As created, it’s opt-in only and does not report matches to a central authority.

This guy says, yeah, but the gubment could abuse the tracing mechanism for things besides an epidemic, force your phone to report matches centrally, and force the removal of the opt-in part of it.

...except, if a government can pull those off, they don’t need this new contact tracing platform. These assume the government already has deep, control of the details of the operating system.

In other words, this contact tracing platform has nothing to do with his privacy concerns.

There are always people who see a tragic pandemic and just see a chance to use the concern and attention to highlight their own cause. And then there are the ones who fight against the efforts to mitigate the suffering to promote their cause, like this guy. Whew.

Second, the author is not wrong - when you build in tracking at such a deep-level it is open to abuse. Read the authors bio, he is not a naive techie. This is an area he has strong background in and deep technical knowledge.

Maybe this is the path forward, but Apple and Google appear to be rushing into this without considering the larger picture.

He knows what he’s saying is wrong, and he knows that if the FUD he’s spreading catches on, a lot of suffering will happen that otherwise would not have.

> when you build in tracking at such a deep-level it is open to abuse.

True, which is why he should do an analysis of this system rather than this. He could be using his platform as an authority and presumed skills as a teacher to explain the system rather than spread misinformation.

Other commenters here go into better detail than I.

> This guy says, yeah, but the gubment could abuse the tracing mechanism for things besides an epidemic, force your phone to report matches centrally, and force the removal of the opt-in part of it.

> ...except, if a government can pull those off, they don’t need this new contact tracing platform. These assume the government already has deep, control of the details of the operating system.

If your system has one RCE, you don't care about another one because it already has one? Perhaps you can work around the one, mitigating it? Also, "the government" (any in the world) can ask Google or Apple to share the data of a suspect. As they're not a one way hash, that is possible. Furthermore, an attacker can certainly gather the Bluetooth addresses and correlate these to one way hashes. If the API is public, they can correlate these hashes and detect which Bluetooth addresses got the disease. Together with the location, even an outsider can learn more about this issue.

Also, lets not forget there's recently an RCE in Bluetooth on Android (which many people still run with unpatched), and the problem of iOS not working with Bluetooth when the application isn't open on the foreground with screen open.

> ...except, if a government can pull those off, they don’t need this new contact tracing platform. These assume the government already has deep, control of the details of the operating system.

It doesn't have to be about the security services having root on your phone - they can use legislation, forcing Apple/Google to hand over location data so they can hoover it up. Alternatively, they can use legal loopholes - as we've seen before after Snowden.

Honestly, it's naive to think they wouldn't try to get this data.

Also, there is no location data in this platform, and Google and Apple don’t have the data that does exist.

> naive

I think you need to understand what’s going on here before you start throwing around words like that.

How? I'm not talking about getting a warrant to infiltrate a single suspect's device, I'm talking about mass surveillance. They need a means, and depending on how they approach it, they need to soften up the public so they are willing.

Apps like this provide a means - maybe they don't collect everything the security services want from the beginning, but we could see a creeping escalation, especially under coercion by the security services.

As for softening up, western governments are already very good at keeping the general populace fearful, whether it be the commies, Russians, Chinese, Islam, terrorists, etc, there is always some boogeyman de jour.

Apps like this could be the opportunity they need - the straw that broke the camel's back, convincing people it's all to save lives. "good citizens will use these apps to save lives - what have you got to hide?".

What may or may not be partially missing (don’t forget, cell towers are already tracking everyone’s general location and governments can get that data in various ways) is the software and backend systems to collect that data and make it available to governments... and this contact tracing system isn’t that software and doesn’t have back end components.

So again: while these privacy concerns are valid, they have nothing to do with this contact tracing system

Same for turning such a feature on surreptitiously vs. installing such a feature surreptitiously.

This system doesn’t do what the author is talking about. It’s decentralized, opt-in, and transparent. The government would have to force Apple and Google to make it centralized, automatic, and secret. In others, force them to make a completely different platform.

