I personally refuse to use any contact tracing because an envitible consequence of its adoption is the idea that mass surveillance is legitimate so long as it can be argued it's keeping people safe.

Tech like this is always abused by governments. Just look at how governments are attacking encrypted messaging services today. It would be naive to think same thing wouldn't happen for any popular privacy-first contact tracing app.

Your comment is another example of dismissing what they did without understanding it.

As a result of this we now have less effective, higher privacy risk implementations in place.

And the alternative of not using them.

I wasn't fundamentally opposed, but as discussion went the way to maybe mandate usage, I thought it more prudent to abstain.

While technically there is nothing wrong with the implementation of Google or Apple, if they behave as specfified, I will not share any medical info with my smartphone as long as we do not have open systems in place.

The problem is understood and not accepted. These cases of third party ambition are a plain confirmation about the doubts many people had. You can ignore it but some people might not want to follow.

I have access to COVID tests through doctors in my family. I believe such tests would serve us better than these wellness apps. Scaling up the production would be possible within the budget that was used for tracing apps.

You can’t easily not use a lot of the data broker stuff that random apps use to resell your data. The data is sold without you noticing.

Maybe you’re cautious, but check the location services for apps on your phone - random third party apps may be selling it to brokers that then resell it to others. Even innocuous apps like free weather apps will do this sort of thing. [0]

Thankfully Apple’s OS updates are making this harder, but that’s relatively new.

The Bluetooth implementation doesn’t require you to input any medical data.

I agree that ubiquitous, free testing would have also helped. I think very high quality exposure notifications paired with quarantine would have been very effective too.

[0]: https://thenextweb.com/apps/2019/01/05/weather-apps-are-secr... (there was a better article on HN more recently, but I can’t remember the title).

It looks like you’re saying that apple’s and google’s solution can’t be used for privacy abuse.

Could it facilitate implementing one? E.g. could a country push for changes to how the solution works within a given location?

Phones track location so yeah a government could always try to force companies to hand over location data, but that issue is orthogonal to this solution.

Their Bluetooth implementation makes it harder for governments to request more problematic location data, because a solution exists that doesn’t require this kind of data.

The existence of this solution reduces privacy abuse risk.

Sad reality: Countries can always push, say, for mandatory upload of all cryptographic keys to government servers. We have to trust in megacorp lawyers to protect us from that at least to the point of exposing that come election times.

We’re trying to tell you that this would have happened anyway and contact tracing itself is just another instrument in the surveillance state.

And I’m trying to tell you that this overly simplistic response ignores pragmatic real-world solutions that let people accomplish hard things even with multiple constraints.

It is in fact possible to have effective and privacy preserving contact tracing at scale.

To me, anyone who work in tech and dismisses the Exposure Notification framework as "surveillance" is no different from an anti-vaxxer.

The app does 3 things on your phone: 1) continuously exchange Temporary Exposure Keys with other phones with EN enabled, and 2) periodically download a list of TEKs, compare to locally cached list of TEKs to determine if you were in close contact with a COVID positive patient, and 3) in the unlikely event when you are tested positive, work with your Health Authority, use a one-time code to upload your TEKs to the key server.

If you are really paranoid, you can do 1 and 2 with just a battery powered Raspberry Pi Zero (someone has done that and was previously posted to HN but can't find it right now) which should be net beneficial to you. But if you just don't understand this framework please stop spreading FUD.

It's really optimistic to think mass rollout of Apple/Google protocol wouldn't be abused. Once government makes it compulsory to use such app in some scenarios (and society actually agrees to do that instead of protesting it en masse) it's over. There's nothing fundamentally stopping government from later changing the technical mechanism ("Please install our national app; it's more trustworthy than foreign megacorps"). Good percentage of society is not technical literate enough to differentiate between "brilliant Bluetooth solution" and "dumber contact tracing relying on data brokers"; for many people that's just implementation detail on the same level as new UI.

Apple/Google pushing their specific privacy preserving implementation of exposure notifications out via an OS update is not the same as a government mandating surveillance app installs.

The existence of the first does not lead to the second.

