It's kind of far down in the page so I missed it the first time I scanned it.
"We are working around the clock to finalise our protocol reference documents and reference implementation, to open source what we have built, so that others may deploy their own flavours of TraceTogether - each implementing the BlueTrace protocol. We appreciate your patience in the meantime."
If this gets any sort of public traction it'll be built in to shop doorways, public transport, police cars, and street lights within a couple of months.
Yeah, in a new york minute. This is already built into iOS in their newer Find My Phone. The carriers also know who and where we are just need to add in covid testing data. The problem is that even if it is decentralized and OSS, then the average user can't/won't install it. If it is simple and easy (centralized), then it becomes a honey pot for the government.
You can't, but apparently Find My Phone uses Bluetooth to find nearby phones and thats the same technology that Bluetooth contact tracing for coronavirus would use.
Sadly this won't happen in the US. Even if it's really private, people won't install it unless it's pushed down to them as an update from above, and no company will want to be the first to push it.
I suspect the bigger issue is people don't want to be told by an app that they need to go get tested.
Come to think of it, cities like New York could push it as part of a bigger, more comprehensive covid app...
I'm curious as a non-expert what's specifically worrying about their privacy model?
My intuition is that rapid adoption of a relatively transparent privacy-preseving option could preempt more heavy-handed approaches to what could be a very valuable public health intervention.
I'd agree if remote tracking was the only option, and if there was a guaranteed policy against public backslash towards those that don't comply out of privacy reasons (which would skyrocket in a health hazard emergency).
These privacy exceptions all affected goverments are talking about (Italy being a great example, viz. Veneto region governor asking for a change in privacy laws the other day) are not going to magically disappear once the coast is clear, just like post 9/11 emergency laws still being used in the US.
I believe there are other ways to help people and that, if you are a government that claims having to resort to remote control its popoulation, maybe your power is either insufficient for your secret expansion goals or you're an inefficient populist.
Every (western) government publicly hates the Chinese government but they do seem to have wet dreams about the population control bit, especially when backed by corporations.
Exactly. People are decrying this because it gives governments capabilities, as if decrying its existence changes that capability model or implies that in the absence of this tool and in a state of emergency, governments wouldn't be stuck trying to accomplish the same goals this tool enables using cruder methods that would be more intrusive to people's lives.
It's like hating gunpowder exists because people can make bullets and fight wars with it.
We all carry around a radio that broadcasts our location. I guess we'll end up switching off Bluetooth except to known good devices, or when we intentionally want to discover what's around us.
I don't know, I'd probably turn mine on just so that I can get notified if I am within proximity of a high infection risk stranger. I would love to have that kind of notification.
I can imagine something like that could lead to people abusing, beating up or killing the infected. It might sound far-fetched, but this was happening in Kenya quite recently.
This is needlessly cynical. TraceTogether uses client-side logging so as to leave data in the hands of the users up until it's actually needed for contact tracing.
Would you suggest that we not have public health departments engage in contact tracing at all to combat the pandemic? If so, I'm not sure what to tell you.
Otherwise, apps may go a long way to improve the speed and accuracy of contact tracing. Here in the US, I'd much rather use a protocol like TraceTogether's Bluetrace that goes out of its way to preserve privacy, than adopt an actually-privacy-violating centralized approach where the government simply gathers everyone's location data and processes it centrally (Israel's approach, for example).
Would you suggest that we not have public health departments engage in contact tracing at all to combat the pandemic? If so, I'm not sure what to tell you.
If the result is (another) permanent loss of privacy and freedom akin to the PATRIOT act, then yes.
Technology has immense power to do good for people, but only if those who deploy it do so ethically. How many governments around the world can we honestly predict to do so?
I'm curious how many people who now say "give me privacy or give me death!" will change their tune in a hurry once they are themselves, perhaps for the first time in their lives, in real danger of dying.
I regret that - assuming my own ongoing case of COVID-19 resolves without fatal complication - I'm quite likely, I think, to have that curiosity satisfied. I regret it because this isn't a cause for change of perspective which I would wish on anyone. But everything I'm seeing suggests it's a cause for change of perspective that many millions of people are going to have.
My hope is that people don't lose sight of the long term in spite of the short term suffering we may experience. You can only surrender your rights once, the effects of losing those rights will last forever. How many movements would have been impossible if a local government could spy on everyone to break it up before it even begins? I'm thankful we didn't have the same technology we have now during the civil rights movement, for example.
Put another way, would you want your children to live in a world where their government abused and spied on them? Borrowing from the future seems free at the time, but the true cost can be enormous. Everyone has to make their own value judgment, but I fall on the side of protecting the freedoms of people now and in the future. If people in the future choose differently for themselves, that will be their choice when their time comes.
Of course, 'you can only surrender your rights once' and 'you can only die once' aren't equivalent either. Once a nation of people surrenders their rights, nobody ever has those rights again (even if the loss of those rights costs lives). A person, or a group of people, becoming ill or passing away doesn't take away the lives of the next generation.
If you think back on the experiences of the last century, how much harm would be done if we couldn't freely assemble because a government decided to intervene? We'd have stayed in Vietnam longer, black folks may not have ever won their civil rights, and its possible women would be unable to vote.
For the record, I don't downplay the suffering of illness. I've lost a parent to cancer, as well as many other family members. Everyone else alive is in the same boat. We're all mortal.
Cancer isn't like a pandemic. Cancer multiply within a body; pathogens multiply within societies.
I disagree with "you can only surrender your rights once"; unlike life, rights can be won back. There's plenty of places on the planet in which you couldn't freely speak or assemble just a couple decades ago, but now you can. Things aren't going monotonically from bad to worse (though I admit, there's a strong directional pressure here; maintaining rights feels like fighting entropy).
I am a parent, I want my child to live in a world where the government doesn't abuse and spy on them, but where that government is also capable of containing an infectious pathogen (whether natural or purpose-made) pretty much as soon as it registers. There is a practical balance to be found there.
(And if we're trading imaginary worlds: I want my child to live in a world where private entities don't spy on them and sell private information, a world where adtech doesn't exist.)
I'm curious how many people who now say "give me privacy or give me death!" will change their tune in a hurry once they are themselves, perhaps for the first time in their lives, in real danger of dying.
The weak ones we shouldn't be prioritizing over the strong. Harboring weakness is just asking to be taken advantage of. It may seem empathetic at first, but all you end up doing is undermining the individuals growth and selling out the security of future generations. If you're an adult, you need to come to terms with death, and recognize that extending your life isn't worth stealing from future generations. They deserve more freedom than we've had. Not less.
It's a mercy you won't be held to this when you get sick, and find it's somewhat easier to talk in the abstract about coming to terms with death than to face the imminent possibility.
edit: Well, you won't be held to it assuming we haven't reached a need for sufficiently severe triage, I suppose. Otherwise, you might get a chance to quite literally put your life on the line for the principle you've just espoused! I wish you joy of it.
