2 ms·

> The same people who are building useless junk that nobody uses absolutely could be building tools, like the one I worked on years back, that actually empower

by usrusr 6y ago

> The same people who are building useless junk that nobody uses absolutely could be building tools, like the one I worked on years back, that actually empower clinicians and public health workers to produce datasets susceptible to useful analysis. I disagree: the last thing we need right now is giving the impression that manual contact tracers are building extensive shadow profile databases. Which can be misused to any number of harmful ends. Unfortunately many people would happily focus only on that, promoting the idea that . And they wouldn't even be entirely wrong about it, as illustrated by dozens of cases in supposedly privacy-sensitive Germany where police has been accessing even the most innocuous form of manual contact tracing datasets, paper attendance lists held offline at restaurants. Decentralized rolling beacon tracing is orders of magnitude more frugal with PII. And yes, it's still no substitute for manual tracing. Just like manual tracing isn't a substitute for beacon exposure (and yes, this wouldn't be true at all if we were talking about STD).

throwanem 6y ago
You're not wrong about the perceived and actual risk of real, high-quality, contact tracing data falling into untrustworthy hands - in this context very much including those of police; where on Earth did you get the idea I had suggested their involvement in contact tracing work? I said "clinicians and public health officials"; I did not say "cops". Before being allowed to even access the code, much less the data, for the STI project, I did a week's training on HIPAA and related regulation whose acronyms I've since forgotten, both in the large and in specifically how I could and could not treat patient data and remain in compliance. At no other point in my career, which aside from that one role has been entirely in industry and outside academia, have I received any training on safe handling of PII. The closest anyone ever bothers to come is PCI, which is both not directly related and, as anyone who's ever done it knows, a total joke of a requirement honored entirely in the breach and directed solely at deflecting liability. Which is why our industry has such a shit record with data security, and why the academic institution where I previously worked has had, to the best of my knowledge, exactly one patient data leak in at least the last ten years - and that one was last month. All of that goes to trust, and trust is a major part of why I emphasized the specific and ongoing effort of providing free sexual health services in my initial comment. Such activity builds significant trust between the research group and the population whose behavior is under study, and that kind of trust is required to get worthwhile data. Don't assume that need for trust only exists in the context of STI tracing among vulnerable communities, either - even your own offhand comment, about "oh by the way" and a sex worker, goes very much to the heart of what I'm saying. If I've engaged the services of such a person, but I'm not willing to mention that to whoever's interviewing me, then the resulting graph will be missing what may prove to be a highly consequential edge. If I am such a person, and likewise decline to disclose, the graph will miss a lot of such edges. That's why it matters to put in the work of building trust, and that's not something that any app - or, given its extremely sketchy history with PII protection, our entire industry - is able alone to do. That takes people, doing the work, over a sizable span of time. We haven't had that here in the US, so we were never going to make contact tracing work for this pandemic no matter what else happened. But we might still have a chance to make it work in the next one. If we do, though, it won't be because some Silicon Valley huckster came up with "Facebook for coronaviruses". It'll be because we got it together and did the work. The ecosystem of Silicon Valley hucksters and their enabling VC parasites has no place in that process. Some of the people involved might; there is a role for good, careful, thoughtful engineers, if they're willing to stop wasting their lives on lottery tickets and start doing work that might actually count for something. Unfortunately, the incentives of the moment remain all in favor of lottery tickets. But I see no reason why that can't, or shouldn't, change. And in the meantime, the very least I can do is explain to people why this isn't at all the simple problem they imagine it to be.

by usrusr 6y ago

throwanem 6y ago

You're not wrong about the perceived and actual risk of real, high-quality, contact tracing data falling into untrustworthy hands - in this context very much including those of police; where on Earth did you get the idea I had suggested their involvement in contact tracing work? I said "clinicians and public health officials"; I did not say "cops". Before being allowed to even access the code, much less the data, for the STI project, I did a week's training on HIPAA and related regulation whose acronyms I've since forgotten, both in the large and in specifically how I could and could not treat patient data and remain in compliance. At no other point in my career, which aside from that one role has been entirely in industry and outside academia, have I received any training on safe handling of PII. The closest anyone ever bothers to come is PCI, which is both not directly related and, as anyone who's ever done it knows, a total joke of a requirement honored entirely in the breach and directed solely at deflecting liability. Which is why our industry has such a shit record with data security, and why the academic institution where I previously worked has had, to the best of my knowledge, exactly one patient data leak in at least the last ten years - and that one was last month. All of that goes to trust, and trust is a major part of why I emphasized the specific and ongoing effort of providing free sexual health services in my initial comment. Such activity builds significant trust between the research group and the population whose behavior is under study, and that kind of trust is required to get worthwhile data. Don't assume that need for trust only exists in the context of STI tracing among vulnerable communities, either - even your own offhand comment, about "oh by the way" and a sex worker, goes very much to the heart of what I'm saying. If I've engaged the services of such a person, but I'm not willing to mention that to whoever's interviewing me, then the resulting graph will be missing what may prove to be a highly consequential edge. If I am such a person, and likewise decline to disclose, the graph will miss a lot of such edges. That's why it matters to put in the work of building trust, and that's not something that any app - or, given its extremely sketchy history with PII protection, our entire industry - is able alone to do. That takes people, doing the work, over a sizable span of time. We haven't had that here in the US, so we were never going to make contact tracing work for this pandemic no matter what else happened. But we might still have a chance to make it work in the next one. If we do, though, it won't be because some Silicon Valley huckster came up with "Facebook for coronaviruses". It'll be because we got it together and did the work. The ecosystem of Silicon Valley hucksters and their enabling VC parasites has no place in that process. Some of the people involved might; there is a role for good, careful, thoughtful engineers, if they're willing to stop wasting their lives on lottery tickets and start doing work that might actually count for something. Unfortunately, the incentives of the moment remain all in favor of lottery tickets. But I see no reason why that can't, or shouldn't, change. And in the meantime, the very least I can do is explain to people why this isn't at all the simple problem they imagine it to be.