6 ms·

Corona App – 10 requirements for the evaluation of “Contact Tracing” apps

44 points by errnesto 6y ago

chimprich 6y ago
This is one of those rare cases where you have to directly balance lives against privacy. My feeling is that while privacy is important, it's being taken a bit too seriously given the severity of the crisis. Google and Facebook et al. carry out far more involved and intimate surveillance of people's lives than would be required for an app as described in the article.
- deleted 6y ago
  [deleted]
- majewsky 6y ago
  This is one of the few cases where more privacy might literally save lives, because people will be more inclined to install the app if the privacy is taken more seriously. There was a poll where Germans were asked if they would install a contact tracing app. Some 40% sayed yes outright. Another 40% said "only if privacy concerns are addressed". So you're looking at a potential 40% market penetration without proper privacy and 80% with, which greatly changes the impact the app can have on reducing the spread of the virus. (Disclosure: I'm a member of CCC and chairman of a local chapter.)
  - jklhwtoy 6y ago
    This is one of the few cases where mandatory installation of apps will save lives, as seen in China/SK. For those "40% only if privacy concerns are addressed" there is a gradient of privacy. How many of them will still have concerns no matter what? And how many will not install anything out of laziness/comfort? Meanwhile, Google and Facebook are installed in 90%+ of phones and happily scoop up location data every day.
    - blub 6y ago
      Where's the proof that installing an app saved any lives at all? And anyway, our rights are anyway being temporarily but heavily reduced. I don't see why we have to also install this app, especially since having everyone wear a mask and washing one's hands would make the whole point of having contact with an infected person almost irrelevant.
    - A4ET8a8uTh0 6y ago
      And that does not mean it is right; it just means it is status quo. And Germans have a good reason to dislike panopticons as some still remember Stasi. Mandatory apps installation.. I guess that could be rolled out as most providers can and do have the ability to install stuff on your phone remotely. That said.. what are the odds average person gets sufficiently annoyed by gvmt mandated apps and installs lineage?
      - fwn 6y ago
        > what are the odds average person gets sufficiently annoyed by gvmt mandated apps and installs lineage? Won't happen to any meaningful degree. IMO if technologists fail to sensitize public discourse against the emerging dangers of surveillance tech now contemporary western democracies are probably about to be "disrupted".
        A4ET8a8uTh0 6y ago
        I am willing to disagree. If the app becomes annoying ( and it may very be ) people may adapt rather quickly. My example is that of SIM locking in the old country. It was a somewhat technical process, but people quickly adapted to it and learned how to remove it. The perception was that removal of SIM lock was beneficial. Naturally, I could be wrong ( and has been about cellphones for a while now ). And then, my mom could barely handle switch from Whatsapp to Signal. edit: coffee didn't kick in yet. added barely before handle
    - Freak_NL 6y ago
      Mandatory how? How will you address people without suitable devices? Not everyone has a (suitable) smartphone. Making owning and carrying a smartphone with required app mandatory won't fly in any healthy democracy.
  - chimprich 6y ago
    I suspect a large proportion of people would install it if requested to by their government. "Please install this app to save lives. Don't worry, it collects less data on your movements than Google Maps."
    - eternalban 6y ago
      "Requested"? It is painfully obvious that this narrative will climax with highly reduced rights - such as freedom of movement; employment; any sort of "assembly" -- for individuals who elect not to use mandatory surveillance products. Pressure to conform will be enormous and applied from top and bottom (from hysterical/concerned bottom dwellers). This drip drip of 'steps to take' by authorities and media is quite disingenuous: there have been multiple simulations into pandemics in the past 30 years and all these steps have been spelled out in various papers. Here is one: www.centerforhealthsecurity.org/our-work/events-archive/2001_dark-winter/Dark%20Winter%20Script.pdf (Grep for "freedom")
      - Angostura 6y ago
        Did you read the article?
- ThreeFx 6y ago
  That's maybe true, but giving governments the possibility to create movement profiles of people and correlate them is extremely dangerous. Maybe your current government is liberal enough to forego using the political aspect of the tracking app, but you can never be sure that this stays the case. What about governments with authoritarian regimes? Finally regarding Google/FB: Why would you give up even more of your privacy?