All the soldiers, firefighters, and doctors/nurses/EMTs (and many more) are putting their lives on the line for what they believe in. Some of them believe in the constitution and some of them simply desire to help their fellow man. Not everyone is so weak that they sell out others for their own benefit, and assuming the worst of others only serves to expose your values, or lack thereof.
I wish you joy of it.
That was straight-up evil. Whatever empathy and respect you may have had just went out the window. I'm almost in disbelief that you would edit your post just to literally wish someone the "joy" of having a chance to die.
Please don't post in the flamewar style to HN. You've done it repeatedly in this thread. That's not ok, regardless of how wrong or bad another comment is, or you feel it is.
It's a mercy you won't be held to this when you get sick, and find it's somewhat easier to talk in the abstract about coming to terms with death than to face the imminent possibility.
It's unfortunate that you're a coward.
Death is not something to fear, and with a stock of strong pain killers neither is dying.
Sure, assuming you have the good fortune to choose your manner of dying. I wouldn't feel very comfortable making that kind of assumption. But I concede it's easier to sling accusations of cowardice than to think seriously about drowning slowly and helplessly in the fluids of your own destroyed lungs.
Congratulations on having gotten over this pandemic virus. Good luck with the next one!
Reflecting on how my relationship with death has varied with my life experiences, I don't think you know enough about his particular experience to call him a coward.
I'm curious how many people who now say "give me privacy or give me death!" will change their tune in a hurry once they are themselves, perhaps for the first time in their lives, in real danger of dying.
Agree to disagree, because my liberty is useless without my life.
Balance can be found. And increasingly, it looks like in the modern era, the balance is found in a situation where the PATRIOT act exists and we find a new normal around its existence.
Which government of more than a few million people do you assume doesn't have a line into monitoring intra- and interstate digital communications in this era?
Cynical for sure, don't know about that "needlessly" given it's an endless fight where everytime you give up a right it's taken away forever. This time they give you the opensource bit, next time it's "a matter of emergency", then they stop asking and just punish you if you don't comply.
Would you suggest that we not have public health departments engage in contact tracing at all to combat the pandemic? If so, I'm not sure what to tell you.
I have never said that so I am not sure what to tell you. The only method that works is quarantine, remote control is a copout to address the lack of contact with the population. Moreover, what I am addressing is how the tracking is NEVER going to go away even after the emergency is gone.
Israel's approach for example
On this topic, Israel tech companies are right now sending out business proposals to the Italian government to try and implement their methods (viz. https://www.ilgazzettino.it/nordest/primopiano/coronavirus_z... last thing Europe needs during this crysis is ANOTHER political mindset shift towards walls and a iron boot.
The point of contact tracing is to find out who to quarantine, so you don’t have to lock down the entire population. It’s not a “copout,” it’s the bread and butter of epidemic mitigation. It’s why most of them don’t get to this point.
But "stay at home" has been a mantra for weeks anyway, with everybody acting as if they and everyone else is infected.[..] But we are at this point already.
Singapore isn't. (the government that is building this app). Neither is Taiwan. Through a combination of contact tracing, surveillance, national health databases and enforcing compliance of quarantined individuals by for example regularly checking in on them they have been able to both contain the spread of the disease and keep a reasonable amount of economic and social life intact.
I will continue to be mystified by this weird and abstract notion of privacy that keeps others away from my data but results in mass lockdown, quarantines, shutdowns and curfews, while people in Singapore give some data to authorities and they can still go out and live their lives. I want material freedom to buy groceries and go to work, not some sort of religious dogmatic privacy while some plague wreaks havoc and I need to haul up in my apartment for months.
Even without that, Taiwan, Singapore, and South Korea all have a no joke civil service. Them being able to come up with something in the time of crisis fast is a consequence of that, not the other way around.
Even if one or two piecemeal measures like that were to be implemented, it will not change the fact of terrific ineptitude of current, and few previous office holders.
Without fixing that first, you will never get to the level of trust needed for the society to function, and not to fall apart upon first serious crisis.
In comparison to East Asia, North America is a very uneventful place, where the apparatus of state has not been truly stress tested in decades. For every Katrina USA had, countries in Asia have like 20, and having non-idiots in the office is much more of an existential need.
Even in a patently broken country like PRC, it's the response to natural disasters which is the only thing that really tickles the CPC when it comes to public anger.
I find it pathetic that people wail to the high heavens about this abstract concept of privacy you mention and pensively quote Benjamin Franklin, while clicking away all their most intimate shit to check out some stupid Facebook game.
Get your priorities right: “you won’t believe...” clickbait no. Contact tracing to stop a disease that turns your lungs to frothy blood-juice. Fuck yes
while clicking away all their most intimate shit to check out some stupid Facebook game.
That doesn't describe me, that describes the straw man your require to be at ease with your own choices, which in turn is the only signal in your comment.
I will continue to be mystified ... people in Singapore give some data to authorities and they can still go out and live their lives. I want material freedom ... not some sort of religious dogmatic privacy ...
For what it's worth, I think open source, opt-in, decentralized, user controlled contact tracing such as that being discussed above is about as good a solution as we can hope for in such a situation.
That being said, I think you've completely failed to understand why some people respond the way they do. Their concerns aren't about freedom in the short term, but rather civil liberties in the long term. Quarantines will necessarily be lifted, but government surveillance has a nasty tendency not to go away. More generally, civil liberties are permanently lost with a disturbing consistency no matter how temporary the original intent.
Nobody out there is either fully informed or perfectly rational, so it's important to understand the underlying motivations behind other's viewpoints if you want to get anywhere. I'm certainly dissatisfied by the incredible ineptitude the US has displayed, but I also value my civil liberties highly and wouldn't want to live in Taiwan. Make of that what you will.
Their concerns aren't about freedom in the short term, but rather civil liberties in the long term.
What's interesting to me is that with the right institutions, surveillance does not actually even diminish one's right to qualified privacy.
It can be illegal to use identifiable data for various purposes, or illegal to use identifiable data in a non-fiduciary manner.
With respect to abuses of the surveillance power, it can be employed against those in power as well, to prevent abuses of their power. e.g. police bodycam can work against abusive police if the laws should support it.
So it's important to see surveillance as a sword that needs proper laws to use responsibly, that allows a society with proper laws to obtain better freedom from actual harm and also a better quality of life. If we should just bury our heads as the technology materializes, the abusers will be the ones to exploit surveillance infrastructure.
In cautionary tales like Nineteen-Eighty-Four, Brave New World, or in the design of the Panopticon, the surveillance power was in the hands of a large power, not themselves held accountable by surveillance. But with the right laws, a citizenry can hold a government accountable and limit government and powerful offices by surveillance. These tales fail to see the how surveillance can help strengthen egalitarian institutions. They were more concerned with demonstrating just how powerful surveillance is, a reasonable point, than with how it could be employed to reinforce egalitarian institutions.
That doesn't mean we have to be forever. Extreme distancing / lockdown will be needed to get the outbreaks under control, but once that point is reached, extensive testing and contact tracing will be needed to relax those measures without triggering a massive resurgence, unless we want to wait a year or more for a vaccine.
