Edit: and... five years later. “There was a mistake in the random number generator, all keys are discoverable”. Like, you know, the Intel Security Module.
Oh, and maybe this could also be used to avoid certain crimes such as terrorism?
You know where this leads to.
> Oh, and maybe this could also be used to avoid certain crimes such as terrorism?
> You know where this leads to.
Exactly, these capabilities won't go away. Today they are used for good but tomorrow? Not to invoke Godwin's Law but these contact tracing capabilities would have been a Nazi's wet dream.
Full open-source everything isn’t air-tight, but potentially a lot better than what we’ve got.
Also: as a mathematician, there is lots of value in a counterexample to part of a proof. Just that, even though the final result is true.
Not necessarily. They included in the article that we could use decentralized contact tracing instead; and, an article arguing against a feature doesn't need an alternative.
If a refrigerator were being released with a microwave, do I really need to provide alternatives to where I could put the microwave instead?
Among other arguments, it argues that contact tracing is a source of mass surveillance. That alone, for the appropriate crowd, is enough reason to not use it. There doesn't need to be an alternative because the alternative is _not having it_.
Just because a bunch of developers ended up wasting their resources on a feature that is a net loss for society doesn't mean that the feature needs to be released.
GACT is decentralized. The article is arguing against decentralized contact tracing.
> a feature that is a net loss for society
The article doesn't even try to make that argument, which is why it is not very good.
Perhaps similar or related, I'd read that Taiwan's using an alert system[1] that uses the absence of cell phone activity as a sign that it may be necessary to check on the owner.
Some places have digital access but in general the temperature measurement of bigger buildings are automated. But most places I went to had a paper form to fill out your details. I assume those are shared with law enforcement and CDC once one person who attended the building has been traced as a positive case and then all people and their contacts will be notified and tested.
There is no centralized government mandated central database that I know of. But I do know that once a crime happens they're quite good at tracing your public movements.
Contact tracing is clearly useful, but on it’s one does not change the basic reproduction numbers much. Look at South Korea which still has active infections despite active contact tracing and very successful social distancing.
Contact tracing COVID-19 is suplimental not a solution.
PS: As to my point, if you’re a grocery store employee in NYC you are likely to have been in contact with someone with COVID-19 in the last week. We can’t simply send all of them home, that’s the issue with contact tracing when a meaningful percentage of the population is infected. You need looser restrictions which reduces effectiveness.
“but not reduced it enough that contact tracing is likely viable”
For example, NYC has seemingly slowed the spread enough it’s possible to Test for and track new cases. But if you dig into their numbers 4,264 deaths are linked to COVID but where not tested prior to death. https://www1.nyc.gov/site/doh/covid/covid-19-data.page. They have little idea who’s currently infected and “ Due to delays in reporting, recent data are incomplete.”
Essentially they need a solid 2 weeks of minimal new cases. At which point they can start meaningful contract tracing, but contract tracing does not mean you can just get back to normal. Just slightly reduce the amount of isolation.
Remember, virus still doubles every 2-3 days under normal conditions. Without a vaccine or herd immunity, contact tracing alone does very little. It’s enough to reopen dental offices possibly hair salons, not schools.
If you want to live luxuriously, also put a netbook, X1 Carbon, MacBook Air, whatever, in your backpack, then you have Internet, too.
This is not an excuse for the outrageous tracking plans of Apple and Google, I just hope more people will do this as a reaction to those plans.
EDIT: I may have misunderstood the "no alternative", I assumed it was about the need to own a "smart" phone.
This is likely to be untrue in the immediate future. This is probably already true in places like China, where mobile payments are the norm.
As a personal example, and I know this does not yet apply to the US, but where I live it is impossible (or so inconvenient that it might as well be not possible) to do some banking operations without an Android or iOS device, as even accessing my bank's website requires me to have the app installed for token generation. I'm sure if I shopped around I could still find a smaller bank without such a requirement or live with the limitations, maybe finagle a way to use an emulator or something equally inconvenient, but I'm quite certain that this will not last and a smartphone will become essential. A lot of other things are also quite inconvenient without a smartphone around here.
I know the US and Europe have a distinct resistance to the smartphone (or even the computer) becoming required to live as anything but a homeless vagrant because their economies and infrastructure developed before smartphones were even an idea, which gives them the luxury to resist these technologies on moral grounds, or even on the grounds of not wanting to learn the new thing. On the other hand, countries whose economies developed in lockstep with cellular technologies and smartphones (China, India, much of Africa, South-East Asia, much of Latin America, etc.) don't have that particular luxury or simply take a much more pragmatic approach to the whole thing. In these places it is already incredibly inconvenient to get by without a smartphone and will likely become impossible in the near future, if it isn't already.
