Woman stalked by sandwich server via her Covid-19 contact tracing info | Hacker News Reader

Woman stalked by sandwich server via her Covid-19 contact tracing info

nakedsecurity.sophos.com

122 pointsel_duderino81 comments

> [The sandwich company named] Subway required her to put her contact details on a contact-tracing form so as to place her food order. She didn’t think anything about it: we all want to stop the spread of the pandemic, after all. The form asked for her name, home address, email address and phone number, all of which she put down.

I'm putting this here because some people may erroneously assume that this story is relevant to bluetooth/cellphone contact tracing.

> some people may erroneously assume that this story is relevant to bluetooth/cellphone contact tracing.

Is it any better if Google, Apple and the govt will be doing the stalking?

Hopefully it's a little harder for a random Sandwich Artist to pick up your address via one of these apps than via a paper form that you fill out in front of them.

That said, they have to be right in front of you to stalk you, they can't do it from California.

There are also many reports about Google or Facebook employees abusing private data. In Permanent Record, Snowden explains how the NSA employees watch nudes stolen from regular citizens on a regular basis.

> many reports about Google or Facebook employees abusing private data.

I'm sure you have a link or two handy?

Here’s one about Google: https://gawker.com/5637234/gcreep-google-engineer-stalked-te...

1 person, 10 years ago, promptly fired. Somehow I'm missing the "many" part of the original claim.

That is true but their have already been dozens of articles explaining how Apple/Google designed their contact tracing system to make it nearly impossible to be abused.

Yes, because they actually designed their system so that it can not be used for stalking. Go read up about it.

Well, they failed then, because it can definitely be used for stalking. Having covid and distributing your daily keys makes it much easier but not necessary.

If you have COVID you should not be distributing your daily keys, you should be staying the fuck inside.

COVID can be asymptotic for long periods. This is the whole point for such systems to exist in the first place.

Yes, and you reveal your keys for the past when you are diagnosed, and then you go inside, stay inside, and do not reveal any further keys.

This is not useful for stalking.

Sure it is, you just need imagination. Say that you are a stalker, you (or someone delegated by you) passed near your target and got h(daykey, time), your target happens to go to the hospital for covid a while after, so you have the daykey of your target for multiple days and all of their h(day, time). You detect that it was your target that went into the hospital because one of their h(daykey, time) matches with the one that you have stored, in addition you know if your target passed nearby you/one of your friends/one of the locations where you have put some cheap bluetooth phones and the exact day and time that this happened. Intentionally infecting the target will covid will help this whole thing but it is not necessary.

This is just in no way a realistic attack scenario. It gains you nearly nothing for a massive amount of work.

You said that it can't be used for stalking. I said that it can and that it is difficult rather than impossible.

Instead of wasting everyone's time arguing pointless semantics, have you considered actually engaging in constructive discussion?

You really should stop blaming others for your own failure to properly convey what you mean.

You should probably read up on how the Google and Apple system works.

https://en.wikipedia.org/wiki/Google_/_Apple_contact_tracing...

My brief understanding:

- No location data is used at all

- Devices get random rolling identifiers that are shared with other devices when in close range (ie contact is made)

- Devices keep a list of which identifiers they came in contact with in the past

- If someone tests positive, their recently used random identifiers are published, and any devices with those identifiers in their list notify the user that they may have been in contact with someone who has now tested positive.

If you can devise a non-magical way that a Google, Apple, or Subway employee could use that to personally stalk someone it would be quite an interesting whitepaper.

A widely distributed Bluetooth monitoring network noting tims and places ... might ... be able to correlate secrets with other data (facial recognition, MAC, UUID, etc.,) to correlate individual with probable SARS-COV-2 exposure status.

An in-location tracking system, such as numerous proposed retail monitoring systems, among othe.

Given time and location, a low number of hits would likely be sufficient.

This would be expensive, but likely within reason for a motivated entity. Possibly by utilising (with or without cooperation) existing infrastructure and systems.

If you have a widespread Bluetooth monitoring network with centralized data you've already built your stalking system that likely works better than trying to use the Google/Apple contact tracing system.

But you've added Covid status detection as a capability. To what net advantage is unclear.

Though yes, this shows the inherent risks of pervasive surveillance systems.