But "stay at home" has been a mantra for weeks anyway, with everybody acting as if they and everyone else is infected.
That's because every single Western country has fucked up the handling of initial stages of the pandemic. Everyone has seen what's going on in China and then Italy, and we all ended up on the spectrum of doing too little, too late (US in particular is leading here).
"Stay at home", social distancing, closing up businesses - those are suppression strategies. They're meant to shut the virus spread down. But they don't have to last all the way until the vaccine - if the number of cases and infection rate go down enough, these measures can be lifted - and then contact tracing can be used to do local quarantines and shutdowns with surgical precision, ensuring most people can live their daily lives as if no pandemic was happening.
Stay at home is the mantra, but because there is zero enforcement of it, there's no shortage of stupid people coughing in grocery stores, or visiting out-of-state relatives, or fleeing the epidemic centers, bringing the virus into rural communities.
Lockdown buys time to introduce new measures. Those measures are:
1. Quarantining positive individuals.
2. Physically enforcing that quarantine. The honor system doesn't work. People are very clearly not obeying voluntary quarantine.
3. Contact tracing, and testing of everyone that positive individuals have interacted with.
Once we get a system that can handle 1, 2, and 3 in place, we can lift the lockdown. This is how Korea and Singapore are beating the virus. This is how China's going to be lifting their lockdown.
Wasn't the same said after 9/11 and the patriot act? I'd guess it was just a tin foil hat conspiracy to think several three letter agencies would use the provisions from the patriot act to track pretty much all communications? You can't just accuse people of being conspiracy theorists over and over again and tell them that this time would be different because... Reasons? Also, who needs martial law when you can just do the same with duly passed laws?
There is no right to fly. There was a right to privacy (at least as argued before the supreme court) and I think it could be said that is revoked because of the three-letter-agencies data collection that was justified by 9/11.
I'd guess it was just a tin foil hat conspiracy to think several three letter agencies would use the provisions from the patriot act to track pretty much all communications?
It was and still is. How do you believe this nonsense?
Also, several provisions from the Patriot Act haven't been renewed, so your example proves my point.
Sorry, but we are long past the point of calling out privacy advocates as "tinfoil hat wearers" - just look at everything that came out after Snowden. Beforehand, most people would have derided others for mentioning "such conspiracy nonsense" (I likely would have myself), and yet the truth was wilder than even hard-core, paranoid conspiracy theorists could have dreamt up.
Since 9/11 in particular, the Western world has seen constant attempts to increase mass surveillance, lower the burden of proof, and dampen human rights, always in the name of whatever they have the public most fearful of at the time - drugs, terrorists, paedos, criminals, the Russians, the Chinese, the Mexicans, communists, Islam, foreigners taking our jobs, the boogey man de jour.
I'm absolutely certain that we'll see politicians try to use coronavirus as an excuse for their Orwellian schemes.
Business as usual has come after Snowden; that's the reason people who have a default-antagonistic reaction to any new technology that could be employed by a government for tracking get labeled "tinfoil-hat wearers."
The future of society isn't no surveillance. That's not tractable. Genie's out of the bottle (as this release of a population tracking tool as open source demonstrates). The question isn't how to stop it; it's how to live with it.
I can't disagree with that; honestly, it felt like the media and politicians conspired to bury it. Revelation after revelation was made after outlets like The Intercept went through the evidence, yet hardly anything made the mainstream news, and when it did, it was fleeting. The CIA destroyed evidence and lied to congress, but there was little impact.
The question isn't how to stop it; it's how to live with it
This I disagree with. We've been shown that the supposedly "benevolent" Western governments of today can't be trusted with laws that permit over-arching mass surveillance and the dampening of civil liberties and human rights, and we've seen the inevitable creeping escalations - who knows what a worse government of tomorrow might do?
I don't think the issue went away because anyone conspired to bury it. I think the issue went away because, on average, Americans are comfortable with the arrangement that the intelligence agencies have broad power to dragnet data. They either don't get that these tools could be used against them by unethical government agents or they know that possibility exists but they trust the checks and balances against it and think the risk is outweighed by the benefit to law enforcement and the national intelligence community in managing the international threat of global terrorist activity (which, itself, leverages modern communications tools to communicate rapidly, move rapidlt, hide from law enforcement and military powers, etc.).
9/11 was an avoidable attack and a failure of information analysis; the information needed to stop it existed but had not been consolidated. A lot of Americans are extremely disinterested in bring attacked that way again, even 20 years later.
How do you propose a XXI-century technologically advanced society can do to ensure its biosafety? The current pandemic is force majeure, the next one might be accidental, the one after that purposeful. Advancement of science and technology in large parts means making more and more potentially destructive power available to individuals and small groups. Society needs a defense to compensate. Biology is particularly nasty here, as it's self-replicating.
Quite honestly, I'm increasingly starting to believe that privacy has been on borrowed time ever since we discovered DNA. That doesn't mean all privacy is going to be gone; just that to survive, societies need to learn how to handle pandemics very swiftly, and that seems to require large-scale, real-time management.
Moreover, what I am addressing is how the tracking is NEVER going to go away even after the emergency is gone.
Wouldn’t people just stop using any tracking applications once there is no tracking needed?
The way I see it is so long as there is a pandemic we have no freedom anyway. It might seem like tracking your citizens is infringing a freedom, but if the option is house arrest I don’t mind.
Any government that would be ready to monitor everyone all the time for no obvious reason isn’t democratic. I trust my government because I live in a functioning democracy. I wouldn’t trust the Chinese government, or even the Hungarian one, and I‘d have second thoughts about trusting the US govt to do the right thing. But most democracies should be able to use technology to provide more freedom in this situation, not less.
It’s a true test of a democracy to do this right. But not trying of fear of a perpetual big brother society I think is the wrong choice.
Wouldn’t people just stop using any tracking applications once there is no tracking needed?
There's a risk that once the capacity is tried and tested, governments and private companies alike will try to make it enticing and useful for different means. The role of privacy activists should be nipping all these follow-up ideas in the bud. Ensuring that emergency measures are used only during actual emergencies. But not fighting them in situations like this.
I completely agree. To that end, it actually seems like fully decentralized client side contract tracking would be a useful technology to have a set of government supported open specifications for. Building the functionality into the OS, securely encrypting (no key escrow!) with a user supplied password, and requiring a warrant to seize (but good luck without the password) would proactively enable a robust response to future pandemics.
Actually I suppose this matches my view on location histories. I like them as an idea, but current implementations exfiltrate all the data off of my device which bothers me to no end.
I share the feeling. I want my phone to collect data about me and my environment. But I want to own that data and use it for myself, not have it sent out to some third parties.
