like location, and with less user interaction.)
Also, the Apple implementation requires user to manually approve access to user private tokens each and every time for apps trying to access them.
Actually you can't trust them to manage the other things either. Google is notorious for abusing user data for advertising purposes and their dark patterns. Two recent investigations by the Norwegian data protection agency highlights this clearly.
Anything on iOS touching iCloud is assumed to be accessible to at least the government where the phone user resides. Their on-device privacy's much better, but the defaults are to use iCloud extensively.
Privacy isn’t on/off.
Just because it was possible indirectly before, it doesn’t mean direct tracing should be waved-through.
> ensuring that all users of a modern iPhone or Android smartphone will be tracked as soon as they accept the OS update. (Again, to be clear: this happens already even if you decide not to install a contact tracing app!) It is unclear yet how consent is handled, whether there will be OS settings allowing one to switch on or off contact tracing, what the default will be.
I don't think that's correct: you can always disable Bluetooth. Moreover broadcasting, if I understand the documentation correctly, Google and Apple will be providing just general framework: no ID broadcasting will happen until a tracking app is installed. But even if it did, if the tracking keys are not published, it doesn't affect privacy more that Bluetooth MAC address.
> In other words, a malicious app could act as if the user is infected (in a way that is unnoticeable to the user) and extract the daily tracing keys and upload them to the server surreptitiously.
That's true for decentralized tracking not using Google's framework as well.
> This means the technology is available all the time, for all kinds of applications.
In Android ecosystem Bluetooth is available for all kinds of applications too. There is a permissions subsystem that can be applied in both cases.
Everything that Google / Apple Contact Tracing allows is already possible in Android. What it provides is a common standard, implementation, and iOS background Bluetooth capabilities.
"To improve device experience, apps and services can still scan for nearby devices at any time, even when Bluetooth is off."
The article can basically be summarized in two points: slippery slope and distrusting the platform holder. The former is best countered by looking over what the platform holders do, the latter has little to do with contact tracing. Apple already broadcasts proximity IDs for "find my". They were in fact heralded for their privacy first approach of that protocol until a few months ago.
If you distrust your platform holder — which is fine — then be aware of what they are doing everywhere. This contact tracing protocol is by far the least worrisome thing these platforms do. In fact it largely just undoes a recent security improvement: MAC address rotation on Bluetooth.
I have a bit problem with blog posts like this: they get circulated widely because they propagate the idea of the big platform holders building a surveillance system. It particularly problematic because it also plays into the hands of PEPP-PT and other efforts which actually do want to build a centralized contact tracing system and they need the platform holders to give more control over the bluetooth stack for that goal.
Right now if apple and google were to go ahead with this implementation it would make it significantly harder to build a surveillance system than if certain other efforts would get their way.
"Apple and Google selflessly implement a new magic technology to save our lives. This involves a tiny little bit of contact analysis. Who would possibly resist!"
For these 99.9% the association "contact tracing good" has now been established. Companies will slowly go further and further in the future, because this event has established a precedence case.
Anchoring bad things to positive events and outcomes works. Advertising works, not for HN readers but for the general population.
That is not at all what consumers see where I am (Austria). The news of Apple/Google doing contract tracing or supporting it has been very badly received here. People would rather trust a centralized system run by PEPP-PT than a decentralized system aided by Google/Apple.
The risks raised by this article appear credible and worthy of consideration.
It'll be interesting to see whether Google and Apple do openly respond to any of the specific concerns raised by the privacy and security community - for exmaple, whether the functionality will be time-limited to the duration of COVID-19.
Google and Apple would gain huge potential leverage over nations worldwide if they retain the sole ability to offer and withdraw the functionality and to vet the applications that are allowed to use it.
You do understand that Apple/Google are not in charge of the world. They operate within each country based on the laws that each government puts in place. It would be trivial for any country to force this functionality to be on/off and dictate which apps it can be used with.
For somewhere like Australia? If it became truly necessary, that’s a small enough market to write off if necessary.