  - chimprich 6y ago
    > What about governments with authoritarian regimes? They're probably not going to care about people's views in the first place. Such regimes are already mandating apps of this type to be used.
- tinus_hn 6y ago
  It is not relevant what would be required. It is only relevant what’s actually in there.
- y7 6y ago
  This is not an all-or-nothing scenario. The choice is not between an app that saves lives and compromises privacy, or no app and lives lost. Privacy preserving technologies exist, and now is the time to use them. There is an additional technological cost, but that's what we should weigh the privacy costs against. The choice is between an app that doesn't care about privacy versus one that does.
  - chimprich 6y ago
    > There is an additional technological cost Time is of the essence here. I agree that, all else being equal, privacy should be respected. However, if it takes multiple weeks to iron out all the potential privacy issues, this approach becomes much less effective.
    - black_puppydog 6y ago
      We don't have enough runway to care about privacy, we'll just un-collect all that data once we raised! Sorry for the sarcasm, but I buy this now as little as I buy it in other situations.
asaddhamani 6y ago
I installed the contact tracing app from the Indian government on my phone. It won't let me use it without giving location access, not even just to see the app. The Indian government does not have a great track record when it comes to privacy and information security. (https://www.firstpost.com/india/aadhaar-data-leak-details-of-7-82-cr-indians-from-ap-and-telangana-found-on-it-grids-database-6448961.html https://www.firstpost.com/india/aadhaar-data-leak-details-of...) Aadhar is the Indian equivalent of the US SSN. While the cause is noble, there is always the problem with setting precedents, and as governments are known to use Riders (https://en.wikipedia.org/wiki/Rider_(legislation) https://en.wikipedia.org/wiki/Rider_(legislation)), I don't trust them they won't use Covid-19 to further their agenda either. This is what happens when you erode peoples trust. I for one will not be using these apps.
- raphaelj 6y ago
  As a side note, Android requires an app to get location access when using Bluetooth (not sure about iOS). So any Bluetooth contract tracing app will request location access.
mantap 6y ago
Entire countries are under house arrest. I don't trust the government but I also want my parents to be able to go to store or hospital without risking their lives. Pretty much everybody is either in at-risk group themselves or has a close relative or friend who is at-risk. Maybe this isn't the dystopia we deserve, but it's the dystopia we need.
- eivarv 6y ago
  From a technical perspective, you don't need to trust the government in these cases - provided that they implement the solutions with built-in privacy.
  - A4ET8a8uTh0 6y ago
    I don't want to be snarky, so instead let me ask what solutions would you recomnend for it?
    - eivarv 6y ago
      I just meant that there are technical approaches that don't necessarily involve centralized storage of everyone's movements and contacts, but achieve the same goals. Singapore (and others, for that matter) has allegedly solved some of these issues in their soon-to-be open source contact tracing app [0]. They basically let every device keep track on itself and it's encounters - until a diagnosis is made. Can't remember the details from there off the top of my head, but you'd either do a lookup via a central authority, or notify peer-to-peer, depending on what other mechanisms are in play (ephemeral/co-signed IDs, etc.) [0]: https://www.tracetogether.gov.sg/ https://www.tracetogether.gov.sg/
    - LarvaFX 6y ago
      The German's app will use bluetooth to track whom you're closed to on the device. When you get ill, the device notifies everyone that id 18911-2342-112312 has it and people who came in bluetooth range to you will get a notice to self isolate.
- deleted 6y ago
A4ET8a8uTh0 6y ago
I was listening in to yesterday's WH briefing and suveillance and contact tracing were mentioned multiple times with none of the media reps asking for details. I do know it is a genuine emegency, but I just don't trust goverment that much
robjan 6y ago
TraceTogether[1] by the Singapore government meets most of these requirements and is/will be open sourced soon. 1: https://www.tracetogether.gov.sg https://www.tracetogether.gov.sg
- A4ET8a8uTh0 6y ago
  In this case, even if it only does exactly what it says it does, the data gathered is more valuable than anything else. Complete movement profiles of an entire nation. Can you put a price tsg on that? From that perspective whether it is open source is a secondary consideration.
  - 9nGQluzmnq3M 6y ago
