Hacker News Reader

Comment by gonehome | Hacker News Reader

The Bluetooth contact tracing would have been amazing, the design was smart, privacy preserving, and worked.

The issue was a few things:

- Opt-in instead of opt-out

- People (even those on HN) not understanding how it worked and loudly and wrongly stating that it was a privacy nightmare. See this thread: https://news.ycombinator.com/item?id=25629304

Unfortunately this lead governments and others to just buy data from brokers/3rd party app collectors and such that are not privacy preserving. A pretty frustrating situation.

View on HN

Completely agree with this. And the opt-in problem was twofold, you needed to opt in to receive notifications (and in California this option wasn't even available until like 6 months after the frameworks were available) and also needed to remember to manually upload your result to the system after testing positive. The testing centers should have been asking for people's contact tracing id info and they should have been the ones reporting results into the system. (They already have your full name/contact info when you book an appointment, and the contact tracing id is anonymous, so again this is not sacrificing your privacy any further).

It seems like a major factor in why this idea was never taken seriously by governments was that professional contact tracers are still using the playbook from 70 years ago from the polio era where the only thing you try is cold calling people's home phones. The public health field seemed entirely uninterested in technological solutions, even though it seems incredibly obvious that these could have had massive benefits over the old fashioned way of doing things.

As with several other things that happened over the course of this pandemic, I really just can't wrap my head around why the "experts" were so willing to just let half a million deaths rack up in the US rather than trying any new ideas. I would be interested to read more about contact tracing now though, and if any of them have changed their mind by this point.

Agreed - the cold calling was a joke and only really started after community transmission was super widespread anyway.

One problem seems to be that no proponent of the technology actually acknowledges that there _are_ ways in which it can be used to track people.

Personally, I use an iPhone, and (for the sake of argument) trust Apple's software. However, I absolutely don't trust Google's software, including their implementation of this technology. My understanding is that all the Android phones around me will store all the nonces which my phone sends out. I then publish a list of all my nonces if I find out I get sick. If Google wants to invade my privacy, Android phones can upload all the nonces alongside the location where the nonce was seen.

If Google wants to track people, Google can use their wide network of Android devices to get an accurate location history of every non-Android user who gets sick.

Or at least that's my understanding of the technology. It might be incorrect. Maybe there's some way to somehow ensure that the nonces I publish aren't associated with me. But again, I haven't seen anyone who encourages the use of the technology take this seriously, and none of the "explanations" of how the tech works go in-depth enough.

I do use the exposure notifications feature on my phone, but it does worry me.

Bluetooth contact tracing had absolutely no chance of ever working.

15% of adults don’t own a smartphone.

47% of children don’t own a smartphone.

Of the 85% of adults who own a smartphone, 20% don’t carry it with them.

At absolute best 50-60% of Americans would be walking around with a contact tracing app. And that is if it was forcibly installed, and forcibly enabled.

The tracing is pointless even before we get into the technical flaws.

When you’re indoors, 6 feet is irrelevant. The air is circulating.

Bluetooth signals penetrate walls and glass.

The end of all this is a system that absolutely no one would trust on the positive or negative. Seriously think about whether you would consider an “all green” to unequivocally mean you were safe. Or that a “red alert” was actually cause for concern.

This has absolutely no chance at working. And despite what you’re saying about privacy, it is the mere existence of a tool like this that is alarming. It’s baked into the operating system, with no visibility into how it might be used in the future.

I just don't want to be tracked, ever, for any reason, by anyone. It doesn't matter how the system works or how private it is. It still normalizes surveillance to those who participate, and I won't :)

You'll be tracked, it'll just be worse and not in a way that protects your privacy.

You'll also be generally ignored by people that care about solving these problems.

You'll also make it harder for people that care about the distinction between pragmatic solutions that protect privacy and simple solutions that don't.

When your response to both is the same the response from governments is: "the privacy people are going to complain no matter what, so just ignore them".

Your comment is basically an example of the kind of misleading knee-jerk response I was talking about. The bluetooth alerting design is not tracking, but your response to it is more likely to lead to solutions that are.

Clever technological solutions can allow us to preserve privacy and still do important hard things. The bluetooth exposure notification design is an example of that, people that care about privacy should be excited about it.

You’re totally ignoring my point. I’m not talking about the tech. It affects the way people in general will think about having tech track them.

I understand it, I just don't find it compelling.

Second order effect arguments are often weak, in this case - not using a cleverly designed system that doesn't track them because it could make some theoretical person more comfortable with the idea of tracking in general doesn't hold up to me.

The point of this is that it doesn't track them, but still achieves the goal of exposure notifications.

It's like the seat-belts are worse argument - if people wear seatbelts they'll drive more dangerously therefore seatbelts are bad. These type of second order arguments can sound contrarian or smart, but they rarely hold up to scrutiny. (Similarly masks are bad because they make people touch their face or w/e nonsense was pushed early on in the pandemic).

The average person is tracked completely by modern web companies, telcos, and random apps and they give up that willingly already - how does privacy preserving contact tracing make that worse? I don't buy it.

It's more likely using services that preserve privacy by design get people to understand why they're different than everything else, and why that's valuable. When you dismiss them along with the bad ones you make it harder for people to make that distinction.

Your point of view will drive the deployment of fully passive tracking, where you have absolutely no say in how/when/which data is collected. Things like pervasive cameras, cell tower dumps, etc., will become the norm whether you want it or not, but with the added downside that you have not say in it.

We are back to the cookies argument. Keep them because at least users are in control, lest fingerprinting becomes the norm.

> I just don't want to be tracked, ever, for any reason, by anyone.

Curious what this means to you in practice? I'm trying to imagine what zero tracking looks like... and wondering if I misunderstand what you mean by "ever, for any reason, by anyone." or if you're really serious about your wish and mean it as literally as it sounds.

You don't want your doctor to have records of your previous visits? (Prefer to be offered the Covid Vaccine every time from now on?) You don't want the ability to have any personal bank / investment accounts? Our HN account & posts are being "tracked", what's an alternative to this discussion? How should governments manage the basics of things like social security or driver's licenses? How would anyone even contact you or employ you without some kind of telephone number or internet address that can be tracked? How would you find gainful employment, and do you want to re-negotiate your compensation daily?

Framing all information storage as "tracking" and all information retrieval as "surveillance" seems to turn a blind eye to the many benefits we enjoy, while stoking a general and vague fear. I think I'm more privacy conscious than most, and I think we have some massive privacy issues at the moment, but I have to recognize the benefits I enjoy at the same time and seek to find a reasonable and practical balance. So, I accept some tracking, and what I want is always opt-in by default and control over who tracks what.

Reply on news.ycombinator.com