What? I don't think this is accurate.

From what I recall, the US was/is spying on the major tech companies and would regularly demand data and place gag orders on those companies.

Neither actions are willful forms of data transfer. The first is actually an eternal game of cat and mouse. NSA finds a leak for some data, Google fixes it, new leak, etc. The second is targeted handover of data, and only affects a few individuals.

Equating these with the US government having full access to everyone's data is misleading. If you think otherwise, please provide more detail.

Exactly why they aren’t collecting GPS data and the system is built using anonymous Bluetooth keys, similar to the find my iPhone anonymous network. Can’t hand over what you don’t have.

How does this jive with Google, for instance, using Bluetooth scanning (enabled by default) for high location accuracy? This has been enabled for years and most people are simply aware of it being enabled (outside of HN).

Google has effectively been using Bluetooth scanning and contact tracing (of sorts) as part of their location tracking feature... Now they're turning around and saying they won't track location from Bluetooth scanning? Seems like a BS PR move.

Apple and google are working together on this. So it’s an agreement between them both to have a more privacy-centered protocol for this purpose.

Google lets you do a lot more privacy violation on Android, but Apple has been building their brand around privacy and wouldn’t participate in that.

>Equating these with the US government having full access to everyone's data is misleading. If you think otherwise, please provide more detail.

By everyone you mean "US citizens" because from my understanding non-US citizens are fair game and it it legal to spy on them.

No, they aren't allowed to hand over data on EU citizens either, that would break GDPR. USA wouldn't go after them for this but EU definitely would.

What about non EU citizens? Do you think NSA won't try to get the realtime location of EU and nonEU politicians? They can claim is for national security, would GDPR stop that?

You should maybe read Permanent Record from Snowden. Everything you describe is outdated since his whistleblowing in 2013.

> is spying on the major tech companies and would regularly demand data and place gag orders on those companies.

So you agree.

> Neither actions are willful forms of data transfer.

What’s that got to do with it?

> Equating these with the US government having full access to everyone's data is misleading.

If the data exists, the only prudent approach is to assume state-level actors, at least, can get access to it.

The discussion is beyond "if the data exists", it will be gathered and some people seem to prefer yelling at clouds instead of looking at the technical implementation.

Even nation state actors will have a harder time gathering data that only exists locally on a bunch of smartphones, separate from geolocation as proposed here, versus a centralised database lacking comprehensive oversight.

The rest is pretty irrelevant, we're talking about data collection using phones that already have an OS from both of these vendors. "But Snowden" is really no argument anybody in these discussions will listen to (and I'm not convinced they should if it's used in a way to imply that you shouldn't use the internet for anything). If you have a problem with data collection for contact tracing please be specific why and optimally provide what you feel would be a better alternative.

Google and Apple are the ones pushing for isolating where this data lives and how it can be used/abused here. They are doing this in an effort to curb far more dangerous data collection on the very same devices in architectures that infer location or send off all data that is gathered on central servers. Your comment boils down to "Gapple is evil because Snowden" and seems to be disconnected from the specific issue at hand. They are OS manufacturers, if they wanted to get malicious access to all kinds of tracing data they would have had to do exactly nothing.

> They are doing this in an effort to curb far more dangerous data collection

Don't be naïve. This is not an NGO or an institution. They are doing this so that they and noone else owns the data.

Or maybe so that ordinary people will continue to to trust them and people like me will start trusting them.

They have a long way to go in my case but every journey starts with a single step, and this seems like the twelfth or so step from Googles side towards becoming trustworthy (but they still have a long way to go!)

I think one shouldn't underestimate the business value of actually being a trustworthy vendor/business partner/SaaS company and while there are a few contenders that niche isn't too crowded for now :-)

> Don't be naïve. This is not an NGO or an institution. They are doing this so that they and noone else owns the data.

Even if this "do your research" level talking point would be true, they don't own the data in this proposal, the end user device does. The device you trust and use anyway, the device that has your geolocation and access to far more data Gapple could abuse at all times. Which is better than what the COVIDsafe/NHSX/ROBERT put forward for the specific topic of digital contact tracing.

Google/Apple developed this particular contact tracing technology such that they don't have any of the data nor any of the control, so it is not the same as the US government having it.

> Having Google/Apple develop a tracking technology is the same as the US government having it.

This is why you want an API that never uses any data you don't want anyone else to have. That's what this API is.

The "trust" here isn't about whether they'll keep your data safe from third parties including state level actors. Your "trust" only needs to be that the API does what it says on the tin.

Which leads to this conclusion: either you A) trust this API to be what it says: something that doesn't ever deal with any sensitive data. Basically an exchange of random numbers.

Or B) you think that there is something nefarious here and the API might associate who you are or where you are, and store or distribute that data.

If it's A) then you should be fine. If you think B) then you shouldn't use a phone from Apple or Google. Because as far as you are aware, they share your location and personal information.

As far as integrity goes, I can't see a situation where you would both accept running an iOS or Android phone but at the same time avoid apps with this API out of privacy concerns!

> then you shouldn't use a phone from Apple or Google

Because you have another choice...

I read Snowden's biography - Permanent Record. Your claims are untrue. The sibling comment has it right - the US govt could steal data from the tech giants but they gradually got better at plugging such leaks. For example, in response to the Snowden revelations, all data in transit between datacenters is now encrypted. On the other hand, the govt would also request the data of a few people, which was generally granted.

It's not correct that the US govt has root access to all systems and data.

That seems extraordinarily naive. The NSA would not give up access like that unless forced at gunpoint, and the US gov has clearly demonstrated it doesn't care (and actually quite likes) this sort of gross privacy invasion.

The only (in)tangible difference between 2005 and today is the presumed existence of national security letters and other warrants that compel these companies to provide access.

You must be ignorant of how these agencies work. All they want is plausible deniability. The spy agencies have all technology needed to access any phone. For example, it is widely known that Israel's agencies have the ability to enter any phone, iOS or Android, and get the information they want. They are now OPENLY using this technology to track corona virus cases:

https://www.cnn.com/2020/03/18/tech/israel-coronavirus-techn...

https://www.timesofisrael.com/israeli-tech-company-says-it-c...

Do you recall the news that NSA (US Intel Agency) paid RSA (US security vendor) $10m go backdoor encryptions libraries?

If this was exposed once it’s happening elsewhere.

There was also the case of the NIST elliptic curve encryption best practices being subverted for NSA backdoors standard.

They’ve got a job to do. They’re doing it. But worth noting that a vendor could claim be pro privacy while also cooperating with their government.

And we also have examples of companies refusing to comply. And we all use djb’s curves rather than the nist curves now.