Since you sound familiar with the situation, can you provide a link/reference to evidence of a country trivially changing the behaviour of an operating-system level feature like GACT after it has been deployed?
https://www.theverge.com/2019/10/7/20903613/apple-hiding-tai...
(lodged in 2004, resolved in 2007 - and led to the release of a version of Windows without Windows Media Player installed-by-default)
[1] - https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX:62...
Example being Russia which told phone makers to either pre-install their apps or stop selling their products. Or EU pretty much telling the entire software industry how high to jump with GDPR.
In his analysis he keeps ignoring that the flow of data is user-controlled.
You need to opt-in to start this this, not just take an OS update.
You also need to install an app and opt-in to allow it to use the data.
Looking at the docs, the user also needs to approve at the point where an app receives the day and duration of contacts with an infected person. The only thing an app that you’ve already downloaded and opted-in to can do without further permission if report some contact with an infected person: not who or even which daily tracking ids, not when within the last 14 days. That won’t make a tool of mass surveillance.
In places he acknowledges some of this, but his analysis proceeds as if the user-controlled nature of this doesn’t exist.
This is deeply despicable.
To the extent this guy and people like him can sow distrust of this platform, the weaker privacy-preserving covid19 contact tracing will be.
That leads to more death and deeper economic ruin.
There are various other problems with the analysis here: For example (just a selection) (1) this platform doesn’t require any more trust from Google and Apple than before. They’ve always been capable of turning your phone into a tool of mass surveillance, one much more effective than what this platform allows. (2) This system cant’t be turned into a tool of mass surveillance with the flip of a virtual switch at Apple or Google HQ. The software to expose the data won’t exist and so would have to be developed, tested and released. This guy is using a Hollywood movie level understanding of of software systems here.
By the way, this guy is a professor with a specialty in privacy, so we know he knows better.
That means all of this is malicious. I don’t know what he has to gain from pushing this FUD, but I do know he doesn’t mind getting a bunch of people killed or putting them through economic hardship.
He should be using his expertise to do an honest and competent analysis of this system so that it could be improved.
Apple/Google could always push a software update that does all kinds of terrible things, but that has always been true and remains true with or without a contact tracing system. It’s a concerning possibility but has nothing at all to do with this system.
>You also need to install an app and opt-in to allow it to use the data.
In some countries (i.e. Australia) there was indications from the government the app could be mandatory. Subsequently walked back, but definitely a testing of the water...
If I'm forced by law to enable contract tracing, I hope it's created by Google and Apple and not a version created by some sketchy government contractor.
The "who's seen who" sounded like it was entirely done locally to your devices.
Unless something nefarious is done under the covers, no central server gains access to the information correlation information.
What am I missing here? It seems like this system preserves privacy.
I exclude nefarious action above because if we believe Google or Apple are acting nefarious (which I understand many do), then they already be doing so at so many levels in our hardware and software that this is just a drop in the bucket.
Just ditch the phone. Problem solved. Simple solutions are usually the best.
> GACT works much more reliably and extensively than any other system based on either GPS or mobile phone location data (based on cell towers) would be able to (under normal conditions). I want to stress this point because some people have responded to this threat saying that this is something companies like Google (using their GPS and WiFi names based location history tool) can already do for years. This is not the case. This type of contact tracing really brings it to another level.
I don't see an explanation of why this would be so.
Also, I see here as elsewhere a "what if one installs a malicious app that uses this?", but that argument applies even without the contact tracing framework.
Still, there are some valid points which I hope can be considered by the spec authors.
Cell phone tracking data does not rely on line of sight to towers, and for most people there is no offline for this to be relevant.
The movements of your mobile phone (and everything you look at on it and what you type and who you communicate with and what you say and literally everything else you can think of) is available at the touch of a button to the government.
It amazes me that people know this, but simultaneously don't know it?!
The horse has bolted. It is gone. This urge to close doors to empty stables is really baffling to me. Really confusing. Why are people like this?
The capability has existed for a pretty long time, mostly out of the public eye, with occasional bursts of outrage when something caused it to become public, quickly forgotten afterwards.