Literally nobody in the epi community believes that. Would you please state your credentials, or cite a credible source for that statement? (For the opposite, please do read takes from Trevor Bedford, Mark Lipsitch, Carl Bergstrom, Andy Slavitt or really pretty much anybody in the field)
We (the US) are currently in a state were suppression is the only prudent tool. As SK has shown, contact tracing & testing help a lot once you're not completely inundated by cases (and actually have a meaningful supply of equipment)
Yes, there are privacy concerns. Work on them. Address them. But blanket statements like "only quarantine works" are extremely detrimental to public health efforts - the last thing you want is an "all or nothing" mindset
We (the US) are currently in a state were suppression is the only prudent tool
How do you know that this is the current state?
As SK has shown, contact tracing & testing help a lot once you're not completely inundated by cases (and actually have a meaningful supply of equipment)
"meaningful supply of equipment" means this option is not possible in the US?
Look at the number of cases and their regional distribution, realize that those are tested cases and thus, with a) asymptomatic carriers and b) really bad testing in the US, the number of active cases is at least 10x that. Then realize you're dealing with an exponential process. United States are thoroughly infected already.
"meaningful supply of equipment" means this option is not possible in the US?
Not now, but if and when the US implements proper suppression measures, and the number of cases goes down to manageable levels (while at the same time the supply chain of PPE catches up to demand), then the supply of equipment will be meaningful.
I guess i misunderstood surpression. Thought surpression is the early stages and not when you have been thouroughly infected already.
"meaningful supply" was in the context of avoiding a lockdown and hence i don't undrestand your answer. if you don't have the equipment now, how do you avoid the lockdown and make the levels go down without large quantities of dead people?
I'm not an epidemiologist, or an MD, so with a large grain of salt:
Containment: Testing & contact tracing - you try to contain the disease before it widely spreads. Usually one of the early stages of fighting.
Mitigation: You can't contain any more, and you're trying to slow down the progress to avoid a large peak. Test & treat those with severe symptoms, encourage people with mild symptoms to stay home, encourage people to keep distance.
Suppression: Things have hit the fan. You need to drastically halt the progress of the epidemic. This is shelter-in-place, lockdown, quarantine etc. #staythefuckhome has become a bit more mandatory. That's pretty much where we are right now. You want to drastically reduce the number of infections in a short amount of time.
"Meaningful supply" was in the context of suppression actually taking hold. At some point, you're hopefully down to illness levels where containment or mitigation make sense again. But for that to happen, you need tests, you need PPE, you need infrastructure so you actually can contain. We're at suppression/lockdown because we failed at that the first time round.
So, it's not about avoiding the lockdown now.
The goal is lockdown now to prevent catastrophic overload and buy time to get supplies in place for later containment stages.
Hope that clarifies?
But, of course, containment is not guaranteed to work, so we might be cycling back and forth between those measures
Israel already moved from a central system to a different one called Hamagen which is not centralised and keeps the privacy of the people. This is the one they recommend for Italy. It is open source so you can verify it yourself.
https://github.com/MohGovIL/hamagen-react-native
Would you suggest that we not have public health departments engage in contact tracing at all to combat the pandemic? If so, I'm not sure what to tell you.
It's fine, but as Jean Yang pointed out on Twitter, no-one would ordinarily call disclosing everyone you'd shared a location with over weeks "privacy-preserving". And once you've done it for some large fraction of infected people, you end up with a country-wide social graph built up, even though you weren't conducting mass surveillance in the usual meaning.
It's a loss of privacy either way (whether done via location or Bluetooth contact). I'd rather just have the conversation about how we've decided to suspend physical metadata privacy to combat the pandemic, than act like the Singapore model is going to preserve it.
This is much better than tracking people via facial and video recognition captured with near-omnipresent camera feeds. This is tracking signals that an optional device optionally broadcasts (and has for years). You can easily avoid this tracking by not having your phone broadcast bluetooth or by not carrying a phone.
Not to mention any number of actors could have already been tracking this signal for years. It's the nature of how bluetooth devices broadcast their presence.
"Never let a serious crisis go to waste" - Rahm Emanuel.
I agree with this and your sentiment, but I think it is misplaced in this instance.
As I understand it, the TraceTogether app collects (and stores locally), information on other users running the TraceTogether app nearby. If our government's contact tracers contact us, we can provide the information, and it can help in contact tracing. This seems to me to be at or near the minimum amount of information collection necessary to fulfil the function. Assuming voluntary widespread adoption, it is useful, and can be uninstalled at any time once the crisis blows over.
You can still turn it off by heading to settings and turning it off there (both WiFi and Bluetooth).
It turns the functionality off completely, and stays off until you manually turn it back on.
In control centre it only partially turns off. But that’s not unreasonable as many people don’t understand how many feature rely on Bluetooth. They would probably get annoyed when the stop working, just because they wanted to quickly disconnect some headphones.
That’s tricky without building a phone yourself from opensource hardware and software.
At least with Apple, they’re under so much scrutiny you can be fairly confident that if their software was lying it would quickly appear in the news.
Finally the above clearly shows that your assertion you can’t turn off the WiFi or Bluetooth radios is false (assuming the software isn’t outright lying, if think that then you should have said so in your first comment).
That's an old principle, and it is, unfortunately, still true. It all depends on where you want to put the trust slider, but push it far enough in the conservative direction and, yes, you enter "build your own machine from scratch" territory.
How do you know the hardware you use doesn't have a microdot that can bypass the monitoring logic and physically manipulate the radio without the OS's consent?
How do you know the software you're running doesn't embed its own bluetooth stack and use a 0-day exploit to gain physical control over the radio?
Oh, you compiled it yourself? With whose compiler? Are you sure that compiler faithfully adheres to the spec of the language and doesn't know how to embed a bluetooth stack that, etc.
Push the paranoia slider far enough, and you end up having to care about all this stuff.
Honestly, as both a free software and privacy advocate... yeah. If contact tracing significantly improves our ability to eliminate the epidemic, and my current understanding is that it does, this seems like a pretty good implementation. So long as the data collection is explicitly voluntary, I'm asked for my permission first, and it's for an important cause like this one... I really don't mind!
I would much rather have a system like this than to be indiscriminately tracked and lose more privacy potentially indefinitely. The tracking can't be indefinite if I'm asked for permission, because if I don't think there's good reason for it I'll just say no. And if I'm worried the app's privacy measures aren't good enough and it'll be abused, I'll just uninstall it.
What data is collected? Are you able to see my personal data?
The only data that we collect is your mobile number, so that MOH can contact you more quickly if you were in close proximity to a COVID-19 case.
With your consent, TraceTogether exchanges Bluetooth proximity data with nearby phones running the same app. However, this data is anonymised and encrypted, and does not reveal your identity or the other person's identity. Also, this data is stored only on the user’s phone. Should MOH need the data for contact tracing, they will seek your consent to share it with them.
I think in these extraordinary times, it’s nice to see the government proactively trying to do more to counteract the worst pandemic the country has ever seen. As much as we might all cry foul over the curtailing of freedom, there is a lot to be said in this current environment about contact tracers immediately knowing who a known covid carrier has come in contact with, which in turn means a speedier response from the medical teams.
That being said though, the app is absolute garbage on iPhone. Obviously not really their fault, but needing to have the app actively on for it to work is absolutely going to lead to people not bothering to turning it on.