The implementation was only privacy-preserving in an idealistic World in which governments wouldn't mandate uploading of the beacon keys.

It's another example of the persistent, naive belief amongst technologists that clever implementation can trump legislation.

I agree. I'm visiting Thailand and the locally developed app requires high precision location permissions, the app is constantly running, and the data is all tied to my passport number. It destroys my battery, and it's a complete privacy invasion.

Meh. If the Singaporian government thinks the police force should have contact tracing information then the police force shall have it. How v1 of an app was designed doesn't matter. Either Google folds and changes the design to suit or they move to a new app provider.

If it is acceptable to use the data for contract tracing for, what exactly is the argument that the government should be using data for contract tracing but not other law enforcement? I can imagine a few arguments, but they all seem weak. The contract-tracing-by-app can of worms shouldnh't have been opened.

I don’t disagree, Singapore specifically leans a little authoritarian and doesn’t really care about the privacy preservation. I was thinking more for countries that have stronger privacy protections or culture around individual rights.

In those countries a lot of people dismissed the Google/Apple approach without understanding it which lead to a privacy worse approach that’s also less effective.

I don’t disagree with the criticism of it being opt-in but I would go further: Apple and Google took months to roll out their framework, they certainly didn‘t prioritize it enough. They are the only parties in a position to implement digital contact tracing natively and they failed us. With great power comes great responsibility. No start-up or government has the ability to implement a low-level cross-platform contact tracing api. As of Today Apple still has not enabled their framework on iOS <= 12 devices even though there are countless people using devices that can not be updated to the current iOS. They have previously provided critical security updates for out-of-support versions of their OS. Why did they not do the same for the contact tracing framework?

We had a lot of other existing technology, like simple face masks, that could have been deployed against the spread of the pandemic as well.

It is almost a case study on how you can't solve problems that are fundamentally social ones by throwing technology (old or new) at the problem.

You're absolutely right that it's a shame.

Yes - I agree, we need both.

Sane policy and competent people to prioritize policy in order to lead effectively and move what needs to happen forward (massive categorical failure in the US on this bit, both in government and initial media response to the virus).

We also need the technical solution to consider privacy risk in the initial design so that we don’t implement something that can be abused later for other purposes.

This second part we have and it’s a great solution, but without the policy/leadership piece we can’t leverage it.

Exposure notification is not contact tracing. Questionable if effective contact tracing on mass scale without privacy violation is possible. At least Singapore contact trace and enforcement chain worked. Worse, A&G hubris in their solution and lack of cooperation with governments that wanted a proper contact trace solution bordered on insolence has caused preventable deaths. The fact that two platform owners could prevent the rest of the world from mounting proper epidemic responses is terrifying. Even more so if it's just a handful of employees dictating their culture to the rest of the world.

With enough responsible people and critical mass, exposure notification and contact tracing are ideally equivalent at their objective. Unfortunately though, people aren't responsible

The API/protocol is a good way of implementing the idea in a privacy-friendly way although I think everyone should have been clear that it is not as private as simply disabling Bluetooth or not carrying a phone. It is pretty benign. But being honest about that is important if for no other reason than to build trust.

However, the apps built on top of the API have (at least in some instances) clearly fallen victim of scope creep - eg the UK app came with venue check-in functionality (which then suddenly became legally mandated and there was no separate check-in app so you were out of luck if your phone didn't support the API or you didn't want to enable Bluetooth) and a function which tells you how "risky" your postcode is which you can't switch off. There was even brief talk about it being extended to include "vaccine passport" type functionality.

This was, sadly, predictable, and is why many people simply won't trust it.

The other issue with the app-based approach is that it sadly appears to be pretty useless. At least the UK app appears to notify for far too many contacts, large numbers of which are false alarms of one sort or another (neighbours, people sat in different offices, etc). While using Bluetooth proximity was a good idea, I think it's fair to say at this point that in the real world it just hasn't worked.

I agree with you that relying on state/country cooperation to build the apps was part of the problem.

I don’t agree that it’s useless, 15min of close proximity to a confirmed positive COVID patient within the timeframe is the best possible determination of exposure and people should quarantine if they get it.