The capability is there, that genie is out of the bottle and nobody is going to put it back in. This isn't really about the technology, it's about the legal frameworks and social attitudes surrounding this capability that are worth talking about. Putting your hands up in defeat is not useful, and at this point probably neither is trying to prevent the technology from spreading. I am unsure what the solution is but the conversation needs to happen, and in all likelihood the end result of that conversation will be that corporations can't be trusted, just like they couldn't be trusted with food safety, for example, thus the FDA was created. What actions will be taken after that, I cannot predict.
Specifically, these programs are totally normalised. We've had them for decades. They're supported by both parties in the the whole English speaking world. They've grown and expanded since they were revealed. At this point, total surveillance is normal.
If anything, making an app for coronavirus is a good thing. It's easier to ignore this if it's done server side than if your carrier suddenly compels you to install some shitty slow battery draining app. I don't know if that qualifies as normalising it, but if it does and get people up in arms (or encourages even 1% of them to move to tor or signal or something) it's a good thing...
It doesn't seeem like this would add any new capabilities, it merely makes it easier/cheaper to have this kind of info.
The house is on fire. Thats a fact. That doesn't mean its okay to throw more fuel on it.
Privacy was dead but GDPR and CCPA are turning that around and gaining more traction in states and countries.
I’m not suggesting that it be developed by the community, but it seems like visibility into the source could give some assurance of what it is doing and potential weakpoints.
What scares me specifically about person proximity tracking is that in the current covid world it seems realistic that some governments will force people to enable it with seeming support from the public. Therefor eroding that uncomfortableness.
Authoritarian countries may give fake test results to people they don't like in order to find their whereabouts for the past two weeks, for example.
In the end, people should be in control and it should be obviously simple turn it off systemwide (not buried in Settings > Privacy > Location > System Services or whatever).
Say I work for a repressive regime. To do business in our economy (tag into subways, etc), you need to install an app with GACT enabled.
Now, whenever we arrest a political opponent, we get their GACT device key, and flag all of their associates as political dissidents, and arrest them too.
This seems like an invaluable tool for oppression.
Bluetooth based contact tracing could be a valuable tool in public health, but as many have opined it is also a significant sacrifice of privacy.
Is there any data on the effectiveness of this sort of technology yet?
That being said, we’ve also been doing interview based contact tracing for a long time. The current IT systems for doing contact tracing leave a lot to be desired (I did a trade study a couple months ago), but public health agencies have procedures for doing contact tracing without invading privacy nearly as much as the proposed platform.
Preemptively using smartphone interactions to capture information world definitely be cheaper than the current manual processes but I want to know how much it improves efficacy before nationwide/global deployment of such an invasive technology.
Until then, hire contact tracer’s. There are a lot of unemployed people.
If they were in any public areas you can pull purchase records for any one who also was in the area at the same time.
I've been operating under the assumption that proximity without PPE but within a few hours of existing in the same space is a significant vector. If true, it seems like it'll be very difficult to find people who shopped at the same store within the same day.
These are not the nine rings for mortal kings.
Do these people think that Larry and Sergei call a meeting of their most evil henchmen/project managers and say “gentlemen we have been given an outstanding chance to build something magnificently privacy violating! The coronavirus has driven people into our hands! We have waited so long for the chance to build such a system and because people think it’s for good, we’ll never be suspected! Go my minions, fly and build the dark software that will create us a secret and hidden trove of privacy data the likes of no other! Ha ha ha !”
The privacy nuts really think this way.
The larger point for me is: this is great and helpful but in doing this we undermine privacy in other less obvious ways.
These two quotes sum it all up for me:
"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."
"The road to hell is paved with good intentions."
One of the most misunderstood quotes on the internet
I'm curious about this, the author says they would like to "stress this point", but then provides no analysis or evidence to impress this... anyone have any buttressing points?
Anything that has the ability to be exploited will be exploited for purposes.
We have a generally healthy level of distrust for our governments as well as big business, and given the consistent evidence, I feel that's generally warranted. (Government is supposed to serve the people, not the other way around).
