10 ms·
Woman stalked by sandwich server via her Covid-19 contact tracing info
- rckoepke 6y ago> [The sandwich company named] Subway required her to put her contact details on a contact-tracing form so as to place her food order. She didn’t think anything about it: we all want to stop the spread of the pandemic, after all. The form asked for her name, home address, email address and phone number, all of which she put down. I'm putting this here because some people may erroneously assume that this story is relevant to bluetooth/cellphone contact tracing.
- redis_mlc 6y ago> some people may erroneously assume that this story is relevant to bluetooth/cellphone contact tracing. Is it any better if Google, Apple and the govt will be doing the stalking?
- taneq 6y agoHopefully it's a little harder for a random Sandwich Artist to pick up your address via one of these apps than via a paper form that you fill out in front of them. That said, they have to be right in front of you to stalk you, they can't do it from California.
- opinologo 6y agoThere are also many reports about Google or Facebook employees abusing private data. In Permanent Record, Snowden explains how the NSA employees watch nudes stolen from regular citizens on a regular basis.
- pgeorgi 6y ago> many reports about Google or Facebook employees abusing private data. I'm sure you have a link or two handy?
- valuearb 6y agoThat is true but their have already been dozens of articles explaining how Apple/Google designed their contact tracing system to make it nearly impossible to be abused.
- DagAgren 6y agoYes, because they actually designed their system so that it can not be used for stalking. Go read up about it.
- dependenttypes 6y agoWell, they failed then, because it can definitely be used for stalking. Having covid and distributing your daily keys makes it much easier but not necessary.
- DagAgren 6y agoIf you have COVID you should not be distributing your daily keys, you should be staying the fuck inside.
- dependenttypes 6y agoCOVID can be asymptotic for long periods. This is the whole point for such systems to exist in the first place.
- DagAgren 6y agoYes, and you reveal your keys for the past when you are diagnosed, and then you go inside, stay inside, and do not reveal any further keys. This is not useful for stalking.
- dependenttypes 6y agoSure it is, you just need imagination. Say that you are a stalker, you (or someone delegated by you) passed near your target and got h(daykey, time), your target happens to go to the hospital for covid a while after, so you have the daykey of your target for multiple days and all of their h(day, time). You detect that it was your target that went into the hospital because one of their h(daykey, time) matches with the one that you have stored, in addition you know if your target passed nearby you/one of your friends/one of the locations where you have put some cheap bluetooth phones and the exact day and time that this happened. Intentionally infecting the target will covid will help this whole thing but it is not necessary.
- stetrain 6y agoYou should probably read up on how the Google and Apple system works. https://en.wikipedia.org/wiki/Google_/_Apple_contact_tracing_project#Technical_specification https://en.wikipedia.org/wiki/Google_/_Apple_contact_tracing... My brief understanding: - No location data is used at all - Devices get random rolling identifiers that are shared with other devices when in close range (ie contact is made) - Devices keep a list of which identifiers they came in contact with in the past - If someone tests positive, their recently used random identifiers are published, and any devices with those identifiers in their list notify the user that they may have been in contact with someone who has now tested positive. If you can devise a non-magical way that a Google, Apple, or Subway employee could use that to personally stalk someone it would be quite an interesting whitepaper.
- dredmorbius 6y agoA widely distributed Bluetooth monitoring network noting tims and places ... might ... be able to correlate secrets with other data (facial recognition, MAC, UUID, etc.,) to correlate individual with probable SARS-COV-2 exposure status. An in-location tracking system, such as numerous proposed retail monitoring systems, among othe. Given time and location, a low number of hits would likely be sufficient. This would be expensive, but likely within reason for a motivated entity. Possibly by utilising (with or without cooperation) existing infrastructure and systems.
- stetrain 6y agoIf you have a widespread Bluetooth monitoring network with centralized data you've already built your stalking system that likely works better than trying to use the Google/Apple contact tracing system.
- dredmorbius 6y agoBut you've added Covid status detection as a capability. To what net advantage is unclear. Though yes, this shows the inherent risks of pervasive surveillance systems.
- 6y ago
- creaghpatr 6y agoAdding here also that the stalking in this article was of the personal harassment nature, not 'stalking' to contact them about potential COVID exposure. It would be a nuisance to have to sign in at restaurants, especially with a physical address.
- GavinMcG 6y agoThat's what "stalking" means. I sure hope no one's expanding the term to mean "contact tracing".