I could be persuaded that too many are notified if there’s decent evidence of it, but with the massive case load/spread in the UK right now - I’m more likely to suspect that amount of people exposed is massive.

I'm not sure current case numbers really tell you much either way - you could equally argue that it's evidence that the app didn't work of course.

The issue in particular is that Bluetooth proximity isn't reliably able to distinguish between "next to but with a meaningful barrier in between" and "actually next to".

In my office, for example, we have areas adjacent to one another separated by floor to ceiling glass walls. People working on one side of the wall don't work with people on the other side and are not allowed to access the other area. There are quite a few scenarios like this (apartment blocks with thin partition walls between apartments, sat in a traffic jam next to another car, etc.

Google and Apple will happily deliver all your information to the government when it becomes their legal obligation.

Are we so naive to believe that if only we adopted their “privacy conscious” solution, there won’t be less privacy focused solutions preferred by the government? Or that their solution won’t be forced to change to meet their legal requirements?

> “ misunderstood by people who didn’t even attempt to try to understand it (including here on HN).”

Your comment is case-in-point the kind of knee-jerk response that I was talking about.

Edit: You added the second part after I’d already responded. They developed a good model to do large scale contact tracing in a privacy conscious way. People rejected this with vague suggestions like your comment about how it could be changed to be the opposite of what they’ve developed. Most people didn’t understand how it worked at all or why the design was good.

As a result, worse less-privacy preserving methods are used.

If they can be forced to change whatever implementation they have by the government then it helps no one. It’s just giving them more information on top of all their existing data they already have on you.

> “ If they can be forced to change whatever implementation they have by the government then it helps no one.”

They can’t be easily forced to change the implementation and their implementation reduces the risk of privacy problems. It’s designed explicitly to be effective without increasing that risk and without giving the government any individual’s information.

It’s worth reading the doc I linked.

And it’s a solution looking for a problem. No one wanted this. Not the people and not the government.

It doesn’t solve my problem because I will not use such an app, period.

It doesn’t solve the government’s objective of maximum data collection so they won’t use it.

The very idea of privacy conscious contact tracing is an oxymoron.

You underestimate how important it is to (most, competent) governments to keep their citizens alive and how unprepared they were caught in this. This solution (if used) was better than flying blind and cost these governments nothing. It's not fair to pretend a government would not welcome contact tracing as-is if it helped provide a tool to stop the spread. Not everything a government does is out to surveil you, they have to still provide some other functions.

After a lid is on things though - yeah, maybe. Maybe they'll try to flip this, but not while their pants are down.

Then why wasn’t it used? Surely all these governments all have heard of apple/google’s superior solution. Reality undermines this argument.

some waited, some didn't. I can't pretend to know why.

My personal guess/opinion is that those governments who's only objective was to get people isolated on exposure would at least have leaned towards the apple/google solution when it became available. Those who had ulterior motives (or had already rolled something out) would be less likely to wait for it.

One surprise for me here is Norway's initial implementation, which it later re-evaluated[1], you'll also see (at least at that point in time) that Bahrain and Kuwait did not. Bahrain even turned it in to a game show.

Edit: just to add, you'd see for example a place like Australia looking in to the solution once available, last paragraph here[2] - my opinion is that these countries do not feel threatened by their general populace, thus don't feel the need to turn everything in to a mass surveillance tool if they don't need to

[1]: https://www.amnesty.org/en/latest/news/2020/06/bahrain-kuwai...

[2]: https://www.reuters.com/article/us-health-coronavirus-apps-t...

> “ It doesn’t solve my problem because I will not use such an app, period.”

This is why I’d argue it should have been an OS update and you can’t opt-out (or at least default opt-in).

If you throw your phone in the trash so be it, everyone else will get privacy preserving exposure notifications. Paired with effective quarantine this may have stopped the spread and thousands of people who died might have lived.

You may want to throw your phone in the trash anyway since it gives away your location to the telecoms.

Perhaps it would have given the Librem 5 and the PinePhone an unexpected fanbase, from all of those who refuse the forced update.