I would never opt-in for this nor would I trust it.
Don't go gentle into that good night.
Rationally, this would boil down to whether you trust your government or the tech companies more with this data, and opinions will vary.
My, admittedly high level, review of this proposal is that it seems to have a good privacy design. As I understand it, the contact information never leaves your device.
Brought your mom some bread today? Log it in the app.
Went to a grocery store after? Log it in the app.
Every Sunday or something maybe check in with some of the people you got within physical proximity of, and try to investigate a bit if there were any known cases at your grocery store or such.
If you were potentially in contact with Covid, maybe update the people you saw after it, or maybe just self isolate, or maybe both.
Definitely do get in contact if you have symptoms, and ideally you could even alert the grocery store and they could post a notice somewhere people could easily find (ideally online) with when you visited and perhaps the likelihood of you having had it at that point.
Sanitize your groceries too~ People pick things up and put them back, I imagine there are hundreds of cans and junk food wrappers sitting in stores across america right now with Covid on them.
I really believe this is all doable with the stock iOS Reminders app and some discipline. But a standalone app would be nice; not-plaintext-in-the-cloud is kind of important at scale. Non-iCloud reminder lists were possible at one point.
(Tangent but Reminders a misnomer imo, I vote renaming it to String Nest)
* I suspect Google and Apple probably did a lot of contact tracing/traffic analysis type stuff that they don't want public...
and
* Contact tracing in the US might have been useful on January 15th but right now it's probably pointless.
Do I think it is sensible to raise concerns? Yes Am I disappointed that there aren't specific suggestions to address issues? Yes
It is really easy to criticise and a lot more difficult to come up with solutions. As an expert in privacy, I'd have liked to see specific actionable items. e.g. 'Google/Apple must do X to ensure Y' or something saying 'Yes, this is really difficult and I don't know the answer'. This opens the floor for collaboration and for suggestions which feels a lot more constructive.
What's key is that this is done right. If it isn't done right, there's a risk that no one will install it and we don't get the protection.
It seems to feel having two centralised vendors for this is worse than just having arbitrary third parties, without explaining how this would be facilitated without any controls over this on an OS level, so it would then just be entirely dependent on all of your third party applications. That's a much bigger threat model than the OS vendor, requiring you to trust dozens of different vendors with different motivations to behave.
The fact is really simple, if you don't trust your OS vendor that the APIs are as described then you're screwed and everything else is irrelevant. It is very clear the general public do not give a stuff.
Once you need to be online you must disable airplane mode, true, but you also must take your phone out of the silent pocket, no? At that point you “lost”.
"You wouldn't stand in front of a microwave all day. Rest easy known mobile EMF radiation isn't doing the same harm."
Oouf. Not a good look.
> 2. FOR THOSE LONG, working from home conference calls, block EMF radiation with air tube headsets.
https://silent-pocket.com/blogs/news/how-to-stay-healthy-and...
At that point the telco can roughly triangulate your position using the base stations that you're connected to. And determine who is nearby to you.
And better not tell the author of this article but this data has been made available to authorities for decades.
Not saying that telcos have shown any moral high ground with location data, even Google has this level of location tracking enabled for a considerable amount of people. I'm most worried about an Elasticsearch instance cropping up where somebody's bluetooth ID can be used to see how they get to work, etc. Faraday cage bag for phone seems like a reasonable solution.
Sometimes people can surprise us; the author is least somewhat familiar with GSM networks, and perhaps you'd both enjoy a learning experience if you're able to share any additional information you have with them.
Totally oversold technology.
Self-appointed privacy experts aren’t going to do their cause any favors by reflexively finding/imagining fault with it. This article comes surprisingly close to literally “crying wolf”.
Even if it is rolled out today as opt-in, the option stays open for a government to centrally enforce mandatory activation of tracking via Apple/Google
Now it turns itself back on every day.
It will roll out as opt in, then as opt-in but enabled-by-default, then the turn off will only be temporary
rfid pocket seems to be the only solution.