You should probably read up on how the Google and Apple system works.

https://en.wikipedia.org/wiki/Google_/_Apple_contact_tracing...

My brief understanding:

- No location data is used at all

- Devices get random rolling identifiers that are shared with other devices when in close range (ie contact is made)

- Devices keep a list of which identifiers they came in contact with in the past

- If someone tests positive, their recently used random identifiers are published, and any devices with those identifiers in their list notify the user that they may have been in contact with someone who has now tested positive.

If you can devise a non-magical way that a Google, Apple, or Subway employee could use that to personally stalk someone it would be quite an interesting whitepaper.

A widely distributed Bluetooth monitoring network noting tims and places ... might ... be able to correlate secrets with other data (facial recognition, MAC, UUID, etc.,) to correlate individual with probable SARS-COV-2 exposure status.

An in-location tracking system, such as numerous proposed retail monitoring systems, among othe.

Given time and location, a low number of hits would likely be sufficient.

This would be expensive, but likely within reason for a motivated entity. Possibly by utilising (with or without cooperation) existing infrastructure and systems.

If you have a widespread Bluetooth monitoring network with centralized data you've already built your stalking system that likely works better than trying to use the Google/Apple contact tracing system.

But you've added Covid status detection as a capability. To what net advantage is unclear.

Though yes, this shows the inherent risks of pervasive surveillance systems.

If you have those resources, there are far more effective ways to track people that do not require relying on the contact tracing system.

Fair point.

The objective is far less practicality or usefulness than of determining possible attacks on the anonymous contact tracing method. Also incidentally highlighting the power and threats of widely-distributed surveillance networks. Inference is powerful.

Hopefully it's a little harder for a random Sandwich Artist to pick up your address via one of these apps than via a paper form that you fill out in front of them.

That said, they have to be right in front of you to stalk you, they can't do it from California.

There are also many reports about Google or Facebook employees abusing private data. In Permanent Record, Snowden explains how the NSA employees watch nudes stolen from regular citizens on a regular basis.

That is true but their have already been dozens of articles explaining how Apple/Google designed their contact tracing system to make it nearly impossible to be abused.

> many reports about Google or Facebook employees abusing private data.

I'm sure you have a link or two handy?

Here’s one about Google: https://gawker.com/5637234/gcreep-google-engineer-stalked-te...

1 person, 10 years ago, promptly fired. Somehow I'm missing the "many" part of the original claim.

Yes, because they actually designed their system so that it can not be used for stalking. Go read up about it.

Well, they failed then, because it can definitely be used for stalking. Having covid and distributing your daily keys makes it much easier but not necessary.

If you have COVID you should not be distributing your daily keys, you should be staying the fuck inside.

COVID can be asymptotic for long periods. This is the whole point for such systems to exist in the first place.

Yes, and you reveal your keys for the past when you are diagnosed, and then you go inside, stay inside, and do not reveal any further keys.

This is not useful for stalking.

Sure it is, you just need imagination. Say that you are a stalker, you (or someone delegated by you) passed near your target and got h(daykey, time), your target happens to go to the hospital for covid a while after, so you have the daykey of your target for multiple days and all of their h(day, time). You detect that it was your target that went into the hospital because one of their h(daykey, time) matches with the one that you have stored, in addition you know if your target passed nearby you/one of your friends/one of the locations where you have put some cheap bluetooth phones and the exact day and time that this happened. Intentionally infecting the target will covid will help this whole thing but it is not necessary.

This is just in no way a realistic attack scenario. It gains you nearly nothing for a massive amount of work.

You said that it can't be used for stalking. I said that it can and that it is difficult rather than impossible.

Instead of wasting everyone's time arguing pointless semantics, have you considered actually engaging in constructive discussion?

You really should stop blaming others for your own failure to properly convey what you mean.