Then they just get a contractor to build an app that just broadcasts "I am Bob and I am at <location>" to nearby people and a central server. suddenly you have something way more open to abuse

You say that like it's not a PR exercise for large corporations.

> the ones who fight against the efforts to mitigate the suffering

There's more than a few billions floating around off-shore that could have helped establish universal healthcare and social safety programs, but just being a good corporate citizen doesn't get headlines, so let's focus on panic situations and instead sell our new slogan:

"Nefarious, for good!"

("good" defined as "not as evil as a global health crisis"; disclaimers may apply)

> In upcoming versions of iOS and macOS, the new Find My feature will broadcast Bluetooth signals from Apple devices even when they're offline, allowing nearby Apple devices to relay their location to the cloud. That should help you locate your stolen laptop even when it's sleeping in a thief's bag. And it turns out that Apple's elaborate encryption scheme is also designed not only to prevent interlopers from identifying or tracking an iDevice from its Bluetooth signal, but also to keep Apple itself from learning device locations, even as it allows you to pinpoint yours.

* https://arstechnica.com/information-technology/2019/06/the-c...

* https://blog.cryptographyengineering.com/2019/06/05/how-does...

If the system was different, it would be bad?

This is a slippery-slope argument that I do not find compelling. The amount of surveillance that this is supposedly guarding against--govt tracking of an individual's location--is already possible with no changes to any system.

It is no more slippery a slope for raw unscrambled BTLE identifiers to be reported to a centralized system. I don't think that the encrypted system makes it any easier in the least.

These devices that we carry everywhere are huge privacy concerns, but I don't think this author is even warning about the right things. Does the author even know the amount of location tracking going on in stores, currently? The amount of data that is sold back and forth with no user knowledge or understanding?

The concerns raised here ignore the much worse reality that already exists!!

I do share some caution, however -- tracing 'personal contacts' by BTLE is likely much more personally specific, and hence significantly more intrusive, than just location.

If such mechanisms became more generally available they would likely become used as part of the machinery of repression in states such as China. Or everywhere (depending on our future).

Location is fairly imprecise as to social contact, but I guess the concern would be that this will be accurate enough to track dissenters, find their contacts, and accuse/ imprison you.

> The current specifications allow phones to learn when and where they were in contact with another device.

That's over simplifying it massively. First the spec clearly states that no location data is recorded, since the location is not necessary for the application of contact tracing.

> By pushing a button on one phone, by reporting it as infected, all other phones that were recently in close proximity reveal themselves to the central server

This is not true, they clearly state that matches with a Diagnosis key is not uploaded to the diagnosis server.

> The current specifications allow phones to learn when and where they were in contact with another device. It is unclear whether the actual identity of that device is also revealed.

This is just not true, they make it abundantly clear in their specifications, that the identity of the device is never revealed.

> A company could install Bluetooth beacons equipped with this software at locations of interest (e.g. shopping malls). By reporting a particular beacon as ‘infected’ all phones (that have been lured into installing a loyalty app or that somehow have the SDK of the company embedded in some of the apps they use) will report that they were in the area.

This is not how this works, this is not how any of this works! It is highly speculative and extremely unlikely that any random APP will have access to the tracing key to make that even remotely plausible.

This criticism is obviously written by somebody who has not read the specification[1] or did not understood key aspects of it.

[1] https://www.apple.com/covid19/contacttracing/

"Apple says an elaborate rotating key scheme will soon let you track down your stolen laptop, but not let anyone track you. Not even Apple."

If you can show the claim to be wrong, you will receive tremendous accolades, and perhaps fame within certain communities. If you just have suspicions, that's uninteresting and not useful.

So this has nothing whatever to do with trust of Google or Apple tracking us, it’s about trusting what data they share and expose via this API for virus contact tracing. That’s it. That’s why the concerns of the linked article, and yours, while possibly valid in a themselves are completely irrelevant to this specific issue of virus contact tracing.

https://qz.com/1825997/taiwan-phone-tracking-system-monitors...

