Do you have some evidence that Apple and Google run backdoors to privacy on iOS or Android devices? You speak about the track record of both companies, surely you should be able to point out several examples of this.

The spec seems pretty clear - it's not possible. If you feel that you don't trust them to implement the spec correctly due to incompetence or malice on their part - you need to supply the proof. If we're relying on your gut feel to be skeptical, you just look like an anti-vaxxer saying "I don't trust Big Pharma's vaccines based on my gut feel."

There's arguably a lot more evidence against Google than Apple here. But Apple did lie about their involvement, or even knowledge of, the PRISM program. Snowden leaks. I highly recommend Glenn Grennwald's book No Place to Hide if you're not interested in digging though sources yourself.

Even against their will, companies with capabilities can and have been compelled by government agencies to go against their promises and lie about it.

Additionally, with organizations of this size, it's very plausible that the vast majority of employees and even executives are blissfully unaware of wrongdoings, abuse and involvement in conspiracy by individual employees or decision makers.

All it takes is a single compromised or malicious person to add new capabilities in an update to an already rolled-out and well-intentioned software. Possibly a handful if you add strongly enforced and audited mechanisms for co-signing releases and whatnot.

I've read Permanent Record by Edward Snowden. It doesn't get more detailed than that. There is nothing in the book that indicates that Google's implementation of the contact tracing spec would deviate from the spec either through incompetence or malice.

You're making vague, unsubstantiated claims about how this could be compromised. Even if there is a bug that allows such apps to collect location info, that has nothing to do with Snowden leaks.

If a government is keen on collecting such information, they would simply not use Google/Apple's APIs and instead roll their own using bluetooth and location services. This was pointed out in the article. Now could you explain to us why you're promoting a conspiracy theory that the government will lean on Apple and Google to introduce malicious bugs into their APIs when they don't need the APIs at all?

> There is nothing in the book that indicates that Google's implementation of the contact tracing spec would deviate from the spec either through incompetence or malice.

I agree I'd trust Google over the government and many others. But the OP you are replying to called for releasing the source code, and reproducible builds. If you do that, you don't have to trust somebodies word or the laws of the land, you have the laws of mathematics in your court.

Surely you are not saying what is a clearly inferior solution is one we should be using.

I'm not arguing for the existence of any specific deliberate conspiracy. So please don't misrepresent what I'm saying as conspiracy theory.

Still, there are multiple plausible ways in which these apps and systems can be compromised by malicious actors (from any nationality). The risks are significantly larger than they need to, to a large degree due to lack of transparency and verifiability, and significant trust elements.

These risks are not inherent in the design of the contact-tracing system or the specific companies themselves, but they are inherent in the way smartphone apps are typically developed and distributed to end-users on mainstream platforms today.

Then on top of that, past and ongoing incidents obliterates my personal confidence that large U.S. tech companies will live up to their promises.