I agree this is bad, but I don't understand why it is. Not an iOS developer but I was under the impression apps can run in the background to maintain Bluetooth connections.
Assuming Apple's policies are in fact preventing them from running in the background, does Apple have a mechanism to grant them an exception for this use case? Does someone have a contact at Apple who could reach out to them?
I feel like this would be a lot easier and have a higher rate of usage/compliance if our tech companies actually worked with people to release or opt-into sharing this information for when it's necessary (information which is already secretly shared with governments for security).
For the majority of people if they go to https://www.google.com/maps/timeline they'll have a tracker of everywhere they've visited and the time they were in each location.
If you could take people's accounts who've been infected and give them the ability to opt-into sharing this information you could have a pretty good source of information about the locations where they dwelled for long periods of time and who should go into self-isolation.
I don’t in my case because I’m not comfortable with the commercial information that gives Google.
One of the gestures I think Google could make in this fight is to allow people to opt into that data sharing on a strictly limited basis. I’d opt in if it was only going to be provided for the purposes of medical infection contact tracing while this pandemic is rife.
I don't think anyone trusts Google enough. They can help by providing governments with anonymized data they already have. Immediately what comes to mind is identifying to governments public hot spots while lockdowns are supposed to be going on so that they can send people to disperse the gatherings. I'm sure people can come up with better ideas
As I understand, contact tracking is recording which people come into proximity so that if one gets sick the task of contact tracing can be facilitated by the contract tracking data.
Once you have an identified case, you trace who they have been in close contact with recently and start contacting/testing/isolating them and trace it further from there
E.g. In Switzerland this was done manually (by medical staff mostly i think) in the very beginning, but they gave up very quickly on it because of lack of resources.
For context, Singapore has a team of 20 that can call contacts of confirmed cases, they are able to make 4000 calls a day. Those in contact with confirmed cases are made to a mandatory home quarantine, i think something like 35k people in Singapore are currently serving home quarantines.
It should be opt-in, if you don't opt-in,mandatory quara tine for you. And this should not be something they can renew after the crisis like the US Patriot act.
It is not a mobile app. You export your data from Google (thanks GDPR!), and filter out personally identifiable data points before submitting. We also let you know exactly who is about to use your donated data (we only allow academic researchers to have access), and give you advance notice so you can delete it if you don’t want your data to be used in a particular project.
We are MIT licensed and are figuring out how to make data donation safe via UX and engineering. We need all the help we can get - even if it’s just feedback. Feel reach out! Nessup@gmail.com
It's kind of far down in the page so I missed it the first time I scanned it.
"We are working around the clock to finalise our protocol reference documents and reference implementation, to open source what we have built, so that others may deploy their own flavours of TraceTogether - each implementing the BlueTrace protocol. We appreciate your patience in the meantime."
Lots of neat descriptions on the page. Can't wait to see the reference documents.
If this gets any sort of public traction it'll be built in to shop doorways, public transport, police cars, and street lights within a couple of months.
You can use changing IDs and publish ID history (or ID generator seed) for confirmed cases.
Yeah, in a new york minute. This is already built into iOS in their newer Find My Phone. The carriers also know who and where we are just need to add in covid testing data. The problem is that even if it is decentralized and OSS, then the average user can't/won't install it. If it is simple and easy (centralized), then it becomes a honey pot for the government.
Carriers know where we are, are you referring to triangulation?
Yeah, they know what towers you are hitting.
Tower info plus other sources. A while back I couldn't stop my iPhone from connecting to the 'free' Orange WiFi at my mall.
Since signal is weak I enabled 'WiFi calling' which also shares location info with the carrier (so they know if you are roaming or not, presumably).
Can you please explain or give a link, how can I use Find My Phone for anything coronavirus-related?
You can't, but apparently Find My Phone uses Bluetooth to find nearby phones and thats the same technology that Bluetooth contact tracing for coronavirus would use.
I was under the impression many private sector companies have already deployed these tools.
Just a matter of companies buying/implementing them.
Yes, visit tracking has been around for years. Here is one product (https://support.google.com/google-ads/answer/6100636?hl=en), I assume there are many more.
I guess it's not more well-known because it's not in the stores interests to publicize it.
Any idea how it works? The site is not very helpful in that manner.
Probably the same way that Google Maps traffic or “this restaurant is busy now” indications work.
Presumably using Bluetooth beacons.
https://en.wikipedia.org/wiki/Bluetooth_low_energy_beacon
Would like to see Apple utilize their ultrawideband chip for decentralized contact tracing.
What the hell, I hate Bluetooth now?
I didn't have any positive experiences with Bluetooth, it was always too flaky, so I didn't even activate it for years now.
Another project by a group of Czech volunteers:
https://github.com/covid19cz/erouska-android
https://github.com/covid19cz/erouska-ios
Sadly this won't happen in the US. Even if it's really private, people won't install it unless it's pushed down to them as an update from above, and no company will want to be the first to push it.
I suspect the bigger issue is people don't want to be told by an app that they need to go get tested.
Come to think of it, cities like New York could push it as part of a bigger, more comprehensive covid app...
Can't wait to be tracked by tech developed by a governmental team in the name of safety. Opensource or not a leash is a leash.
I'm curious as a non-expert what's specifically worrying about their privacy model?
My intuition is that rapid adoption of a relatively transparent privacy-preseving option could preempt more heavy-handed approaches to what could be a very valuable public health intervention.
I'd agree if remote tracking was the only option, and if there was a guaranteed policy against public backslash towards those that don't comply out of privacy reasons (which would skyrocket in a health hazard emergency).
These privacy exceptions all affected goverments are talking about (Italy being a great example, viz. Veneto region governor asking for a change in privacy laws the other day) are not going to magically disappear once the coast is clear, just like post 9/11 emergency laws still being used in the US.
I believe there are other ways to help people and that, if you are a government that claims having to resort to remote control its popoulation, maybe your power is either insufficient for your secret expansion goals or you're an inefficient populist.
Every (western) government publicly hates the Chinese government but they do seem to have wet dreams about the population control bit, especially when backed by corporations.
Exactly. People are decrying this because it gives governments capabilities, as if decrying its existence changes that capability model or implies that in the absence of this tool and in a state of emergency, governments wouldn't be stuck trying to accomplish the same goals this tool enables using cruder methods that would be more intrusive to people's lives.
It's like hating gunpowder exists because people can make bullets and fight wars with it.
We all carry around a radio that broadcasts our location. I guess we'll end up switching off Bluetooth except to known good devices, or when we intentionally want to discover what's around us.
I don't know, I'd probably turn mine on just so that I can get notified if I am within proximity of a high infection risk stranger. I would love to have that kind of notification.
Just for now. Uninstall when the pandemic clears.
I can imagine something like that could lead to people abusing, beating up or killing the infected. It might sound far-fetched, but this was happening in Kenya quite recently.
This is needlessly cynical. TraceTogether uses client-side logging so as to leave data in the hands of the users up until it's actually needed for contact tracing.
