7 ms·

And... that right there would also be a very sufficient surveillance system. As much as I want this to be over, it's really scary hearing about a system where e

And... that right there would also be a very sufficient surveillance system. As much as I want this to be over, it's really scary hearing about a system where everyone's physical interactions with everyone else is intentionally logged and alerted upon. Even if this app was only really used for a couple months to get us past this hurdle, it'll both condition people to detailed contact tracing and will inevitably remain installed on many devices.

hprotagonist 7y ago
k-anonymity is more or less impossible, to boot. https://www.nature.com/articles/s41467-019-10933-3 https://www.nature.com/articles/s41467-019-10933-3
- AaronFriel 7y ago
  Wouldn't a "find my phone" feature like Apple developed be possible to use in this case? See: https://blog.cryptographyengineering.com/2019/06/05/how-does-apple-privately-find-your-offline-devices/ https://blog.cryptographyengineering.com/2019/06/05/how-does... I think that with two tweaks, we could cast a pretty wide net and remain privacy preserving: 1. Phones record a 14 day history of every pseudonym and public key they generate, as well as every pseudonym and public key they observe. Observers (potentially exposed contacts) could encrypt these observations with their own public keys and upload them using the same method Apple uses, I believe. 2. People who test positive can opt in to publishing those pairs publicly, which would allow any device to scan its history for those pairs and determine if its owner has been exposed. Or alternatively, Apple or another company could perform this on a user's behalf using the central database. I think the privacy preserving aspect is dependent on users opting in to sharing information for the past 14 days following a covid-19 test. That would allow the contacts to perform the same "have I seen this device" search locally. Edit: This actually seems a lot like "haveibeenpwned" more-so than anything else. As long as a case's device generated unique IDs continuously, logged them privately and broacasted them to nearby devices, then a potentially exposed contact's device could regularly query a central database for hashed prefixes of IDs they've seen in the past 2 weeks. Any person (case) who tests positive could opt-in to publishing all of the IDs their phone has generated in the past 2 weeks. The contacts could then opt in to publishing the location said contact occurred, and a hash of a geofence could also be logged - allowing contacts who have been exposed to opt in to publishing that someone in a particular vicinity had tested positive and was present at a particular date and time.
xorfish 7y ago
You don't need surveilance. All recorded contacts can be stored locally and only informed once a positive test is returned. More information here: https://www.pepp-pt.org/ https://www.pepp-pt.org/
- raphlinus 7y ago
  The word "surveillance" in healthcare is a little different than in regular politics - it basically means gathering information from the field. See [1]. However, we're going to be seeing a lot of discussion about infectious disease surveillance and the more nefarious types. As Maciej Cegłowski has pointed out, we are already doing the nefarious kind on a massive scale in order to target ads more effectively. I do believe there's a middle ground, that this stuff can be done in a way that preserves human rights. But it will require attention and holding those who have the power to abuse the system accountable. [1]: https://journalofethics.ama-assn.org/article/surveillance-infectious-diseases-information-action/2006-04 https://journalofethics.ama-assn.org/article/surveillance-in...
- klik99 7y ago
  My understanding of what you just said - status and contacts are stored locally, and the user will manually mark themselves as "infected" after a test. Presumably the receiver of that notification will have a local status saying "get tested". But when you mark yourself to infected, how does that resolve to notifications for all your contacts? At some point that must hit the cloud and fan out to everyone, meaning the contact list is shared at that point, and with a large enough network becomes identifiable info. Esp if you combine that with skimming contacts. Is the GDPR compliance and on the wire encryption what keeps it private?
  - xorfish 7y ago
    You exchange a one time id with each close proximity. If you test positive, you publish your recorded close proximities ids on a public server. Authorities can supply you with a one time tocken with the test result to append said server. There are certanly more efficient and elegant ways to solve this problem, but it is solvable.
zepearl 7y ago
I don't disagree, but I cannot think about any alternative => a compromise is needed... . > ...and will inevitably remain installed on many devices But I really hope that on one hand when this is over the central tracking servers will then be disabled and on the other hand users will be motivated to uninstall the app and/or switch off bluetooth/gps/whatever to save battery (even if tracking by cell tower would still be active, if used by the app).
- Denzel 7y ago
  Compromise makes sense when both sides are willing to compromise. Speaking broadly, the U.S. government and its institutions (NSA) have proven reluctant to compromise even when the American public is. I’d be willing to compromise here if along with the compromise we replaced “hope” with laws around destroying this technology/platform at a certain defined point in time, along with sufficient criminal penalties for continued usage of the technology/platform after said point in time. If the Patriot Act proved anything, it’s that we as citizens must demand laws with teeth around the deployment and usage of these dangerous technologies.
  - zepearl 7y ago
    Yeah, agree on that.
zozbot234 7y ago
> And... that right there would also be a very sufficient surveillance system. If you're using "Find My Phone" on your device, you're already relying on this sort of surveillance. I'm not sure what's "scary" about using the exact same feature that many people are in fact relying on for their convenience, to mitigate an ongoing disease outbreak.
- dx87 7y ago
  The reason it's being used is the difference, the fact that it's the exact same feature is irrelevant. That's like saying you don't understand why someone would have a problem with murder because we already use guns for other things.
  - zozbot234 7y ago
    And the reason it's being used is to try and contain the spread of disease. I don't think many people would object to that, either.