    The app does not use GPS or other location data, contacts are established only by Bluetooth pairing.
    - GordonS 6y ago
      Call me a cynic, but if apps like these became popular, I'd expect to see a creeping escalation. Reel in a large user base, then slowly capture and send more data. The possibility of being able to track a nation in real-time would have the security services blowing a load in their proverbial pants.
  - robjan 6y ago
    Everyone generates an anonymous ID, if they come within Bluetooth proximity the devices trade these anonymous IDs. No location data is collected and none of the data is sent over the internet. If you become infected you have the option of broadcasting your ID as being infected and others can compare the infected list against the IDs collected on their phones. None of the data you mentioned is being collected.
    - A4ET8a8uTh0 6y ago
      Hmm, does that anonymous ID change? If not, it is not going to stay anonymous for very long as patterns will remain largely unchanged. People do tend to be creatures of habit. I mentioned location data and if there is one thing we have learned over the past decade or so, it is that location is not gathered just from GPS ( which is the argument I assume you were making ). edit: As for the claim, no data is sent over the internet.. I just plainly do not believe that statement. I do not understand how anyone would.
the_mitsuhiko 6y ago
> Even if the transmission of a message is observed in the system (e.g. via communication metadata), it must not be possible to conclude that a person is infected himself or herself or has had contact with infected persons. This must be ensured both with regard to other users and to infrastructure and network operators or attackers who gain insight into these systems. I don't think this is doable. All protocols that we currently have have the ability to reveal this information in one way or another. There are two fundamental approaches at the moment: soemthing like DP-3T which uses TCNs (temporary contact numbers) where contacts exchange temporary numbers. On infection you download the list of infected people and compare on your device for matches. This fundamentally reveals who was infected. Then you have centralized approaches where you hand out encrypted IDs which a central authority can decrypt. In the latter case you can just create new device IDs which again lets you easily figure out which of your contacts was infected. In the latter case you have the theoretical possibility to detect such behavior due to the sheer amount of IDs generated by participants. Generally the attack vector would be someone putting a beacon to a super market and making pictures of people going in and out and capture their IDs. Then they could figure out later which of the people got infected.
alex_young 6y ago
San Francisco has demonstrated that just asking people to social distance and observe some shelter in place rules works for the most part. Why do we need to implement a surveillance state on top of that?
- A4ET8a8uTh0 6y ago
  There is an entire group of people who believe that "something" needs to be done. They do not know what that "something" is, but it has to be done. And the government representatives happily oblige with additional power grab.
- Angostura 6y ago
  ... and New Yoerk has shown that such methods aren't always sufficient. Contract tracing and testing clearly have a place. Doing so in a way that maintain civil liberties is clearly important.
- troydavis 6y ago
  > Why do we need to implement a surveillance state on top of that? Most contact tracing comes up as part re-opening businesses (and schools, though in the US that will probably be in the fall), not as much for the current complete shutdown. https://www.aei.org/research-products/report/national-coronavirus-response-a-road-map-to-reopening/ https://www.aei.org/research-products/report/national-corona... has a good explanation of why contact tracing is an important part of re-opening. The gist is that any amount of re-opening is likely to bring R0 much closer to 1 than it is during the current complete shutdown. The question then becomes how (well, how else) to minimize spread when new cases do occur. Think of contact tracing as one way to replace the impact that’s currently provided by shutting everything down.
buboard 6y ago
sure we can write 10 page bioethics essays, but when contact tracing is implemented it won't even be an app, governments will access data directly from carriers. and people will be ok because they re scared
thinkingemote 6y ago
To those saying "its a real urgent emergency" you might be too young to remember the immediate response after 9/11, but you might be old enough to remember the fall out, Manning, Snowden etc which continues almost twenty years later. This time around shouldn't we aim for a better response and no fall out that will last decades on our responses?