Exactly: Pervasive tracking is already available to the telcos and is being used in at least one country.

I think it's also true that deploying yet another potentially privacy-invading technology makes it more difficult for privacy advocates and lawmakers to deal with and reduce existing overreaches.

The argument seems to be: the spec is fine and presents little danger, but if an app went rogue, or a government mandated an app with further capabilities, then it would be problematic. Yeah, sure. But that also describes the status quo, and everyone still carries their smartphone around.

Let’s not stop this initiative that protects health and safety of societies that can trust their health authorities— and there are many.

We should be vigilant and try to stop autocratical implementations or misuses of the system. But it seems that even that will be difficult considering how the system is designed. And if governments can compel you to install some app on your phone, no amount of stopping Apple / Google will help.

The problem is exactly the reverse: infected people would gladly tell everybody exposed, but they can't reach them since the virus spreads so easily and the exposed could be delivery drivers, people in the grocery store, etc

this is not true for surveillance systems

There has never been a situation like this in the modern age. Last time it happened 50 million people died.

I'm not even sure I'm against the current application, but the question is not a simple one.

Remember https://en.wikipedia.org/wiki/WARRIOR_PRIDE, Pepperide Farms does.

There is no point trying to remain private whilst there is a phone where you have little control over private data. If you want privacy then you should look more towards using a collection of VPNs and fuzz your browser each time you use it. Change the installed fonts, randomize the browser window and destroy the user account that started it.

You can't do this reliably with a phone. All surveillance relies upon the user favouring convenience.

Are you implying we are not already in the worst economic collapse? Is there something to prevent at this point in time?

Once governments have these tools, they will want to keep them around.

That's an important difference. If you want to argue against Covid contact tracking, at least do it reasonably.

The government doesn't have to do anything.

You can stay safe by putting your phone in a Faraday cage if you must.

That’s been in place for some time.

But it's likely wifi pings and bluetooth details would be added to the mix these days.

0: https://estimote.com/

Triangulated location data is far from precise however. It would let you determine roughly where someone is, but nothing like accurately enough to do contact tracing or infection monitoring. You'd also need to start storing historical location data on a huge scale, but it would be accurate to a few hundred metres typically. Not ideal for contact tracing.

1. Doing it globally would require download of too much data, thus (contra promise of the spec) location data will have to enter. However, from what I can tell, that could be very coarse data, on the level of country and/or time zone (thus, not even necessitating access to GPS location data). I don’t see it as a major problem.

2. The “prank” danger: someone just pressing “I’m infected” for fun. One could introduce a tiered system where “I’m infected” requires some sort of authentication from a hospital/lab (a QR code on positive test results for example). There would also need to be a tier for “I have symptoms”, and yes, that could be abused/“pranked”.

Would be interesting to see a deeper analysis on both points. I don’t think they’re deal breakers.

This approach, just like the manual approach of tracking potential contacts via paper and phone, is only of use in a scenario with a very limited number of transmissions and an R (reproduction rate) of around or below 1. Its purpose is not to reach such a situation, but to aid in keeping that situation in effect without severe measures. But severe lockdowns must first suppress the infection counts to such levels before any contact tracing may work at all.

How about you can only check the "I'm infected" box if your phone is near the phone of a health worker?

Another idea is that you get a code in the mail from the hospital which you have to enter in the app.

That seems untenable.

It's a lot, but untenable? If 300 million report as infected, that's 4.8 GB, coincidently the size of a DVD. So 2 hours of Netflix, 1 hour at 4k. Very easy to cache this data close to the edge, too.

> That seems untenable.*

> It's a lot, but untenable? If 300 million report as infected, that's 4.8 GB, coincidently the size of a DVD. So 2 hours of Netflix, 1 hour at 4k. Very easy to cache this data close to the edge, too.

Just doing the math here, assuming a perfectly efficient wire protocol was used, each infected person would amount to (16 x 14 = 224 bytes) of data to be transmitted.

Assuming we see 150k new cases per day, worldwide (worldometers is reporting 100k new cases per day as the peak, and let's factor in 50% margin), this would be 33.6 MB of data per day.

