4 ms·

This guy is wrong about the Apple/Google contact tracing program. As created, it’s opt-in only and does not report matches to a central authority. This guy sa

by jmull 7y ago

This guy is wrong about the Apple/Google contact tracing program. As created, it’s opt-in only and does not report matches to a central authority. This guy says, yeah, but the gubment could abuse the tracing mechanism for things besides an epidemic, force your phone to report matches centrally, and force the removal of the opt-in part of it. ...except, if a government can pull those off, they don’t need this new contact tracing platform. These assume the government already has deep, control of the details of the operating system. In other words, this contact tracing platform has nothing to do with his privacy concerns. There are always people who see a tragic pandemic and just see a chance to use the concern and attention to highlight their own cause. And then there are the ones who fight against the efforts to mitigate the suffering to promote their cause, like this guy. Whew.

GordonS 7y ago
> This guy says, yeah, but the gubment could abuse the tracing mechanism for things besides an epidemic.. > ...except, if a government can pull those off, they don’t need this new contact tracing platform. These assume the government already has deep, control of the details of the operating system. It doesn't have to be about the security services having root on your phone - they can use legislation, forcing Apple/Google to hand over location data so they can hoover it up. Alternatively, they can use legal loopholes - as we've seen before after Snowden. Honestly, it's naive to think they wouldn't try to get this data.
- jmull 7y ago
  You’re missing the main point: if the government can do this, it will, independent of this contact tracing platform. Also, there is no location data in this platform, and Google and Apple don’t have the data that does exist. > naive I think you need to understand what’s going on here before you start throwing around words like that.
  - GordonS 7y ago
    > You’re missing the main point: if the government can do this, it will, independent of this contact tracing platform How? I'm not talking about getting a warrant to infiltrate a single suspect's device, I'm talking about mass surveillance. They need a means, and depending on how they approach it, they need to soften up the public so they are willing. Apps like this provide a means - maybe they don't collect everything the security services want from the beginning, but we could see a creeping escalation, especially under coercion by the security services. As for softening up, western governments are already very good at keeping the general populace fearful, whether it be the commies, Russians, Chinese, Islam, terrorists, etc, there is always some boogeyman de jour. Apps like this could be the opportunity they need - the straw that broke the camel's back, convincing people it's all to save lives. "good citizens will use these apps to save lives - what have you got to hide?".
    - jmull 7y ago
      We’re already at the bottom of the hill of that slippery slope argument. Nearly everyone already carries the tools of mass surveillance around with them everywhere they go already. What may or may not be partially missing (don’t forget, cell towers are already tracking everyone’s general location and governments can get that data in various ways) is the software and backend systems to collect that data and make it available to governments... and this contact tracing system isn’t that software and doesn’t have back end components. So again: while these privacy concerns are valid, they have nothing to do with this contact tracing system
      - matt_smith123 7y ago
        A key difference for me is that it is way easier for the government to get a company or individual to give up keys or data than it is to get them to write the code to gather data in the first place. I'm sure there are those in government that are quite pleased that Apple and Google are doing it willingly.
donohoe 7y ago
First, you make some good points but you could have made them without rudely characterizing the author ("...but the gubment could.." etc.) Second, the author is not wrong - when you build in tracking at such a deep-level it is open to abuse. Read the authors bio, he is not a naive techie. This is an area he has strong background in and deep technical knowledge. Maybe this is the path forward, but Apple and Google appear to be rushing into this without considering the larger picture.
- jmull 7y ago
  It’s exactly because of the Author’s bio that I come down hard on him. He knows what he’s saying is wrong, and he knows that if the FUD he’s spreading catches on, a lot of suffering will happen that otherwise would not have. > when you build in tracking at such a deep-level it is open to abuse. True, which is why he should do an analysis of this system rather than this. He could be using his platform as an authority and presumed skills as a teacher to explain the system rather than spread misinformation.
  - donohoe 7y ago
    No, what he is saying is very plausible and very likely correct. It is not mis-information. It is a well founded concern. I've been in tech long enough to know that what he is proposing is very possible. Other commenters here go into better detail than I.
    - jmull 7y ago
      Please do read comments by others. There are some good ones that go through, point by point, places where the author is wrong.
grey-area 7y ago
Also, the government already has this capability in place, they can track and bug individuals and groups via telecom networks.
- stjohnswarts 7y ago
  Yes but previously they would have needed a law passed to do such monitoring without a warrant, now people are just volunteering it with the drive by apple and google to publically and very openly track who you hang out with, where you're going, where you've been and then enthusiastically sharing it with the government. This is the softening up. Once covid is over in a few months or years they will be like "well look at all the good we can do, now we can use it to track all sorts of diseases, crime patterns, what you had for dinner and how that ties in with your other webs of interaction TO HELP MAKE YOU SAFER"
  - grey-area 7y ago
    Is a rubber stamped warrant which allows mass surveillance really a warrant at all? How many requests has the fisa court denied? Which law allows for warrantless collection of all this data?
mpweiher 7y ago
There's quite a difference between either forcing Apple and Google to build such a feature, which seems hard, vs. just forcing them to turn an existing feature on. Same for turning such a feature on surreptitiously vs. installing such a feature surreptitiously.
- jmull 7y ago
  It’s not just turning something on though. This system doesn’t do what the author is talking about. It’s decentralized, opt-in, and transparent. The government would have to force Apple and Google to make it centralized, automatic, and secret. In others, force them to make a completely different platform.
  - Macha 7y ago
    The other thing is lets say the government decided to bring in this system and Google/Apple didn't give any feedback. Then they just get a contractor to build an app that just broadcasts "I am Bob and I am at <location>" to nearby people and a central server. suddenly you have something way more open to abuse
baryphonic 7y ago
Exactly right. And as civil libertarian as I am, I'd rather have Google and Apple tracking my location for this prosocial cause than serving targeted ads. And it's not like Apple and Google aren't already tracking iOS and Android users anyway (albeit user-tweakable).
craigsmansion 7y ago
> There are always people who see a tragic pandemic and just see a chance to use the concern and attention to highlight their own cause You say that like it's not a PR exercise for large corporations. > the ones who fight against the efforts to mitigate the suffering There's more than a few billions floating around off-shore that could have helped establish universal healthcare and social safety programs, but just being a good corporate citizen doesn't get headlines, so let's focus on panic situations and instead sell our new slogan: "Nefarious, for good!" ("good" defined as "not as evil as a global health crisis"; disclaimers may apply)
Fnoord 7y ago
I'm not sure why you need to be so condescending in a healthy discussion like this. > This guy says, yeah, but the gubment could abuse the tracing mechanism for things besides an epidemic, force your phone to report matches centrally, and force the removal of the opt-in part of it. > ...except, if a government can pull those off, they don’t need this new contact tracing platform. These assume the government already has deep, control of the details of the operating system. If your system has one RCE, you don't care about another one because it already has one? Perhaps you can work around the one, mitigating it? Also, "the government" (any in the world) can ask Google or Apple to share the data of a suspect. As they're not a one way hash, that is possible. Furthermore, an attacker can certainly gather the Bluetooth addresses and correlate these to one way hashes. If the API is public, they can correlate these hashes and detect which Bluetooth addresses got the disease. Together with the location, even an outsider can learn more about this issue. Also, lets not forget there's recently an RCE in Bluetooth on Android (which many people still run with unpatched), and the problem of iOS not working with Bluetooth when the application isn't open on the foreground with screen open.
nunez 7y ago
I think it's only opt-in on the surface. I could see governments requiring users to be opted-into the program in order to get tested for COVID.