44 points by errnesto 6y ago

This is one of those rare cases where you have to directly balance lives against privacy. My feeling is that while privacy is important, it's being taken a bit too seriously given the severity of the crisis. Google and Facebook et al. carry out far more involved and intimate surveillance of people's lives than would be required for an app as described in the article.

deleted 6y ago
[deleted]
majewsky 6y ago
This is one of the few cases where more privacy might literally save lives, because people will be more inclined to install the app if the privacy is taken more seriously. There was a poll where Germans were asked if they would install a contact tracing app. Some 40% sayed yes outright. Another 40% said "only if privacy concerns are addressed". So you're looking at a potential 40% market penetration without proper privacy and 80% with, which greatly changes the impact the app can have on reducing the spread of the virus. (Disclosure: I'm a member of CCC and chairman of a local chapter.)
- jklhwtoy 6y ago
  This is one of the few cases where mandatory installation of apps will save lives, as seen in China/SK. For those "40% only if privacy concerns are addressed" there is a gradient of privacy. How many of them will still have concerns no matter what? And how many will not install anything out of laziness/comfort? Meanwhile, Google and Facebook are installed in 90%+ of phones and happily scoop up location data every day.
  - blub 6y ago
    Where's the proof that installing an app saved any lives at all? And anyway, our rights are anyway being temporarily but heavily reduced. I don't see why we have to also install this app, especially since having everyone wear a mask and washing one's hands would make the whole point of having contact with an infected person almost irrelevant.
  - A4ET8a8uTh0 6y ago
    And that does not mean it is right; it just means it is status quo. And Germans have a good reason to dislike panopticons as some still remember Stasi. Mandatory apps installation.. I guess that could be rolled out as most providers can and do have the ability to install stuff on your phone remotely. That said.. what are the odds average person gets sufficiently annoyed by gvmt mandated apps and installs lineage?
    - fwn 6y ago
      > what are the odds average person gets sufficiently annoyed by gvmt mandated apps and installs lineage? Won't happen to any meaningful degree. IMO if technologists fail to sensitize public discourse against the emerging dangers of surveillance tech now contemporary western democracies are probably about to be "disrupted".
      - A4ET8a8uTh0 6y ago
        I am willing to disagree. If the app becomes annoying ( and it may very be ) people may adapt rather quickly. My example is that of SIM locking in the old country. It was a somewhat technical process, but people quickly adapted to it and learned how to remove it. The perception was that removal of SIM lock was beneficial. Naturally, I could be wrong ( and has been about cellphones for a while now ). And then, my mom could barely handle switch from Whatsapp to Signal. edit: coffee didn't kick in yet. added barely before handle
  - Freak_NL 6y ago
    Mandatory how? How will you address people without suitable devices? Not everyone has a (suitable) smartphone. Making owning and carrying a smartphone with required app mandatory won't fly in any healthy democracy.
- chimprich 6y ago
  I suspect a large proportion of people would install it if requested to by their government. "Please install this app to save lives. Don't worry, it collects less data on your movements than Google Maps."
  - eternalban 6y ago
    "Requested"? It is painfully obvious that this narrative will climax with highly reduced rights - such as freedom of movement; employment; any sort of "assembly" -- for individuals who elect not to use mandatory surveillance products. Pressure to conform will be enormous and applied from top and bottom (from hysterical/concerned bottom dwellers). This drip drip of 'steps to take' by authorities and media is quite disingenuous: there have been multiple simulations into pandemics in the past 30 years and all these steps have been spelled out in various papers. Here is one: www.centerforhealthsecurity.org/our-work/events-archive/2001_dark-winter/Dark%20Winter%20Script.pdf (Grep for "freedom")
    - Angostura 6y ago
      Did you read the article?
ThreeFx 6y ago
That's maybe true, but giving governments the possibility to create movement profiles of people and correlate them is extremely dangerous. Maybe your current government is liberal enough to forego using the political aspect of the tracking app, but you can never be sure that this stays the case. What about governments with authoritarian regimes? Finally regarding Google/FB: Why would you give up even more of your privacy?
- chimprich 6y ago
  > What about governments with authoritarian regimes? They're probably not going to care about people's views in the first place. Such regimes are already mandating apps of this type to be used.
tinus_hn 6y ago
It is not relevant what would be required. It is only relevant what’s actually in there.
y7 6y ago
This is not an all-or-nothing scenario. The choice is not between an app that saves lives and compromises privacy, or no app and lives lost. Privacy preserving technologies exist, and now is the time to use them. There is an additional technological cost, but that's what we should weigh the privacy costs against. The choice is between an app that doesn't care about privacy versus one that does.
- chimprich 6y ago
  > There is an additional technological cost Time is of the essence here. I agree that, all else being equal, privacy should be respected. However, if it takes multiple weeks to iron out all the potential privacy issues, this approach becomes much less effective.
  - black_puppydog 6y ago
    We don't have enough runway to care about privacy, we'll just un-collect all that data once we raised! Sorry for the sarcasm, but I buy this now as little as I buy it in other situations.