Would you suggest that we not have public health departments engage in contact tracing at all to combat the pandemic? If so, I'm not sure what to tell you.
Otherwise, apps may go a long way to improve the speed and accuracy of contact tracing. Here in the US, I'd much rather use a protocol like TraceTogether's Bluetrace that goes out of its way to preserve privacy, than adopt an actually-privacy-violating centralized approach where the government simply gathers everyone's location data and processes it centrally (Israel's approach, for example).
If the result is (another) permanent loss of privacy and freedom akin to the PATRIOT act, then yes.
Technology has immense power to do good for people, but only if those who deploy it do so ethically. How many governments around the world can we honestly predict to do so?
I'm curious how many people who now say "give me privacy or give me death!" will change their tune in a hurry once they are themselves, perhaps for the first time in their lives, in real danger of dying.
I regret that - assuming my own ongoing case of COVID-19 resolves without fatal complication - I'm quite likely, I think, to have that curiosity satisfied. I regret it because this isn't a cause for change of perspective which I would wish on anyone. But everything I'm seeing suggests it's a cause for change of perspective that many millions of people are going to have.
My hope is that people don't lose sight of the long term in spite of the short term suffering we may experience. You can only surrender your rights once, the effects of losing those rights will last forever. How many movements would have been impossible if a local government could spy on everyone to break it up before it even begins? I'm thankful we didn't have the same technology we have now during the civil rights movement, for example.
I sincerely hope for your swift recovery.
Well, that's the thing, isn't it? You can only get sick and die once, but that lasts forever too.
Put another way, would you want your children to live in a world where their government abused and spied on them? Borrowing from the future seems free at the time, but the true cost can be enormous. Everyone has to make their own value judgment, but I fall on the side of protecting the freedoms of people now and in the future. If people in the future choose differently for themselves, that will be their choice when their time comes.
Of course, 'you can only surrender your rights once' and 'you can only die once' aren't equivalent either. Once a nation of people surrenders their rights, nobody ever has those rights again (even if the loss of those rights costs lives). A person, or a group of people, becoming ill or passing away doesn't take away the lives of the next generation.
If you think back on the experiences of the last century, how much harm would be done if we couldn't freely assemble because a government decided to intervene? We'd have stayed in Vietnam longer, black folks may not have ever won their civil rights, and its possible women would be unable to vote.
For the record, I don't downplay the suffering of illness. I've lost a parent to cancer, as well as many other family members. Everyone else alive is in the same boat. We're all mortal.
It's not really about what I want or don't want; for one thing, I don't have children and never will.
If I did, though, I suspect I would want them to live.
Cancer isn't like a pandemic. Cancer multiply within a body; pathogens multiply within societies.
I disagree with "you can only surrender your rights once"; unlike life, rights can be won back. There's plenty of places on the planet in which you couldn't freely speak or assemble just a couple decades ago, but now you can. Things aren't going monotonically from bad to worse (though I admit, there's a strong directional pressure here; maintaining rights feels like fighting entropy).
I am a parent, I want my child to live in a world where the government doesn't abuse and spy on them, but where that government is also capable of containing an infectious pathogen (whether natural or purpose-made) pretty much as soon as it registers. There is a practical balance to be found there.
(And if we're trading imaginary worlds: I want my child to live in a world where private entities don't spy on them and sell private information, a world where adtech doesn't exist.)
With an app like tracetogether, you can just uninstall it after the pandemic, right? No need to surrender your rights forever.
Until the government decides that it's in the public's best interest that such an application be installed on every phone, and non-removable.
We already have NSA / Tech company "collaboration" so this is hardly a huge step in terms of tech or privacy invasion. It would just be the next step.
The weak ones we shouldn't be prioritizing over the strong. Harboring weakness is just asking to be taken advantage of. It may seem empathetic at first, but all you end up doing is undermining the individuals growth and selling out the security of future generations. If you're an adult, you need to come to terms with death, and recognize that extending your life isn't worth stealing from future generations. They deserve more freedom than we've had. Not less.
It's a mercy you won't be held to this when you get sick, and find it's somewhat easier to talk in the abstract about coming to terms with death than to face the imminent possibility.
edit: Well, you won't be held to it assuming we haven't reached a need for sufficiently severe triage, I suppose. Otherwise, you might get a chance to quite literally put your life on the line for the principle you've just espoused! I wish you joy of it.
All the soldiers, firefighters, and doctors/nurses/EMTs (and many more) are putting their lives on the line for what they believe in. Some of them believe in the constitution and some of them simply desire to help their fellow man. Not everyone is so weak that they sell out others for their own benefit, and assuming the worst of others only serves to expose your values, or lack thereof.
That was straight-up evil. Whatever empathy and respect you may have had just went out the window. I'm almost in disbelief that you would edit your post just to literally wish someone the "joy" of having a chance to die.
"The weak should be winnowed from the strong, that the strong may prosper without being held back" is an idea that attracts your sympathy, though?
Please don't post in the flamewar style to HN. You've done it repeatedly in this thread. That's not ok, regardless of how wrong or bad another comment is, or you feel it is.
https://news.ycombinator.com/newsguidelines.html
It's unfortunate that you're a coward.
Death is not something to fear, and with a stock of strong pain killers neither is dying.
Sure, assuming you have the good fortune to choose your manner of dying. I wouldn't feel very comfortable making that kind of assumption. But I concede it's easier to sling accusations of cowardice than to think seriously about drowning slowly and helplessly in the fluids of your own destroyed lungs.
Congratulations on having gotten over this pandemic virus. Good luck with the next one!
Reflecting on how my relationship with death has varied with my life experiences, I don't think you know enough about his particular experience to call him a coward.
Personal attacks will get you banned here. No more of this please.
https://news.ycombinator.com/newsguidelines.html
Edit: Please don't post unsubstantive or flamebait comments here generally. You've done it repeatedly, and we've already asked you not to.
Please do not take HN threads further into flamewar. We ban accounts that keep doing that.
https://news.ycombinator.com/newsguidelines.html
Already had the virus, it was a bad cold.
Liberty or death.
This is like saying “There are no atheists in foxholes.” People who say it might believe it, but it is demonstrably false.
I'm sure there are a few!
Agree to disagree, because my liberty is useless without my life.
Balance can be found. And increasingly, it looks like in the modern era, the balance is found in a situation where the PATRIOT act exists and we find a new normal around its existence.
Which government of more than a few million people do you assume doesn't have a line into monitoring intra- and interstate digital communications in this era?
Cynical for sure, don't know about that "needlessly" given it's an endless fight where everytime you give up a right it's taken away forever. This time they give you the opensource bit, next time it's "a matter of emergency", then they stop asking and just punish you if you don't comply.
I have never said that so I am not sure what to tell you. The only method that works is quarantine, remote control is a copout to address the lack of contact with the population. Moreover, what I am addressing is how the tracking is NEVER going to go away even after the emergency is gone.
