Apple, Google ban location tracking in apps using their contact-tracing system • Hacker News Board

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#231

Post by crushthecurve » Tue, May 05, 2020, 1:30 AM UTC

artursapek wrote: post #59

buboard wrote: post #47

covid19 has become a buzzword factory. Politicians popularize terms like "herd immunity" , "crush the curve", "testing", "ventilators", "PPE" etc to appear to be doing something. "Tracing" is the next in line, but it's a total sham. No country has been able to contain the epidemic with bluetooth. And all the countries that manage the epidemic have first waited until they have very few cases , which can be traced manu…

You seem to agree with Schneier! I'm with you, the whole premise is utterly useless. https://www.schneier.com/blog/archives/2020/05/me_on_covad-1...

We took a deeper look in an article linked in another comment on this thread.

One thing that's interesting to think about more deeply is how difficult it is to estimate proximity based on the combinatorial explosion of different hardware, individual device peculiarities, battery levels and environmental factors (walls, glass windows, partitions, ventilation).

The very limited data published appears like interesting preliminary field work which finds significant variability in signal strength across hardware, and rather than concluding proximity estimations are useful, ends in a plea for OEMs to release factory calibration data for their BLE implementations:

https://github.com/opentrace-community/opentrace-calibration...

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#232

Post by int_19h » Tue, May 05, 2020, 1:30 AM UTC

forgotmylogin2 wrote: post #143

nicwolff wrote: post #109

Earlier quoted context omitted.

> Their tools are just easier to use and more expressive. And that's the problem – they're giving governments tools that let them more easily and effectively infringe on the privacy rights of their citizens. Privacy isn't invaded when the data is collected, although that's a necessary step; it's invaded when a cop or bureaucrat queries that data to see what a citizen has done. Giving them that tool is morally complic…

This is a ridiculous stance to take. If true, then open sourcing any form of software is morally corrupt since the government could then use it for evil. Quite frankly, I don't think any reasonable person would consider selling software to the government to be morally corrupt unless they were reasonably confident the government would use it for evil. Right now, nobody has made a compelling-enough argument to make me…

Intent matters. Palantir specifically makes surveillance tech, and specifically markets it to governments.

As for compelling arguments... is the history of most of the world's governments not enough for you? In US, you can look at the census for a case in point: this data was used to chase draft dodgers during WW1, and to compile list of Japanese for internment during WW2. Curiously, by WW2, the federal census law had specific provisions preventing the Bureau from disclosing that information to any other government agencies, precisely to prevent this kind of use - Congress simply repealed those provisions. Nevertheless, the Bureau subsequently denied sharing that data and buried any leads, so we didn't have definitive proof until this century.

Or we could talk about COINTELPRO, PRISM etc.

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#233

Post by goindeep » Tue, May 05, 2020, 1:37 AM UTC

Horrible.

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#234

Post by hogFeast » Tue, May 05, 2020, 1:39 AM UTC

andrepd wrote: post #124

jjgreen wrote: post #11

Earlier quoted context omitted.

Given that Palantir is involved, I'd not touch it with a long stick https://tech.newstatesman.com/coronavirus/palantir-covid19-d...

> Palantir is involved Holy shit, and I didn't think that this whole contact tracing bullshit could look even worse.

Contact tracing isn't bullshit. It is how they dealt with sexually transmitted diseases four decades ago...it works.

The issue is that the UK govt is composed of a combination of incompetent and corrupt people (one of the companies involved in this is owned by a minister). And they are trying to go with the low-cost option (whilst the govt is subsidising 1/4 of salaries paid in the whole country) rather than the old-school, proven way.

It is kind of shocking but it is the result of a political system (and culture) that rewards incompetence and sloth.

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#235

Post by crushthecurve » Tue, May 05, 2020, 1:39 AM UTC

jaimex2 wrote: post #168

Here in Australia our Covid tracing app is already out. It uses Bluetooth proximity logs and local storage unless you test positive and are asked to upload. I had a look at whats in the apps DB and it seems it just keeps a log of unique ids it bumps into. When you test positive and upload I'm guessing it publishes those unique ids if the logs show over 15 minutes of contact. The government already have our locations…

A misunderstanding is that this system results in instantaneous contact notification and isolation (which is what one of the original papers on digital contact tracing efficacy assumes).

The reality is the entire 'human in the loop' contact tracing process is still manual. Health staff working in state contact tracing teams still need to call and interview every contact to determine whether they could be considered a close contact from an epidemiological perspective.

Also consider that close contacts include anyone you've spent more than 2 hours in an enclosed room with.

So that immediately limits the utility of any bluetooth proximity app: you still need an entirely manual process for home, work, social gatherings - any situation where you are in an enclosed room.

We've taken a deeper look at the assumptions and expert opinion, both from individuals and institutions, which appear to discount this kind of system from providing significant value.

Even the product lead of Singapore's TraceTogether app, as a natural advocate for this kind of initiative, admits the technology is oversold and is only an additional tool (due to the significant potential for false positives / negatives):

https://blog.gds-gov.tech/automated-contact-tracing-is-not-a...