If you have those resources, there are far more effective ways to track people that do not require relying on the contact tracing system.

Fair point.

The objective is far less practicality or usefulness than of determining possible attacks on the anonymous contact tracing method. Also incidentally highlighting the power and threats of widely-distributed surveillance networks. Inference is powerful.

Adding here also that the stalking in this article was of the personal harassment nature, not 'stalking' to contact them about potential COVID exposure.

It would be a nuisance to have to sign in at restaurants, especially with a physical address.

That's what "stalking" means. I sure hope no one's expanding the term to mean "contact tracing".

> I sure hope no one's expanding the term to mean "contact tracing".

I think this guy just did downthread: https://news.ycombinator.com/item?id=23179458

This is not necessarily the case. I took it to mean that Google, Apple, and the govt all have employees, some of them rouge, just like subway.

It confused me at first when I saw the headline.

That’s what’s going to be required in the Netherlands from June 1st.

>It would be a nuisance to have to sign in at restaurants, especially with a physical address.

I have friends who carry a passport card because they've had unawanted contact from bouncers, bartenders etc.

This type of incident is super common.

https://en.wikipedia.org/wiki/United_States_Passport_Card#Ca...

This was also in New Zealand, where it appears to be required to be collected by the law (the article is unclear but references the public health commissioner explaining how it should be used).

Many places just require you pay by card (not cash), since that is enough to trace someone if needed. Or preorder online. Techniques vary.

I'm disappointed that the "sandwich server" is a person who serves sandwiches.

I was here for the server-as-we-know-server and got disappointed too.

I was searching for container stuff and came across this video on crypto mining in a container:

https://youtu.be/IZ_bQJM5liM

I was a quite a ways into the video before I slapped my forehead.

Think about this for a moment. There are people out there who are willing to give out their full name, home address and their phone number just so they can buy a brand name sandwich. If we are willing to trade our freedoms for convenience, perhaps an Orwellian future cannot be avoided after all.

> We don’t know much about the form, but it sounds like it was paper, as opposed to digital, given that Subway told Newshub that starting on Wednesday, it will have installed a new digital contact tracing system at all restaurants.

That sounds great. Now instead of having to worry only about the employees at the particular restaurant, you have to worry about whether Subway has properly secured their system from everybody with internet access (including all of their employees).

If the price of a Subway sandwich includes giving PII to Subway, I'll pass.

I'm sure the validation process is just "form written on". You could probably write down 867-5309 and walk out w/ your sandwich.

It's not like Subway wants to do this sort of extra work... it's government mandated, at least in some areas like Washington.

Washington state is requiring restaurants to record the info of customers. Lots of potential for abuse like this.

That's insane! Why would they do that? And why would people hand that info over?

You're not you when you're hungry.

Because it's the law and majority of people obey the law. You'll get an odd person who refuses, but that's fine, they can leave if they don't want to comply. Unless majority refuses to comply, nothing will change.

There's a pandemic happening right now, so I think they're doing it to track where people go and how things might be spreading. It's really helpful for analysis. I think people are handing info over because it's required to get one's order.

Because getting told when you were eating at the same restaurant as someone with a contagious disease could be life-or-death information?

(Mind you, I've no intention of going to restaurants until the infection rate is much lower!)

Why not just use the double blind google / apple tech for this? The govt requiring this level of data seems unnecessary.

To my knowledge there's no implementation of that tech. I think it's definitely not an ideal system to have it be all pen and paper, but there isn't a clear "just turn it on" solution they're ignoring here either.

I’ll just put down fake info.

What information are they requiring? Not home address. Name and phone number I suppose?

Are they checking drivers licenses? I'd give fake info. Rusty Shackleford is here to get some breakfast.

So you don’t want to know if you are exposed to the virus?

If the price is giving my personal data to restaurants, personally no.

As others have pointed out, this is so businesses can inform you if you've been exposed.

And personally I don't feel the benefit of giving out that much information (in such an uncontrolled manner) is worth it, so I would probably opt out. Then again, you're not going to see my face in any restaurant at all for the foreseeable future so I don't have to provide fake info to opt out.

> Are they checking drivers licenses?

They are not.