Since you only need to transmit that day's data rather than the full database, a very basic sync protocol could be used here - the phone simply stores the sequence number of the last identifier handled, and it can be given subsequent data. This could even be done with a static (and thus cacheable) server if cases are chunked sequentially into 1MB chunks, and addressed by filename based on the last case ID.

For clarity here, case ID would be simply be the sequential number that a given tracing ID has in the server-side record, so you only need to fetch data you haven't already checked against.

I am not trying to imply that they do not have this capability. It just seems odd.

I also have a question: can this feature disabled simply via disabling Bluetooth?

> A company could install Bluetooth beacons equipped with this software at locations of interest (e.g. shopping malls). By reporting a particular beacon as ‘infected’ all phones (that have been lured into installing a loyalty app or that somehow have the SDK of the company embedded in some of the apps they use) will report that they were in the area.

I see these as possible exploits indeed. But the points are a bit confusing. I would love for the police to be able to stop a serial killer from killing more people. But they will do by exploiting a COVID-19 contact tracing app? And we will be mad at them?

> Some might say this is not a bug but a feature, but the same mechanism could be used to find whistleblowers, or the sources of a journalist.

It's been some time since I read Snowdens' Permanent Record, but I don't remember him getting in close contact with journalists to hand over information.

> If you have Google Home at home, Google could use this mechanism to identify all people that have visited your place.

That's the reality already.

> Jealous partners could secretly install an app on the phone of their significant other, to allow them to monitor who they have been in contact with. Overzealous parents could use this spy on their children.

Maybe drill down a bit into your relationship and figure out the core issue.

So this assumes that any random app installed by a user will have open access to the contact database? That seems unlikely to me, but I have not read the full spec.

Cell-tower-resolution analysis is already very powerful - it can trivially reveal someone's associations and overall behavior. When correlated with short-range proximity data, I suspect the same analysis might reveal behavioral details within a organization ("which meetings you attend" instead of merely "what address you work at").

https://www.washingtonpost.com/world/national-security/nsa-t...

https://www.eff.org/deeplinks/2013/12/meet-co-traveler-nsas-...

Even crooks and anarchists lead very predictable lives.

That isn't the case though, due to Bluetooth MAC address randomisation, which the paper does address - the 10-minutely identifiers advertised are updated in sync with the local device updating its own MAC address, to prevent correlation between the last MAC address and next one.

The virus can remain in surfaces up to 3 days(https://www.immedicohospitalario.es/noticia/18729/new-corona...).

With bluetooth you can not track the surfaces, so the ratio of false positives and false negatives will be high.

The best way to stop possible infections remains in individual measures anyone can take. For this reason, I think that the objective of this platform is to track people, not stop the virus.

There are multiple scientific studies that support the use of an app as one of many measures for ending the lockdown which already takes away many basic rights at the moment. Even though viral RNA can be found on surfaces after hours this does not mean that surfaces are an important vector for transmission and all studies so far point in the opposite direction. What is very concerning however is that close to 50% of all tranmissions happen during the first few days of infection when the host is not experiencing any symptoms. In the absence of symptoms and given the many limitations of personal follow-up through the authorities (which gives them much more data on your person than this app ever could btw) an automatic notification system is the only way short of a complete shutdown to quarantine infected but currently asymptomatic patients and halt the spread of the virus.

Privacy-wise you would be worse of in any other situation as well. Do you want the shutdown to continue and police to be able to control you at any time when you leave your appartement? Do you want government workers asking the infected who they have been in contact with during the last weeks and them to give your name, address and contact details to the government? Do you want the economical crisis to continue and people to have to share all possible details with the government in order to get unemployment benefits? Also, Apple and Google already control your operating system and have much more data on you than this app could provide them with through their OSs and all their apps. What they could gain would at most be the knowledge of wether you could have been in contact with an infected person. Leaving aside that their system as outlined atm would not even allow them to do that, what would they gain? For most people there won't be any lasting effects so there ara no charateristics inherent to the group that can be targeted. It will also affect a huge chunk of the world's population, chances are that most people will have to quarantine at some point and then that data will be almost worthless.