- creepyHomoDad 6y agoReally? What does "pedophilia" mean?
- ardy42 6y ago> I sure hope no one's expanding the term to mean "contact tracing". I think this guy just did downthread: https://news.ycombinator.com/item?id=23179458 https://news.ycombinator.com/item?id=23179458
- dependenttypes 6y agoThis is not necessarily the case. I took it to mean that Google, Apple, and the govt all have employees, some of them rouge, just like subway.
- creaghpatr 6y agoIt confused me at first when I saw the headline.
- dontbenebby 6y ago>It would be a nuisance to have to sign in at restaurants, especially with a physical address. I have friends who carry a passport card because they've had unawanted contact from bouncers, bartenders etc. This type of incident is super common. https://en.wikipedia.org/wiki/United_States_Passport_Card#Card_layout https://en.wikipedia.org/wiki/United_States_Passport_Card#Ca...
- valuearb 6y agoThis was also in New Zealand, where it appears to be required to be collected by the law (the article is unclear but references the public health commissioner explaining how it should be used).
- robocat 6y agoMany places just require you pay by card (not cash), since that is enough to trace someone if needed. Or preorder online. Techniques vary.
- kanox 6y agoI'm disappointed that the "sandwich server" is a person who serves sandwiches.
- chrisandchris 6y agoI was here for the server-as-we-know-server and got disappointed too.
- m463 6y agoI was searching for container stuff and came across this video on crypto mining in a container: https://youtu.be/IZ_bQJM5liM https://youtu.be/IZ_bQJM5liM I was a quite a ways into the video before I slapped my forehead.
- bsd44 6y agoThink about this for a moment. There are people out there who are willing to give out their full name, home address and their phone number just so they can buy a brand name sandwich. If we are willing to trade our freedoms for convenience, perhaps an Orwellian future cannot be avoided after all.
- mrfusion 6y agoWashington state is requiring restaurants to record the info of customers. Lots of potential for abuse like this.
- kjakm 6y agoThat's insane! Why would they do that? And why would people hand that info over?
- oarsinsync 6y agoYou're not you when you're hungry.
- gambiting 6y agoBecause it's the law and majority of people obey the law. You'll get an odd person who refuses, but that's fine, they can leave if they don't want to comply. Unless majority refuses to comply, nothing will change.
- deleted 6y ago[deleted]
- ganstyles 6y agoThere's a pandemic happening right now, so I think they're doing it to track where people go and how things might be spreading. It's really helpful for analysis. I think people are handing info over because it's required to get one's order.
- pjc50 6y agoBecause getting told when you were eating at the same restaurant as someone with a contagious disease could be life-or-death information? (Mind you, I've no intention of going to restaurants until the infection rate is much lower!)
- thoraway1010 6y agoWhy not just use the double blind google / apple tech for this? The govt requiring this level of data seems unnecessary.
- greendave 6y ago> We don’t know much about the form, but it sounds like it was paper, as opposed to digital, given that Subway told Newshub that starting on Wednesday, it will have installed a new digital contact tracing system at all restaurants. That sounds great. Now instead of having to worry only about the employees at the particular restaurant, you have to worry about whether Subway has properly secured their system from everybody with internet access (including all of their employees). If the price of a Subway sandwich includes giving PII to Subway, I'll pass.
- libria 6y agoI'm sure the validation process is just "form written on". You could probably write down 867-5309 and walk out w/ your sandwich.
- deleted 6y ago[deleted]
- asdf21 6y agoIt's not like Subway wants to do this sort of extra work... it's government mandated, at least in some areas like Washington.
- gruez 6y ago>Newshub spoke with Privacy Commissioner John Edwards, who said that businesses should only be custodians of the information they’re given for public health purposes. Doing otherwise could leave the public with a strong distaste for handing over their details Is this some sort of official government program? The response by the privacy commissioner ("should") suggests that there won't be any legal consequences for businesses that misuse the data.
- valuearb 6y agoIt’s a burden the government is imposing on businesses, ideally you want a high legal bar before suing for misuse or you will create noncompliance. A rogue employee should not be one. For example, let’s assume you add a bunch of requirements to implementation, say specific encrypted terminals. Now restaurants can’t get those for months. What will they do, close? Ignore it all together? We are in a pandemic, the main focus should be collecting the contact tracing information while still feeding people. If this were to last years we can also solve all privacy concerns, but it’s really hard to do in two months.