I'd trust this system if it were double-blind. The government issues an identifier to me (separate from SSN). I feel OK giving that number to restaurants. If there is a reason to initiate contract tracing, the restaurant hands its list of identifiers over to the appropriate government agency, which cracks open its vault of identifier --> contact information

Seems no less open to misinformation than the current system but gives vastly more protections to personal information. Doesn't even seem that hard to set up in the grand scheme of things.

> The government issues an identifier to me (separate from SSN). I feel OK giving that number to restaurants.

Wow, can anyone imagine reading this in the beginning of 2019? The totalitarians come out in huge numbers recently.

It was once considered totalitarian to be asked at the East German border if one had any "contraband" (books or magazines that were frowned upon).

Now at the U.S. border one can be asked if one has any "contraband".

Next we all get a government id to pass on to private businesses. How about a "social credit" score, China style?

> Next we all get a government id to pass on to private businesses.

Most of the rest of the world actually has government-issued identifiers and ID cards and they don't devolve into totalitarian dumpster holes. To make it even more absurd, the lack of a proper government-issued ID scheme in the US actually leads to problems only the US has, like people opening up credit lines and siphoning large sums of money with stolen SSN+name+DOB combos.

I'm in the UK and we don't pass on said government ID to a plethora of private businesses so that they can turn around and hand it back to the government for tracking.

Correct me if I'm wrong, but the UK is still part of the EU and thus subject to the EU KYC/AML laws requiring people who want to open a bank account/credit card to undergo identification with a government-issued ID?

I'd imagine you're right, I don't know enough about that to say otherwise.

However, my point was a "plethora of privates businesses", not "all private businesses"

I can't tell if you are trolling. I'll assume good faith.

We show ID to enter bars. We show ID to buy certain products. I provide identifying information when I pick up tickets at will call. Some items (like houses, cars, guns) you have to register the purchase with a government authority

Asking about contraband was totalitarian because they were trying to control what information people had and made certain thoughts/books verboten. Customs/border patrol has asked for ... ever? what you are bringing into the country.

I'm not saying the government would get an automatic transcript of every purchase I've made. I'm saying individual restaurants could collect a list of unique but meaningless numbers on a piece of paper or wherever they want. If the restaurant gets tagged as a place where COVID is believed to be spread, then the government now has a way to contact everyone who had visited the store.

>I'm not saying the government would get an automatic transcript of every purchase I've made

You make the assumption here that governments don't trend towards looking for ways for that information to be automatically supplied in future in the name of "efficiency".

Honestly, the history of the 20th century should be the closed book final assessment on why it's permanently a bad idea for governments to collect files on people.

Given how long governments have kept records (domesday book, bablylon) and how few governments have slipped into totalitarian hellscapes, I'm not as worried about this as you are.

I'm more concerned about the patriot act & etc because a lot of those survelliance programs are actively centralized.

The system I outlined would work XX% as well if it were entirely optional and if it were managed by independent agents. You could sign up with "ID Corp", or a credit union, or whatever. And they could keep your records.

>and how few governments have slipped into totalitarian hellscapes

Just because it's improbable doesn't mean we shouldn't protect against tail risks. Not taking meaningful tail risk protection is why we're in the covid-19 problem we are now.

>I'm not as worried about this as you are.

I wouldn't want to be presumptions of your background, but have you talked with many people from countries where they or their parents were victims of state bullying via secret police that kept files on them?

>I'm more concerned about the patriot act & etc because a lot of those survelliance programs are actively centralized.

I don't think what we're talking about is any different in the long run.

>The system I outlined would work XX% as well if it were entirely optional and if it were managed by independent agents.

I'm actually not opposed to a temporary system of tracking like this in order to stamp out coronavirus. However, it needs to have iron-clad provisions in law to make it time limited, along with laws that mandate that independent international observers witness data audits and subsequent destruction of said data. Unfortunately, when governments legislate provisions, they're usually in the form of "we promise to be very good" platitudes.

There is a difference between purchasing a house and buying a sandwich. Do you bring a notary to buy a sandwich?

The U.S. border agents can ask to hand over passwords to social media. They can search your computer in order to see if any intellectual contraband (their words) is imported.

Very similar to the East German restriction on printed contraband.

>Wow, can anyone imagine reading this in the beginning of 2019? The totalitarians come out in huge numbers recently.

sorry, are you saying a national id is totalitarian? Virtually every democratic country requires one. Using it to say, verify online age-sensitive purchases like booze or in South Korea for things that require identification is common, and of course for everyday interaction with public agencies and whatnot.