hprotagonist 7y ago

k-anonymity is more or less impossible, to boot. https://www.nature.com/articles/s41467-019-10933-3 https://www.nature.com/articles/s41467-019-10933-3

AaronFriel 7y ago
Wouldn't a "find my phone" feature like Apple developed be possible to use in this case? See: https://blog.cryptographyengineering.com/2019/06/05/how-does-apple-privately-find-your-offline-devices/ https://blog.cryptographyengineering.com/2019/06/05/how-does... I think that with two tweaks, we could cast a pretty wide net and remain privacy preserving: 1. Phones record a 14 day history of every pseudonym and public key they generate, as well as every pseudonym and public key they observe. Observers (potentially exposed contacts) could encrypt these observations with their own public keys and upload them using the same method Apple uses, I believe. 2. People who test positive can opt in to publishing those pairs publicly, which would allow any device to scan its history for those pairs and determine if its owner has been exposed. Or alternatively, Apple or another company could perform this on a user's behalf using the central database. I think the privacy preserving aspect is dependent on users opting in to sharing information for the past 14 days following a covid-19 test. That would allow the contacts to perform the same "have I seen this device" search locally. Edit: This actually seems a lot like "haveibeenpwned" more-so than anything else. As long as a case's device generated unique IDs continuously, logged them privately and broacasted them to nearby devices, then a potentially exposed contact's device could regularly query a central database for hashed prefixes of IDs they've seen in the past 2 weeks. Any person (case) who tests positive could opt-in to publishing all of the IDs their phone has generated in the past 2 weeks. The contacts could then opt in to publishing the location said contact occurred, and a hash of a geofence could also be logged - allowing contacts who have been exposed to opt in to publishing that someone in a particular vicinity had tested positive and was present at a particular date and time.

xorfish 7y ago

You don't need surveilance. All recorded contacts can be stored locally and only informed once a positive test is returned. More information here: https://www.pepp-pt.org/ https://www.pepp-pt.org/

raphlinus 7y ago
The word "surveillance" in healthcare is a little different than in regular politics - it basically means gathering information from the field. See [1]. However, we're going to be seeing a lot of discussion about infectious disease surveillance and the more nefarious types. As Maciej Cegłowski has pointed out, we are already doing the nefarious kind on a massive scale in order to target ads more effectively. I do believe there's a middle ground, that this stuff can be done in a way that preserves human rights. But it will require attention and holding those who have the power to abuse the system accountable. [1]: https://journalofethics.ama-assn.org/article/surveillance-infectious-diseases-information-action/2006-04 https://journalofethics.ama-assn.org/article/surveillance-in...
klik99 7y ago
My understanding of what you just said - status and contacts are stored locally, and the user will manually mark themselves as "infected" after a test. Presumably the receiver of that notification will have a local status saying "get tested". But when you mark yourself to infected, how does that resolve to notifications for all your contacts? At some point that must hit the cloud and fan out to everyone, meaning the contact list is shared at that point, and with a large enough network becomes identifiable info. Esp if you combine that with skimming contacts. Is the GDPR compliance and on the wire encryption what keeps it private?
- xorfish 7y ago
  You exchange a one time id with each close proximity. If you test positive, you publish your recorded close proximities ids on a public server. Authorities can supply you with a one time tocken with the test result to append said server. There are certanly more efficient and elegant ways to solve this problem, but it is solvable.

zepearl 7y ago

I don't disagree, but I cannot think about any alternative => a compromise is needed... . > ...and will inevitably remain installed on many devices But I really hope that on one hand when this is over the central tracking servers will then be disabled and on the other hand users will be motivated to uninstall the app and/or switch off bluetooth/gps/whatever to save battery (even if tracking by cell tower would still be active, if used by the app).

Denzel 7y ago
Compromise makes sense when both sides are willing to compromise. Speaking broadly, the U.S. government and its institutions (NSA) have proven reluctant to compromise even when the American public is. I’d be willing to compromise here if along with the compromise we replaced “hope” with laws around destroying this technology/platform at a certain defined point in time, along with sufficient criminal penalties for continued usage of the technology/platform after said point in time. If the Patriot Act proved anything, it’s that we as citizens must demand laws with teeth around the deployment and usage of these dangerous technologies.
- zepearl 7y ago
  Yeah, agree on that.

zozbot234 7y ago

> And... that right there would also be a very sufficient surveillance system. If you're using "Find My Phone" on your device, you're already relying on this sort of surveillance. I'm not sure what's "scary" about using the exact same feature that many people are in fact relying on for their convenience, to mitigate an ongoing disease outbreak.

dx87 7y ago
The reason it's being used is the difference, the fact that it's the exact same feature is irrelevant. That's like saying you don't understand why someone would have a problem with murder because we already use guns for other things.
- zozbot234 7y ago
  And the reason it's being used is to try and contain the spread of disease. I don't think many people would object to that, either.