On this topic, Israel tech companies are right now sending out business proposals to the Italian government to try and implement their methods (viz. https://www.ilgazzettino.it/nordest/primopiano/coronavirus_z... last thing Europe needs during this crysis is ANOTHER political mindset shift towards walls and a iron boot.
The point of contact tracing is to find out who to quarantine, so you don’t have to lock down the entire population. It’s not a “copout,” it’s the bread and butter of epidemic mitigation. It’s why most of them don’t get to this point.
But "stay at home" has been a mantra for weeks anyway, with everybody acting as if they and everyone else is infected.
But we are at this point already.
Singapore isn't. (the government that is building this app). Neither is Taiwan. Through a combination of contact tracing, surveillance, national health databases and enforcing compliance of quarantined individuals by for example regularly checking in on them they have been able to both contain the spread of the disease and keep a reasonable amount of economic and social life intact.
I will continue to be mystified by this weird and abstract notion of privacy that keeps others away from my data but results in mass lockdown, quarantines, shutdowns and curfews, while people in Singapore give some data to authorities and they can still go out and live their lives. I want material freedom to buy groceries and go to work, not some sort of religious dogmatic privacy while some plague wreaks havoc and I need to haul up in my apartment for months.
Even without that, Taiwan, Singapore, and South Korea all have a no joke civil service. Them being able to come up with something in the time of crisis fast is a consequence of that, not the other way around.
Even if one or two piecemeal measures like that were to be implemented, it will not change the fact of terrific ineptitude of current, and few previous office holders.
Without fixing that first, you will never get to the level of trust needed for the society to function, and not to fall apart upon first serious crisis.
In comparison to East Asia, North America is a very uneventful place, where the apparatus of state has not been truly stress tested in decades. For every Katrina USA had, countries in Asia have like 20, and having non-idiots in the office is much more of an existential need.
Even in a patently broken country like PRC, it's the response to natural disasters which is the only thing that really tickles the CPC when it comes to public anger.
I find it pathetic that people wail to the high heavens about this abstract concept of privacy you mention and pensively quote Benjamin Franklin, while clicking away all their most intimate shit to check out some stupid Facebook game.
Get your priorities right: “you won’t believe...” clickbait no. Contact tracing to stop a disease that turns your lungs to frothy blood-juice. Fuck yes
That doesn't describe me, that describes the straw man your require to be at ease with your own choices, which in turn is the only signal in your comment.
For what it's worth, I think open source, opt-in, decentralized, user controlled contact tracing such as that being discussed above is about as good a solution as we can hope for in such a situation.
That being said, I think you've completely failed to understand why some people respond the way they do. Their concerns aren't about freedom in the short term, but rather civil liberties in the long term. Quarantines will necessarily be lifted, but government surveillance has a nasty tendency not to go away. More generally, civil liberties are permanently lost with a disturbing consistency no matter how temporary the original intent.
Nobody out there is either fully informed or perfectly rational, so it's important to understand the underlying motivations behind other's viewpoints if you want to get anywhere. I'm certainly dissatisfied by the incredible ineptitude the US has displayed, but I also value my civil liberties highly and wouldn't want to live in Taiwan. Make of that what you will.
What's interesting to me is that with the right institutions, surveillance does not actually even diminish one's right to qualified privacy.
It can be illegal to use identifiable data for various purposes, or illegal to use identifiable data in a non-fiduciary manner.
With respect to abuses of the surveillance power, it can be employed against those in power as well, to prevent abuses of their power. e.g. police bodycam can work against abusive police if the laws should support it.
So it's important to see surveillance as a sword that needs proper laws to use responsibly, that allows a society with proper laws to obtain better freedom from actual harm and also a better quality of life. If we should just bury our heads as the technology materializes, the abusers will be the ones to exploit surveillance infrastructure.
In cautionary tales like Nineteen-Eighty-Four, Brave New World, or in the design of the Panopticon, the surveillance power was in the hands of a large power, not themselves held accountable by surveillance. But with the right laws, a citizenry can hold a government accountable and limit government and powerful offices by surveillance. These tales fail to see the how surveillance can help strengthen egalitarian institutions. They were more concerned with demonstrating just how powerful surveillance is, a reasonable point, than with how it could be employed to reinforce egalitarian institutions.
That doesn't mean we have to be forever. Extreme distancing / lockdown will be needed to get the outbreaks under control, but once that point is reached, extensive testing and contact tracing will be needed to relax those measures without triggering a massive resurgence, unless we want to wait a year or more for a vaccine.
That's because every single Western country has fucked up the handling of initial stages of the pandemic. Everyone has seen what's going on in China and then Italy, and we all ended up on the spectrum of doing too little, too late (US in particular is leading here).
"Stay at home", social distancing, closing up businesses - those are suppression strategies. They're meant to shut the virus spread down. But they don't have to last all the way until the vaccine - if the number of cases and infection rate go down enough, these measures can be lifted - and then contact tracing can be used to do local quarantines and shutdowns with surgical precision, ensuring most people can live their daily lives as if no pandemic was happening.
Stay at home is the mantra, but because there is zero enforcement of it, there's no shortage of stupid people coughing in grocery stores, or visiting out-of-state relatives, or fleeing the epidemic centers, bringing the virus into rural communities.
Lockdown buys time to introduce new measures. Those measures are:
1. Quarantining positive individuals.
2. Physically enforcing that quarantine. The honor system doesn't work. People are very clearly not obeying voluntary quarantine.
3. Contact tracing, and testing of everyone that positive individuals have interacted with.
Once we get a system that can handle 1, 2, and 3 in place, we can lift the lockdown. This is how Korea and Singapore are beating the virus. This is how China's going to be lifting their lockdown.
This is tin foil hat nonsense. The US has implemented martial law before. Those rights weren't taken away forever.
Wasn't the same said after 9/11 and the patriot act? I'd guess it was just a tin foil hat conspiracy to think several three letter agencies would use the provisions from the patriot act to track pretty much all communications? You can't just accuse people of being conspiracy theorists over and over again and tell them that this time would be different because... Reasons? Also, who needs martial law when you can just do the same with duly passed laws?
"Every time you give up a right, it's taken away forever" is still hyperbole.
People gave up the right to fly at all after 9/11. That was re-instituted for almost everyone in short order.
There is no right to fly. There was a right to privacy (at least as argued before the supreme court) and I think it could be said that is revoked because of the three-letter-agencies data collection that was justified by 9/11.
It was and still is. How do you believe this nonsense?
Also, several provisions from the Patriot Act haven't been renewed, so your example proves my point.
Sorry, but we are long past the point of calling out privacy advocates as "tinfoil hat wearers" - just look at everything that came out after Snowden. Beforehand, most people would have derided others for mentioning "such conspiracy nonsense" (I likely would have myself), and yet the truth was wilder than even hard-core, paranoid conspiracy theorists could have dreamt up.
Since 9/11 in particular, the Western world has seen constant attempts to increase mass surveillance, lower the burden of proof, and dampen human rights, always in the name of whatever they have the public most fearful of at the time - drugs, terrorists, paedos, criminals, the Russians, the Chinese, the Mexicans, communists, Islam, foreigners taking our jobs, the boogey man de jour.
