News for hackers. Stuff that matters.
Re:NSA “precomputed contact chaining” enhances phone-record ... by walterbell on Sunday May 24, 2020 @11:11AM (#23292039)
Some countries are also collecting physical location data from telecom companies, for the claimed purpose of contact chaining-tracing-matrix-graph-network analysis:

https://www.eff.org/deeplinks/2020/05/global-contact-tracing...

> Despite the lack of evidence to show the effectiveness of location data to stop the spread of the virus, a number of countries’ governments have used the crisis to introduce completely new surveillance powers or extend old ones to new COVID-related purposes.

Some US states will use smartphones for opt-in contact tracing using iOS 13.5+ and Android 6.0+, https://9to5mac.com/2020/05/21/covid-19-exposure-notificatio...

> Alabama, South Carolina, and North Dakota are among the first U.S. states to express interest in Apple and Google’s Exposure Notifications API for assisting COVID-19 contact tracing.

It is not yet understood if/how state health contact databases will be combined with other county, state or federal databases, but Palantir manages multiple databases and is involved in both US and UK Covid-related data fusion projects, https://techcrunch.com/2020/05/20/palantir-covid-19-va-contr... & https://tech.newstatesman.com/coronavirus/palantir-covid19-d...

Re:NSA “precomputed contact chaining” enhances phone-record ... by bo1024 on Sunday May 24, 2020 @02:48PM (#23293657)
Apple and google’s system apparently doesn’t store location information. Actually it’s getting pushback from health people because it doesn’t collect data.
Re:NSA “precomputed contact chaining” enhances phone-record ... by walterbell on Sunday May 24, 2020 @02:59PM (#23293742)
It can be used to derive phone/human proximity data, which can be cross-referenced with other metadata.
Re:NSA “precomputed contact chaining” enhances phone-record ... by conradev on Sunday May 24, 2020 @03:39PM (#23294067)
It can’t be because the database does not exist: it is sharded onto each individual phone

The server only has a list of random identifiers from those who have tested positive for COVID. An exposure notification is determined when a phone downloads that list and correlates it with its local list.

Re:NSA “precomputed contact chaining” enhances phone-record ... by walterbell on Sunday May 24, 2020 @03:51PM (#23294171)
> when a phone downloads that list

After exposure, a time-bounded (?) graph of proximity contact data can join the central list, via the state health app using the local data. This can be cross-referenced with other metadata.

Once a human contact tracer establishes communication with the owner of a phone's random identifier, the identifier can be de-anonymized.

Even without the new APIs, each phone's location can be collected and shared by telcos, at the granularity of cell tower triangulation.