- c22 6y agoThey already made businesses close with no recourse. Why is it crazy to require businesses to follow specific procedures if they want to re-open? Why shouldn't those procedures be designed to protect the public?
- valuearb 6y agoIt’s not crazy to have specific procedures, but think about unintended consequences. The procedures need to be achievable in the real world, not so burdensome they can’t or won’t be followed. Maybe a better example, let’s say NZ institutes a $50,000 fine per each occurrence of misuse of personal information collected per their requirements. Now a small business owner could find out they are facing a $250,000 fine and bankruptcy because of one horny employee violating their specific trading instructions. What restaurant would ever take that risk? If the government wants to force businesses to collect personal information, it better be prepared to provide secure means of collecting and communicating that information to them. And it should indemnify the businesses for any liability from release of that information that’s not willful or intentional. If the business faithfully follows the rules, punish the perpetrator, not the business owner.
- jbattle 6y agoI'd trust this system if it were double-blind. The government issues an identifier to me (separate from SSN). I feel OK giving that number to restaurants. If there is a reason to initiate contract tracing, the restaurant hands its list of identifiers over to the appropriate government agency, which cracks open its vault of identifier --> contact information Seems no less open to misinformation than the current system but gives vastly more protections to personal information. Doesn't even seem that hard to set up in the grand scheme of things.
- amlop 6y ago> The government issues an identifier to me (separate from SSN). I feel OK giving that number to restaurants. Wow, can anyone imagine reading this in the beginning of 2019? The totalitarians come out in huge numbers recently. It was once considered totalitarian to be asked at the East German border if one had any "contraband" (books or magazines that were frowned upon). Now at the U.S. border one can be asked if one has any "contraband". Next we all get a government id to pass on to private businesses. How about a "social credit" score, China style?
- mschuster91 6y ago> Next we all get a government id to pass on to private businesses. Most of the rest of the world actually has government-issued identifiers and ID cards and they don't devolve into totalitarian dumpster holes. To make it even more absurd, the lack of a proper government-issued ID scheme in the US actually leads to problems only the US has, like people opening up credit lines and siphoning large sums of money with stolen SSN+name+DOB combos.
- ac2u 6y agoI'm in the UK and we don't pass on said government ID to a plethora of private businesses so that they can turn around and hand it back to the government for tracking.
- 6y ago
- wickerman 6y agoBut here's the thing: this kind of personal data is used daily by many companies. There's a table in a bank/telco/etc where they have your full name, your ID number, your address, your age. Any worker who has access to this (thousands of people who need that kind of access to do their jobs and to provide you with services) could've done something similar. Recruiters are particularly stalkey sometimes with the way they keep calling your personal number without warning. While I don't understand if Subway really needs to share that much data with the person who makes your sub, the reality is that there's nothing privacy laws can do to stop some creep who works somewhere that deals with data from stalking one of their customers. Edit: the case might be here that Subway doesn't really need to handle that kind of PII, but that should be on principle I think. The creep using that kind of data is a bit incidental.
- thoraway1010 6y agoTemp agencies are actually the WORST. If you do hiring and they get your cell phone number you are hosed.
- newscracker 6y agoThis kind of abuse has happened even before COVID-19 and contact tracing. The issue here is not just the guise of contact tracing used to collect information. Many businesses collect customer information insidiously (sometimes with offers to win a prize or for a discount). Once they collect it (usually phone and email), all bets are off on employees misusing the information. In this case, it’s beyond anyone’s imagination as to why the home address would be collected. There was absolutely no need for that except someone who imagined it to be a well thought out solution (solution for what I don’t know).
- throwawaysea 6y agoSorry but having to share my contact info at a business is a step too far for me, and is a breach of individual liberty that I am not willing to participant in. Apart from privacy concerns like in the linked article, I think it is also the kind of normalization of authoritarian mechanisms that we just do not need. Some may call this a slippery slope fallacy, but to them I say that slippery slopes / boiling the frog are an effective way to go from a minor breach of liberty to something more dangerous, all with the public's support along the way.
- Fezzik 6y agoIt sounds like the NZ government is requiring businesses to do this, without much guidance as to how businesses do it, so that seems like error #1. Or am I misunderstanding? The article mentions Subway is moving to a secure computer system to retain the information... that does not seem much better.