asaddhamani 6y ago

I installed the contact tracing app from the Indian government on my phone. It won't let me use it without giving location access, not even just to see the app. The Indian government does not have a great track record when it comes to privacy and information security. (https://www.firstpost.com/india/aadhaar-data-leak-details-of-7-82-cr-indians-from-ap-and-telangana-found-on-it-grids-database-6448961.html https://www.firstpost.com/india/aadhaar-data-leak-details-of...) Aadhar is the Indian equivalent of the US SSN. While the cause is noble, there is always the problem with setting precedents, and as governments are known to use Riders (https://en.wikipedia.org/wiki/Rider_(legislation) https://en.wikipedia.org/wiki/Rider_(legislation)), I don't trust them they won't use Covid-19 to further their agenda either. This is what happens when you erode peoples trust. I for one will not be using these apps.

raphaelj 6y ago
As a side note, Android requires an app to get location access when using Bluetooth (not sure about iOS). So any Bluetooth contract tracing app will request location access.

mantap 6y ago

Entire countries are under house arrest. I don't trust the government but I also want my parents to be able to go to store or hospital without risking their lives. Pretty much everybody is either in at-risk group themselves or has a close relative or friend who is at-risk. Maybe this isn't the dystopia we deserve, but it's the dystopia we need.

eivarv 6y ago
From a technical perspective, you don't need to trust the government in these cases - provided that they implement the solutions with built-in privacy.
- A4ET8a8uTh0 6y ago
  I don't want to be snarky, so instead let me ask what solutions would you recomnend for it?
  - eivarv 6y ago
    I just meant that there are technical approaches that don't necessarily involve centralized storage of everyone's movements and contacts, but achieve the same goals. Singapore (and others, for that matter) has allegedly solved some of these issues in their soon-to-be open source contact tracing app [0]. They basically let every device keep track on itself and it's encounters - until a diagnosis is made. Can't remember the details from there off the top of my head, but you'd either do a lookup via a central authority, or notify peer-to-peer, depending on what other mechanisms are in play (ephemeral/co-signed IDs, etc.) [0]: https://www.tracetogether.gov.sg/ https://www.tracetogether.gov.sg/
  - LarvaFX 6y ago
    The German's app will use bluetooth to track whom you're closed to on the device. When you get ill, the device notifies everyone that id 18911-2342-112312 has it and people who came in bluetooth range to you will get a notice to self isolate.
deleted 6y ago

A4ET8a8uTh0 6y ago

I was listening in to yesterday's WH briefing and suveillance and contact tracing were mentioned multiple times with none of the media reps asking for details. I do know it is a genuine emegency, but I just don't trust goverment that much

robjan 6y ago

TraceTogether[1] by the Singapore government meets most of these requirements and is/will be open sourced soon. 1: https://www.tracetogether.gov.sg https://www.tracetogether.gov.sg