When smartphones and the internet do become essential to life, I can only hope that the laws of the land have managed to catch up by then. I am not particularly optimistic on this aspect, though, and I suspect it will take some kind of major disaster and/or abuse of human rights (or more likely, a series of them) to happen for another "age of enlightenment"-like period to happen, focused on information technology this time.
EDIT: spelling
Yeah. Because they can run out of power, they are easily damaged, and, generally, bug and exploit ridden.
A bank card is near indestructible.
I've seen this used at Wells Fargo ATMs.
Modern cards disable the magnetic stripe, and the chip is surprisingly secure.
https://www.cnet.com/news/homeless-not-phoneless-askizzy-app...
I do think making a smartphone a requirement for living is a genuinely catastrophic idea, not simply an ivory tower exercise nor conservativism. Requiring people to possess and carry with them at all times a computer with a myriad of sensors and an ever-broadcasting beacon not under their control seems terribly fragile, unnatural, caste-creating and cruel. It is worthwhile to fight this, despite it being undeniably convenient for some things.
YES
Since the Google Maps 'Allow 24/7 location tracing? Yes/Maybe Later' popping up once every other week, it is pretty clear that at least Google is willing to push surveillance as hard as possible. Once they have GACT built, deployed en masse and somewhat trusted by the public, it is not hard to infer they'll be willing to push any number of dark patterns to make it the de-facto reality for 99% of the population out there.
In summary: Yes, they can push any shit right now on your phone. No, they don't just push it yet because they are afraid of public / internal backlash. Yes, they'll do everything in their power to boil the proverbial frog and gradually reduce the backlash potential, and will eventually push the most invasive surveillance they can possibly conceive. And they are pretty imaginative.
Medium term bet: Within a year, Google will change GACT from opt-in to [de-facto] opt-out. For example by nagging you every two weeks: 'Protect your grandma life? Yes/Maybe Later'.
Most users are not your typical HN reader. Whatever is the default, or easy choice is the one that they are going to go for. Regulations were needed to forbid dark patterns with fishy defaults and pre-added items in the shopping car. People which profession is not related to computers may not have the time to spend analyzing and having a deep understanding of complex ethical computer problems.
> If you don't trust Google or Apple to do what they say they do then you need to stop using their OS and hardware.
I though that this argument was discarded long time ago. If I do not want to use Google nor Apple what are the alternatives? (I really mean it, it is not a cheap shot to your next argument, that is not a bad one) My bank has apps for iOS and Android, like my travel agency and even government. When so much depends on two providers choice is not really there.
That two points does not add much to your argument, as they are not good arguments in this or any situation. Leave them out next time and I think that your argument will gain more strength.
I agree that a constructive criticism is important, thou.
Which doesn't necessarily mean that the typical HN reader is right and most users are wrong. Many users will be prepared to sacrifice a bit of a "freedom" that HN users prize highly; that doesn't mean they're wrong to do so, just that their priorities differ.
I agree that this situation needs to be preserved. FWIW I worked at Mozilla for a long time because I was (and still am) enthusiastic about their mission, which is partly about making sure the Web remains a) a strong platform for such applications and b) not wholly controlled by Apple and Google. Part of that was doing FirefoxOS which mostly failed but curiously, via KaiOS in India, is also kind of succeeding.
Although it's not stated by the author, one simple and low-cost approach is to take more time for further discussion and review before accepting deployment of a system like this.
To those who might argue that we "don't have time to delay" and need to rush this functionality out, then I would respond that a rushed solution can often be worse than doing nothing -- especially if there is no easy way to roll it back.
Therefore my personal suggestions would either be to take more pause before accepting and deploying a single solution like this, or to enact stringent and specific time bounds on the rollout.
That is a reality-independent objection that can apply in any situation and delay anything indefinitely.
Lots of experts say that a robust digital contact-tracing solution (as part of a multipronged contact-tracing effort) could provide big health and economic benefits, the sooner the better. That doesn't mean we should have no discussion and review, but it does mean we should expedite them. We have at least a month before Google and Apple start rolling out their stuff, let's make the most of it.
My primary concern is related to maintaining pleasant social interaction and a reasonable balance of power on a time horizon of five years and beyond.
To me it's hard to imagine that a continuous digital record of human interactions that is subject to a proprietary protocol and implementation would be the safest situation to end up in.
That's "simple and low-cost" in the sense that doing nothing is simple and low-cost, usually. But it's not an "approach" to anything. It's also not low-cost considering thousands of people are dying every day.
It doesn't seem to me that there are easy solutions for this problems that offer better privacy that we haven't yet thought about for lack of time.
I'm not suggesting delaying forever, and I do realize that there is human impact at the moment. I would not refer to the value of life in monetary terms that way.