Do you have any source of this information?

> close to 50% of all tranmissions happen during the first few days

What's the source of this information?

Ferretti et al. (2020). Quantifying dynamics of SARS-CoV-2 transmission suggests that epidemic control and avoidance is feasible through instantaneous digital contact tracing. Science. https://science.sciencemag.org/content/early/2020/04/09/scie...

Ganyani, Tapiwa, et al. "Estimating the generation interval for COVID-19 based on symptom onset data." medRxiv (2020). https://www.medrxiv.org/content/10.1101/2020.03.05.20031815v...

The first study also touches on the point of transmission through surfaces which they argue should be at the very most 10% of all cases but probably less and a German virologist who's one of the leading experts in coronaviruses, Prof. Dr. Drosten, said that he and many others believe that surface transmission is almost negligible: https://www.ndr.de/nachrichten/info/coronaskript162.pdf (in German).

Isn't this the standard prescription for the extreme privacy conscious individuals anyways? For the rest of us, we can always turn off bluetooth. Maybe this will bring back headphone jacks or replace the standards all together. In the mean time, some of us want security over privacy. Many of us never valued the latter much in the first place.

This is a particular problem in the US where in the name of "freedom" people feel entitled to do whatever they want. I've come around to thinking that this is little more than a mass rationalization for selfishness and cruelty.

I think back to things like the Trump administration separating children from parents in detention facilities, a measure so cruel that it was one of the few times such a policy of this government has been reversed. This has long term harm on children (seriously, google it) but yet it's justified by some out of a sense of fear that somehow these immigrants are criminals or just "stealing their jobs" or "jumping the queue" when most are just trying to escape pretty terrible situations.

Honestly, I see more outrage over animal cruelty than I did from removing three year olds from their parents.

In years passed, we as a society endured a lot when required. In the World Wars, there was rationing and a lot of sacrifice to support the war effort.

But we've somehow transitioned into a society where we don't want to do anything for anyone. And we want to call that "liberty".

What we have here is something that may help tracking contacts for a disease we need to fight. That seems like a good thing to me. I don't give an F that some privacy nut may think "but the government might use this to track us".

Not every surface is a slippery slope.

Just like we had curfews, rations, shortages, blackout blinds and so forth in WW2 and now we don't. Not everything has to get worse.

Agreed - rights without responsibilities are just privileges.

> Not every surface is a slippery slope.

Maybe, maybe not. The whole point of the slippery slope metaphor is that it's hard to know when to stop. I think this is a better trade-off than the economy sinking though.

In this particular case, I'm leaning towards "this is worth it if the alternative is economic oblivion for billions of people" - but this guy's about page is enlightening: he's not some random commentator, this is very much his field.

That said, there's risk in globally deploying platform-level technology changes which could be difficult to roll back and are not held democratically accountable.

It may be worth considering time-limits on rapidly-introduced technology changes like this. We cannot always anticipate all the side-effects of technology, and if we do need to introduce them suddenly, we should be thoughtful and deliberate about evaluating their effect as we do.

It seems apparent that Apple and Google are the entities holding the reins on this particular implementation. Yes the technology is opt-in; but that could be seen as a way to make a potentially bitter pill palatable for both citizens and their governments.

After a global recovery, imagine what the world might be like if nearly all daily interactions between people with Android or Apple smart devices have to be assumed known to their local authorities (including in locations with repressive regimes).

Perhaps that would appear acceptable, under some circumstances, to some people in some cultures. I think it'd be hard for almost anyone to quantify.

I'd suspect that an environment like this would lead to a significant loss of privacy and a resulting chilling effect in the types of activities and relationships that people build.

Even if that's a pessimistic outlook, it may be worth questioning whether two corporations from a single country should have the power to effect such large changes without at least constraining their effect to the duration of the COVID-19 crisis.