by jmull 7y ago

GordonS 7y ago

> This guy says, yeah, but the gubment could abuse the tracing mechanism for things besides an epidemic.. > ...except, if a government can pull those off, they don’t need this new contact tracing platform. These assume the government already has deep, control of the details of the operating system. It doesn't have to be about the security services having root on your phone - they can use legislation, forcing Apple/Google to hand over location data so they can hoover it up. Alternatively, they can use legal loopholes - as we've seen before after Snowden. Honestly, it's naive to think they wouldn't try to get this data.

jmull 7y ago
You’re missing the main point: if the government can do this, it will, independent of this contact tracing platform. Also, there is no location data in this platform, and Google and Apple don’t have the data that does exist. > naive I think you need to understand what’s going on here before you start throwing around words like that.
- GordonS 7y ago
  > You’re missing the main point: if the government can do this, it will, independent of this contact tracing platform How? I'm not talking about getting a warrant to infiltrate a single suspect's device, I'm talking about mass surveillance. They need a means, and depending on how they approach it, they need to soften up the public so they are willing. Apps like this provide a means - maybe they don't collect everything the security services want from the beginning, but we could see a creeping escalation, especially under coercion by the security services. As for softening up, western governments are already very good at keeping the general populace fearful, whether it be the commies, Russians, Chinese, Islam, terrorists, etc, there is always some boogeyman de jour. Apps like this could be the opportunity they need - the straw that broke the camel's back, convincing people it's all to save lives. "good citizens will use these apps to save lives - what have you got to hide?".
  - jmull 7y ago
    We’re already at the bottom of the hill of that slippery slope argument. Nearly everyone already carries the tools of mass surveillance around with them everywhere they go already. What may or may not be partially missing (don’t forget, cell towers are already tracking everyone’s general location and governments can get that data in various ways) is the software and backend systems to collect that data and make it available to governments... and this contact tracing system isn’t that software and doesn’t have back end components. So again: while these privacy concerns are valid, they have nothing to do with this contact tracing system
    - matt_smith123 7y ago
      A key difference for me is that it is way easier for the government to get a company or individual to give up keys or data than it is to get them to write the code to gather data in the first place. I'm sure there are those in government that are quite pleased that Apple and Google are doing it willingly.

