It is. It just requires additional beacons and at least one point where a real identity can be matched.

So, theoretical attack relying on non-existing deployments to get a person's past position, even with several other ways of obtaining the same information (for example: cell tower tracing, collecting info from cameras, cctv, card purchases, etc)

Thanks I think I'll keep using the app

Our parents did not write that you shouldn't use some app.

There was a very specific claim about the Google/Apple approach and its usefulness for surveillance and someone objected by teasing a possible pathway for using proximity tracing for surveillance.

One can acknowledge an approaches inherent risks without making absolute judgements about the approach in general.

It is if you build Bluetooth scanners everywhere in a city and correlate the scan data with other surveillance data, as simple as pointing a camera at whoever passes by a scanner.

Indeed, if you start with the contact tracing platform, add a mass surveillance system to it, you end up with a mass surveillance system. Note that a surveillance system like the one you propose doesn’t need the contact tracing platform to work.

But it does make it a heck of a lot cheaper to build and scale. You need far fewer cameras and can spread cheap bluetooth beacons densely across the area. And you can put beacons in places you can't use cameras.

Wait, so how are you matching the beacons (cryptographic random values) back to individual users?The back end only gets that information if a user tests positive and agrees to submit the data.

Even then there is no reason to store that linkage so server compromises won't leak this information.

You do realize that the scanning of bluetooth is already in place? For example http://www.libelium.com/products/meshlium/smartphone-detecti... or https://www.cnn.com/2020/04/04/tech/location-tracking-florid...

The contact tracking system does not add anything that is not present for tracking individuals. What it does provide is for two anonymous individuals to determine if they were in contact with each other for some period of time in the past.

The ability to do surveillance to see if an individual is in a particular place at a particular time is neither aided nor hindered by the contract tracing framework that Apple and Google provided.

You’d have to have a pretty sophisticated setup to do so, considering the identifiers are randomly changing all the time. It would be far easier to use the existing identifying cell tower data that already exists. Your paranoia isn’t justified IMHO.

It is, though. If you're not infected you retain your privacy, but once you're infected and give up your contact tracing key, everyone can know whether you have been near them or not. Combine this fact with a network of Bluetooth beacons at fixed locations and a malicious actor can basically track where anywhere an infected person has went.

"everyone can know whether you have been near them or not."

For a very broad definition of "you" and for an unconventionally small set called "everyone". If you are forced to quarantine, a lot of people will know about your infection anyways, completely without any convoluted mental gymnastics about theoretical deanonyzation possibilities. Epidemic control has always been a very low privacy endeavor and app-based tracing following the Google/Apple model doesn't change that the tiniest bit. In fact of it was fully deployed it could replace a lot of far more invasive tracing, causing a net increase in privacy.

I wish I could believe some new form of surveillance would ever "replace a lot of far more invasive tracing" and not just increase the overall scope of collection. This type of BT-based "offline/historic" mass-snitching just gives privacy-conscious people another thing to have to hide from in addition to the cellular network itself.

Random Bluetooth identifiers rotate every 10-20 minutes, to help prevent tracking [1]. (Of course it's always possible to track phones with their radios on for some time and distance.)

[1] https://covid19-static.cdn-apple.com/applications/covid19/cu...

That's irrelevant because once you're infected, you give up your daily keys[1], which allow your random ids to be correlated together.

[1] technically this is optional, but not doing so also means you're not reporting your infected status to others, which kills the point of contact tracing.

The medical facility that diagnoses you does not get your keys, if I'm understanding the system correctly. They give you a key that you give to your phone, and your phone then uploads the daily keys. Unless your phone includes identifying information with that upload, the daily keys are still anonymous at that point.

The hypothetical malicious actor would need to have (1) listened at some location where you were and captured the key you were broadcasting at the time, (2) identified you by some other means, such as face recognition, while you were at that location, and (3) infiltrated the server where your phone uploaded its daily keys so they could find out what other keys came from the same device as the one they captured and correlated with you already.

If they do all that then they could tell which other locations they were capturing key broadcasts at that you visited.

If they have not gained access to the data at the upload server, then all they get from matching your key to your real identity at one location is what other key listening location you visited before the key rotated.

They could put the face recognition systems (or whatever they are using) at their other key listening stations...but then they don't need the keys.

This seems like a lot of effort for little gain on the part of the malicious actor.

You're right, I wonder why they didn't harden it just a little by transmitting less and listening more, or by changing keys more often.

It’s optional and opt-in now. Do you trust it to stay that way once the framework is in 99% of people’s pocket? I sure don’t.

If Apple or Google are going to introduce a non-optional surveillance mechanism into their devices, there’s no particular need to build it off of their contact tracing platform.

You’re thinking the contact tracing platform somehow paves the way for an actual surveillance system, but it doesn’t. If they want to build a surveillance system then they will, and the success/failure/adoption rate of their contact tracing platform won’t affect that at all.

> there’s no particular need to build it off of their contact tracing platform

Building surveillance off the contact-tracing platform would allow the three-letter agencies to track movement of a single device regardless of whether or not you try to sever its connection to the cellular network. You might be able to hide a single device from the network, but would you be able to hide all the other devices around you that are trying to snitch on you?

Surveillance is more than just the technical means of data collection but also the societal framework in which it occurs. Contact tracing, if it worked, would have been a bunch of "good PR" for surveillance in general, and that affects how people will react to similar increases of data collection in the future. How to you think the FBI's 2015 case against Apple would have gone if there was already precedent for unlocking devices if the owner was thought to be infected?

> would allow the three-letter agencies to track movement of a single device regardless of whether or not you try to sever its connection to the cellular network

They can do this without the contact tracing platform.

Regarding PR, that too can be done very well without a contact tracing “success story”. Also, forcing people to unlock their devices is not an element of the the contact tracing platform.

I’m not sure why you’re convinced the contact tracing platform is a necessary or even helpful step for any of these things you worry about. But it isn’t. You will be able to take more fruitful actions against these things once you understand that.

My understanding is just fine, thanks. I see a surveillance system that has demonstrated no value to me, presented in a very short time by parties who rarely-if-ever cooperate, with no end date for the system's removal. It doesn't pass my sniff test, I don't like it, and I don't need anyone to tell me I'm allowed to think that way :)

It doesn't matter, the technology doesn't provide any means for central tracking.

Yes I do - because everybody is watching.

This feels like a "slippery slope" argument. If so then I would argue the situation demands us to take a small step further towards the start of the slope.