A national id was first and foremost for visual and ephemeral verification in exceptional circumstances.

If no record is stored (e.g. a supermarket worker briefly verifying an alcohol purchase), it is not totalitarian.

Making a copy of the id, like PayPal wants, is more sketchy, but at least this is banking.

Requiring an id that is stored in a database for minor transactions like buying a sandwich is definitely totalitarian.

The government could at a later date decide that all restaurants have to hand in all these identifier lists, regardless of whether a potential covid-19 case has been identified or not.

Of course, this could also happen with clear text lists. So I would be better for cases like in the article. I just want to point out that it's not a perfect solution.

But here's the thing: this kind of personal data is used daily by many companies. There's a table in a bank/telco/etc where they have your full name, your ID number, your address, your age. Any worker who has access to this (thousands of people who need that kind of access to do their jobs and to provide you with services) could've done something similar.

Recruiters are particularly stalkey sometimes with the way they keep calling your personal number without warning. While I don't understand if Subway really needs to share that much data with the person who makes your sub, the reality is that there's nothing privacy laws can do to stop some creep who works somewhere that deals with data from stalking one of their customers.

Edit: the case might be here that Subway doesn't really need to handle that kind of PII, but that should be on principle I think. The creep using that kind of data is a bit incidental.

Temp agencies are actually the WORST. If you do hiring and they get your cell phone number you are hosed.

This kind of abuse has happened even before COVID-19 and contact tracing. The issue here is not just the guise of contact tracing used to collect information. Many businesses collect customer information insidiously (sometimes with offers to win a prize or for a discount). Once they collect it (usually phone and email), all bets are off on employees misusing the information.

In this case, it’s beyond anyone’s imagination as to why the home address would be collected. There was absolutely no need for that except someone who imagined it to be a well thought out solution (solution for what I don’t know).

>Newshub spoke with Privacy Commissioner John Edwards, who said that businesses should only be custodians of the information they’re given for public health purposes. Doing otherwise could leave the public with a strong distaste for handing over their details

Is this some sort of official government program? The response by the privacy commissioner ("should") suggests that there won't be any legal consequences for businesses that misuse the data.

It’s a burden the government is imposing on businesses, ideally you want a high legal bar before suing for misuse or you will create noncompliance. A rogue employee should not be one.

For example, let’s assume you add a bunch of requirements to implementation, say specific encrypted terminals. Now restaurants can’t get those for months. What will they do, close? Ignore it all together?

We are in a pandemic, the main focus should be collecting the contact tracing information while still feeding people. If this were to last years we can also solve all privacy concerns, but it’s really hard to do in two months.

They already made businesses close with no recourse. Why is it crazy to require businesses to follow specific procedures if they want to re-open? Why shouldn't those procedures be designed to protect the public?

It’s not crazy to have specific procedures, but think about unintended consequences. The procedures need to be achievable in the real world, not so burdensome they can’t or won’t be followed.

Maybe a better example, let’s say NZ institutes a $50,000 fine per each occurrence of misuse of personal information collected per their requirements. Now a small business owner could find out they are facing a $250,000 fine and bankruptcy because of one horny employee violating their specific trading instructions. What restaurant would ever take that risk?

If the government wants to force businesses to collect personal information, it better be prepared to provide secure means of collecting and communicating that information to them. And it should indemnify the businesses for any liability from release of that information that’s not willful or intentional.

If the business faithfully follows the rules, punish the perpetrator, not the business owner.

Sorry but having to share my contact info at a business is a step too far for me, and is a breach of individual liberty that I am not willing to participant in. Apart from privacy concerns like in the linked article, I think it is also the kind of normalization of authoritarian mechanisms that we just do not need. Some may call this a slippery slope fallacy, but to them I say that slippery slopes / boiling the frog are an effective way to go from a minor breach of liberty to something more dangerous, all with the public's support along the way.

It sounds like the NZ government is requiring businesses to do this, without much guidance as to how businesses do it, so that seems like error #1. Or am I misunderstanding? The article mentions Subway is moving to a secure computer system to retain the information... that does not seem much better.

Reply on news.ycombinator.com