There may not be easy solutions but there are plenty of other contract tracing technologies[1] that experts have been discussing, developing and critiquing.
I am suggesting that we allow those experts the time they need - no more, and no less - to get their work done to a sufficient level and report their findings to decision-makers.
After that feedback is gathered it could become apparent that deploying GACT as a closed-source, time-unbounded OS-level feature with app approval restricted to two companies situated in one nation of the world is less than ideal.
That could allow nations to collectively ask for changes to the proposal, with solidarity in their concerns and expert evidence to back it up.
[1] - "Unified research on privacy-preserving contact tracing and exposure notification", https://docs.google.com/document/d/16Kh4_Q_tmyRh0-v452wiul9o...
Even if Google or Apple are _capable_ of doing something evil, you can stil prevent them from excersing that power by not setting an example that it's okay to do so.
Genuinely, it's not Google nor Apple that I fear doing something evil here.
Google will try to give me more targeted ads, without giving that detailed data to their app developers, but instead just making their demographics tools better.
Apple will do what they think will help the circumstance.
I fear the government doing evil with it, especially under the guise of good.
"Hey, we found this terrorist's phone number, turns out he has an Android device. Give me every person that's been physically near him in the last 24 hours"
"Hey, these 37 people were at a protest, where do they spend their off time?"
Well, sure; if it didn't have walls, it wouldn't be a castle.
Some castles rely entirely on their own walls
And then they'll do it anyway a few years later, when you're not looking. Just look at Google's introduction and continuous tightening of SafetyNet requirements.
And what the hell can you do? Switch to buying Apple, who set the gold standard for this crap years ago? Switch to Purism, which BankID (practically mandatory for life in Sweden, sadly) still hasn't been ported to?
You get a chance and you take it. All things bring you towards success one step at a time, as unsatisfying as it might feel.
How realistic is to expect populace to exclude their choice of smartphones that are the dominant ones in market?
Yes we should, if we complain about surveillance of Uighurs in China:
https://www.ft.com/content/dfec4ac4-6bf5-11e9-80c7-60ee53e66...
Speaking of China, ironically they are already running out of new patients:
https://www.thestreet.com/investing/gilead-cancels-second-re...
So probably Apple and Google have to hurry to use covid as an excuse to push their new data collection solution.
The problem arises because once it is widespread flipping it to mandatory for all phones is trivial. Check YES to agree to our new Privacy Policy ;)
We've seen opt-out abused before so it is down to whether you feel you can use a platform known for not respecting your choices.
Often times, it's a simple boolean value, do you want to trust that bool will stay the same, always?
Perhaps I should have said "since the Red Scare" or "since the War on Drugs"
In fact the end of McCarthy came after McCarthy. That particular abomination universally being understood as one the darkest periods is also progress.
I’m also somewhat certain the idea of any net loss of freedom over the last 50 years would be considered a bad joke by anyone not cis/white/hetero/male. Into the 70s, you weren’t allowed to take a job or have a bank account without your husband’s permission.
And if you insist on limiting this to just the freedoms of the all-American white bro: the Boomer generation was still subject to the draft. Spending two years in an Asian rainforest in perpetual danger of dying would seem to be quite worse, liberty-wise, than... whatever you're calling "authoritarianism".
It does legitimize it and that is a very important thing. Right now, pushing this kind of thing covertly would be disastrous if (when) it is discovered. With GACT, it's already there so it's presence alone is not suspicious and can be enabled surreptitiously.
> Or should we abjure smartphone-powered contact tracing?
Yes, in its present state, I think we should. We've done without smartphone-powered contact tracing before so it is clearly not essential. In its current form, it is worse than the alternative of traditional contact tracing.
> GACT creates a dormant functionality for mass surveillance, that can be turned on with the flip of a virtual switch at Apple or Google HQ.
If you don't trust Google or Apple to do what they say they do then you need to stop using their OS and hardware. It is already the case that Google and Apple can push (more) surveillance into your device anytime. GACT does not change that.
> Which makes the whole GACT platform a smokescreen really, as exactly the strong oversight would be required if the GACT platform was not there, and apps requested special access to Bluetooth to implement their own contact tracing technology.
Not at all. Plausible advantages of GACT: a) Google and Apple don't have to evaluate the properties of each app's Bluetooth protocol; b) standardizing the protocol prevents Balkanization and makes tracing much more effective; c) Google and Apple are likely to implement it better.
Another problem with this article is that the criticism is not constructive. If we believe the conclusions of the article, then what? Is there a better way to leverage smartphones for contact tracing? Or should we abjure smartphone-powered contact tracing? Doing what instead? "This sucks" without comparing it to alternatives is not actionable.