donohoe 7y ago

First, you make some good points but you could have made them without rudely characterizing the author ("...but the gubment could.." etc.) Second, the author is not wrong - when you build in tracking at such a deep-level it is open to abuse. Read the authors bio, he is not a naive techie. This is an area he has strong background in and deep technical knowledge. Maybe this is the path forward, but Apple and Google appear to be rushing into this without considering the larger picture.

jmull 7y ago
It’s exactly because of the Author’s bio that I come down hard on him. He knows what he’s saying is wrong, and he knows that if the FUD he’s spreading catches on, a lot of suffering will happen that otherwise would not have. > when you build in tracking at such a deep-level it is open to abuse. True, which is why he should do an analysis of this system rather than this. He could be using his platform as an authority and presumed skills as a teacher to explain the system rather than spread misinformation.
- donohoe 7y ago
  No, what he is saying is very plausible and very likely correct. It is not mis-information. It is a well founded concern. I've been in tech long enough to know that what he is proposing is very possible. Other commenters here go into better detail than I.
  - jmull 7y ago
    Please do read comments by others. There are some good ones that go through, point by point, places where the author is wrong.

grey-area 7y ago

Also, the government already has this capability in place, they can track and bug individuals and groups via telecom networks.

stjohnswarts 7y ago
Yes but previously they would have needed a law passed to do such monitoring without a warrant, now people are just volunteering it with the drive by apple and google to publically and very openly track who you hang out with, where you're going, where you've been and then enthusiastically sharing it with the government. This is the softening up. Once covid is over in a few months or years they will be like "well look at all the good we can do, now we can use it to track all sorts of diseases, crime patterns, what you had for dinner and how that ties in with your other webs of interaction TO HELP MAKE YOU SAFER"
- grey-area 7y ago
  Is a rubber stamped warrant which allows mass surveillance really a warrant at all? How many requests has the fisa court denied? Which law allows for warrantless collection of all this data?

mpweiher 7y ago

There's quite a difference between either forcing Apple and Google to build such a feature, which seems hard, vs. just forcing them to turn an existing feature on. Same for turning such a feature on surreptitiously vs. installing such a feature surreptitiously.

jmull 7y ago
It’s not just turning something on though. This system doesn’t do what the author is talking about. It’s decentralized, opt-in, and transparent. The government would have to force Apple and Google to make it centralized, automatic, and secret. In others, force them to make a completely different platform.
- Macha 7y ago
  The other thing is lets say the government decided to bring in this system and Google/Apple didn't give any feedback. Then they just get a contractor to build an app that just broadcasts "I am Bob and I am at <location>" to nearby people and a central server. suddenly you have something way more open to abuse

baryphonic 7y ago

Exactly right. And as civil libertarian as I am, I'd rather have Google and Apple tracking my location for this prosocial cause than serving targeted ads. And it's not like Apple and Google aren't already tracking iOS and Android users anyway (albeit user-tweakable).

craigsmansion 7y ago

> There are always people who see a tragic pandemic and just see a chance to use the concern and attention to highlight their own cause You say that like it's not a PR exercise for large corporations. > the ones who fight against the efforts to mitigate the suffering There's more than a few billions floating around off-shore that could have helped establish universal healthcare and social safety programs, but just being a good corporate citizen doesn't get headlines, so let's focus on panic situations and instead sell our new slogan: "Nefarious, for good!" ("good" defined as "not as evil as a global health crisis"; disclaimers may apply)

Fnoord 7y ago

I'm not sure why you need to be so condescending in a healthy discussion like this. > This guy says, yeah, but the gubment could abuse the tracing mechanism for things besides an epidemic, force your phone to report matches centrally, and force the removal of the opt-in part of it. > ...except, if a government can pull those off, they don’t need this new contact tracing platform. These assume the government already has deep, control of the details of the operating system. If your system has one RCE, you don't care about another one because it already has one? Perhaps you can work around the one, mitigating it? Also, "the government" (any in the world) can ask Google or Apple to share the data of a suspect. As they're not a one way hash, that is possible. Furthermore, an attacker can certainly gather the Bluetooth addresses and correlate these to one way hashes. If the API is public, they can correlate these hashes and detect which Bluetooth addresses got the disease. Together with the location, even an outsider can learn more about this issue. Also, lets not forget there's recently an RCE in Bluetooth on Android (which many people still run with unpatched), and the problem of iOS not working with Bluetooth when the application isn't open on the foreground with screen open.

nunez 7y ago

I think it's only opt-in on the surface. I could see governments requiring users to be opted-into the program in order to get tested for COVID.