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#236

Post by hogFeast » Tue, May 05, 2020, 1:42 AM UTC

OJFord wrote: post #191

g_p wrote: post #184

Earlier quoted context omitted.

It looks like you won't have to petition for it. According to https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.... , "We intend to open source our codebase once the first release is finalised. The documentation accompanying that release will supersede this paper." and from https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contac... , "The Secretary of State has also committed to making the source code…

> That may not happen immediately on release because the fabulous NHSX development team are all working hard on getting the product ready. But it will happen. That's just annoying nonsense though isn't it? There are reasonable (well 'ok they happen, whatever') causes for delay in open-sourcing something that didn't start out that way, but... Do any of them take more than seconds of developer time? They mean it 'may n…

The UK has passed the point of parody. If you want to justify any action, just say something about how great the NHS is before you do it.

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#237

Post by viraptor » Tue, May 05, 2020, 1:44 AM UTC

crushthecurve wrote: post #230

We've been looking at digital contact tracing from the perspective of Australia, as we see a huge push for the COVIDSafe app, based on Singapore's TraceTogether app. It seems the sensible order of questions is: 1) Do we have a contact tracing problem? 2) Does digital contact tracing generally solve it? 3) Is the specific app / implementation useful / safe / privacy-respecting? It appears the national conversation alm…

The post has a very city-specific view. (and it may have good points about that environment) Compare it to a regional town: minimal public transport, few/no dense residential buildings, no large offices. For me the app is literally a "does anyone I stood next to in the shop / petrol station test positive" indicator.

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#238

Post by paxswill » Tue, May 05, 2020, 1:44 AM UTC

azinman2 wrote: post #218

skybrian wrote: post #15

We probably shouldn't call them "contact tracing" apps since what they plan to do is so different than manual contact tracing. "Exposure notification" is a better term. Nothing prevents anyone from using their phone's location history to remember what to tell the contact tracing people.

What exactly is the difference?

Say Alice tests positive.

Contact tracing: Alice is able to say, “I was in contact with Bill and Carol.” Then authorities can talk to Bill and Carol, and have them trigger their phones to see who they’ve been near. But because that’s slow, most plans would upload the lists of who’s been near who to a central server. Then the authorities can do a simple query to see who’s been near who.

Exposure notification: Alice enters a code that she got with her positive test result in to the app. The app has been continually broadcasting rotating, random identifiers which it then uploads to the central service. The code she entered verifies to the central service that she has a legitimate positive result. Bob and Carol’s phones periodically check with the central server for the list of positive IDs. Their phones stored one of the IDs from Alice’s phone when they were near each other earlier. Once they get the latest list of infected IDs, their phones will alert them that they have been exposed and should be tested.

In CT, the central service has all the data, and you can trace contacts without the knowledge of the users. In EN, the service has a list of infected people, and everyone needs to check that list periodically.

Pretty sure there’s some subtlety with the IDs being a cryptographic sequence or something so there isn’t a gigantic list of IDs everybody is constantly pulling down, but this is the gist of it.

ETA: The FAQ from Apple+Google is a pretty quick rundown of where exactly each part of the data is stored and when it leaves your device. https://blog.google/documents/73/Exposure_Notification_-_FAQ...

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#239

Post by azinman2 » Tue, May 05, 2020, 1:53 AM UTC

I have to say, working at Apple and knowing all the hard work that goes into this and making sure your data stays private while also being able to combat this disease, it's very frustrating to read a lot of the comments here. I can understand why the public is skeptical, but I feel like as a society we've swung so far away from institutional trust that now nothing good can actually emerge. The anti-vax movement is a perfect example where the collective work of thousands of people over decades to save millions of lives just gets tossed aside because some celebrity 'feels' like there's a connection that isn't there, and in the process, the level of public harm becomes severe.

Note: All opinions (in this comment and all of mine on HN) are my own.

Re: Apple, Google ban location tracking in apps using their contact-tracing system

#240

Post by viraptor » Tue, May 05, 2020, 1:54 AM UTC

shakna wrote: post #139

ghuntley wrote: post #129

See https://twitter.com/GeoffreyHuntley/status/12561244277810626... for Australia.

Where are the bug bounty programs? That's easy. It's a crime to see how any of the app is running. Reporting a security flaw would likely see you receive a $5000 fine, and potential jail time atop of that. They didn't bother to get the servers running before pushing out a gigantic advertising campaign shaming anyone for not using it. ... Despite it having obvious flaws from day one, that showed it was mostly a cut 'n…

> It's a crime to see how any of the app is running.

Have you got something supporting this? Here's a panel of Australian-based security people decompiling and discussion the details of the app: https://www.youtube.com/watch?v=U3dN99ljgD4 Are you saying they've all publicly admitted to committing a crime and are unaware of those laws? Are all editors here https://docs.google.com/document/d/17GuApb1fG3Bn0_DVgDQgrtnd... criminals?

The only serious analysis I can find is in http://www.austlii.edu.au/au/journals/JlLawInfoSci/2003/2.ht... and it's "kinda depends why you're doing it, but either way it's largely untested".