A4ET8a8uTh0 6y ago
In this case, even if it only does exactly what it says it does, the data gathered is more valuable than anything else. Complete movement profiles of an entire nation. Can you put a price tsg on that? From that perspective whether it is open source is a secondary consideration.
- 9nGQluzmnq3M 6y ago
  The app does not use GPS or other location data, contacts are established only by Bluetooth pairing.
  - GordonS 6y ago
    Call me a cynic, but if apps like these became popular, I'd expect to see a creeping escalation. Reel in a large user base, then slowly capture and send more data. The possibility of being able to track a nation in real-time would have the security services blowing a load in their proverbial pants.
- robjan 6y ago
  Everyone generates an anonymous ID, if they come within Bluetooth proximity the devices trade these anonymous IDs. No location data is collected and none of the data is sent over the internet. If you become infected you have the option of broadcasting your ID as being infected and others can compare the infected list against the IDs collected on their phones. None of the data you mentioned is being collected.
  - A4ET8a8uTh0 6y ago
    Hmm, does that anonymous ID change? If not, it is not going to stay anonymous for very long as patterns will remain largely unchanged. People do tend to be creatures of habit. I mentioned location data and if there is one thing we have learned over the past decade or so, it is that location is not gathered just from GPS ( which is the argument I assume you were making ). edit: As for the claim, no data is sent over the internet.. I just plainly do not believe that statement. I do not understand how anyone would.

the_mitsuhiko 6y ago

> Even if the transmission of a message is observed in the system (e.g. via communication metadata), it must not be possible to conclude that a person is infected himself or herself or has had contact with infected persons. This must be ensured both with regard to other users and to infrastructure and network operators or attackers who gain insight into these systems. I don't think this is doable. All protocols that we currently have have the ability to reveal this information in one way or another. There are two fundamental approaches at the moment: soemthing like DP-3T which uses TCNs (temporary contact numbers) where contacts exchange temporary numbers. On infection you download the list of infected people and compare on your device for matches. This fundamentally reveals who was infected. Then you have centralized approaches where you hand out encrypted IDs which a central authority can decrypt. In the latter case you can just create new device IDs which again lets you easily figure out which of your contacts was infected. In the latter case you have the theoretical possibility to detect such behavior due to the sheer amount of IDs generated by participants. Generally the attack vector would be someone putting a beacon to a super market and making pictures of people going in and out and capture their IDs. Then they could figure out later which of the people got infected.

alex_young 6y ago

San Francisco has demonstrated that just asking people to social distance and observe some shelter in place rules works for the most part. Why do we need to implement a surveillance state on top of that?

A4ET8a8uTh0 6y ago
There is an entire group of people who believe that "something" needs to be done. They do not know what that "something" is, but it has to be done. And the government representatives happily oblige with additional power grab.
Angostura 6y ago
... and New Yoerk has shown that such methods aren't always sufficient. Contract tracing and testing clearly have a place. Doing so in a way that maintain civil liberties is clearly important.
troydavis 6y ago
> Why do we need to implement a surveillance state on top of that? Most contact tracing comes up as part re-opening businesses (and schools, though in the US that will probably be in the fall), not as much for the current complete shutdown. https://www.aei.org/research-products/report/national-coronavirus-response-a-road-map-to-reopening/ https://www.aei.org/research-products/report/national-corona... has a good explanation of why contact tracing is an important part of re-opening. The gist is that any amount of re-opening is likely to bring R0 much closer to 1 than it is during the current complete shutdown. The question then becomes how (well, how else) to minimize spread when new cases do occur. Think of contact tracing as one way to replace the impact that’s currently provided by shutting everything down.

buboard 6y ago

sure we can write 10 page bioethics essays, but when contact tracing is implemented it won't even be an app, governments will access data directly from carriers. and people will be ok because they re scared

thinkingemote 6y ago

To those saying "its a real urgent emergency" you might be too young to remember the immediate response after 9/11, but you might be old enough to remember the fall out, Manning, Snowden etc which continues almost twenty years later. This time around shouldn't we aim for a better response and no fall out that will last decades on our responses?