I'm absolutely certain that we'll see politicians try to use coronavirus as an excuse for their Orwellian schemes.
Business as usual has come after Snowden; that's the reason people who have a default-antagonistic reaction to any new technology that could be employed by a government for tracking get labeled "tinfoil-hat wearers."
The future of society isn't no surveillance. That's not tractable. Genie's out of the bottle (as this release of a population tracking tool as open source demonstrates). The question isn't how to stop it; it's how to live with it.
I can't disagree with that; honestly, it felt like the media and politicians conspired to bury it. Revelation after revelation was made after outlets like The Intercept went through the evidence, yet hardly anything made the mainstream news, and when it did, it was fleeting. The CIA destroyed evidence and lied to congress, but there was little impact.
This I disagree with. We've been shown that the supposedly "benevolent" Western governments of today can't be trusted with laws that permit over-arching mass surveillance and the dampening of civil liberties and human rights, and we've seen the inevitable creeping escalations - who knows what a worse government of tomorrow might do?
I don't think the issue went away because anyone conspired to bury it. I think the issue went away because, on average, Americans are comfortable with the arrangement that the intelligence agencies have broad power to dragnet data. They either don't get that these tools could be used against them by unethical government agents or they know that possibility exists but they trust the checks and balances against it and think the risk is outweighed by the benefit to law enforcement and the national intelligence community in managing the international threat of global terrorist activity (which, itself, leverages modern communications tools to communicate rapidly, move rapidlt, hide from law enforcement and military powers, etc.).
9/11 was an avoidable attack and a failure of information analysis; the information needed to stop it existed but had not been consolidated. A lot of Americans are extremely disinterested in bring attacked that way again, even 20 years later.
How do you propose a XXI-century technologically advanced society can do to ensure its biosafety? The current pandemic is force majeure, the next one might be accidental, the one after that purposeful. Advancement of science and technology in large parts means making more and more potentially destructive power available to individuals and small groups. Society needs a defense to compensate. Biology is particularly nasty here, as it's self-replicating.
Quite honestly, I'm increasingly starting to believe that privacy has been on borrowed time ever since we discovered DNA. That doesn't mean all privacy is going to be gone; just that to survive, societies need to learn how to handle pandemics very swiftly, and that seems to require large-scale, real-time management.
What do you believe the truth was? I replied to somebody else in this thread who believed the truth was far wilder than anything in Snowden's leaks.
Wouldn’t people just stop using any tracking applications once there is no tracking needed?
The way I see it is so long as there is a pandemic we have no freedom anyway. It might seem like tracking your citizens is infringing a freedom, but if the option is house arrest I don’t mind.
Any government that would be ready to monitor everyone all the time for no obvious reason isn’t democratic. I trust my government because I live in a functioning democracy. I wouldn’t trust the Chinese government, or even the Hungarian one, and I‘d have second thoughts about trusting the US govt to do the right thing. But most democracies should be able to use technology to provide more freedom in this situation, not less. It’s a true test of a democracy to do this right. But not trying of fear of a perpetual big brother society I think is the wrong choice.
There's a risk that once the capacity is tried and tested, governments and private companies alike will try to make it enticing and useful for different means. The role of privacy activists should be nipping all these follow-up ideas in the bud. Ensuring that emergency measures are used only during actual emergencies. But not fighting them in situations like this.
I completely agree. To that end, it actually seems like fully decentralized client side contract tracking would be a useful technology to have a set of government supported open specifications for. Building the functionality into the OS, securely encrypting (no key escrow!) with a user supplied password, and requiring a warrant to seize (but good luck without the password) would proactively enable a robust response to future pandemics.
Actually I suppose this matches my view on location histories. I like them as an idea, but current implementations exfiltrate all the data off of my device which bothers me to no end.
I share the feeling. I want my phone to collect data about me and my environment. But I want to own that data and use it for myself, not have it sent out to some third parties.
"The only method that works is quarantine"
Literally nobody in the epi community believes that. Would you please state your credentials, or cite a credible source for that statement? (For the opposite, please do read takes from Trevor Bedford, Mark Lipsitch, Carl Bergstrom, Andy Slavitt or really pretty much anybody in the field)
We (the US) are currently in a state were suppression is the only prudent tool. As SK has shown, contact tracing & testing help a lot once you're not completely inundated by cases (and actually have a meaningful supply of equipment)
Yes, there are privacy concerns. Work on them. Address them. But blanket statements like "only quarantine works" are extremely detrimental to public health efforts - the last thing you want is an "all or nothing" mindset
How do you know that this is the current state?
"meaningful supply of equipment" means this option is not possible in the US?
Look at the number of cases and their regional distribution, realize that those are tested cases and thus, with a) asymptomatic carriers and b) really bad testing in the US, the number of active cases is at least 10x that. Then realize you're dealing with an exponential process. United States are thoroughly infected already.
Not now, but if and when the US implements proper suppression measures, and the number of cases goes down to manageable levels (while at the same time the supply chain of PPE catches up to demand), then the supply of equipment will be meaningful.
I guess i misunderstood surpression. Thought surpression is the early stages and not when you have been thouroughly infected already.
"meaningful supply" was in the context of avoiding a lockdown and hence i don't undrestand your answer. if you don't have the equipment now, how do you avoid the lockdown and make the levels go down without large quantities of dead people?
I'm not an epidemiologist, or an MD, so with a large grain of salt:
Containment: Testing & contact tracing - you try to contain the disease before it widely spreads. Usually one of the early stages of fighting.
Mitigation: You can't contain any more, and you're trying to slow down the progress to avoid a large peak. Test & treat those with severe symptoms, encourage people with mild symptoms to stay home, encourage people to keep distance.
Suppression: Things have hit the fan. You need to drastically halt the progress of the epidemic. This is shelter-in-place, lockdown, quarantine etc. #staythefuckhome has become a bit more mandatory. That's pretty much where we are right now. You want to drastically reduce the number of infections in a short amount of time.
"Meaningful supply" was in the context of suppression actually taking hold. At some point, you're hopefully down to illness levels where containment or mitigation make sense again. But for that to happen, you need tests, you need PPE, you need infrastructure so you actually can contain. We're at suppression/lockdown because we failed at that the first time round.
So, it's not about avoiding the lockdown now.
The goal is lockdown now to prevent catastrophic overload and buy time to get supplies in place for later containment stages.
Hope that clarifies? But, of course, containment is not guaranteed to work, so we might be cycling back and forth between those measures
The report #9 from the Imperial College of London details the ideas behind that cycling approach: https://www.imperial.ac.uk/media/imperial-college/medicine/s...
Israel already moved from a central system to a different one called Hamagen which is not centralised and keeps the privacy of the people. This is the one they recommend for Italy. It is open source so you can verify it yourself. https://github.com/MohGovIL/hamagen-react-native
Would you then advocate for mandatory contact tracing in perpetuity, for purposes of preventing / solving crimes?
Why does this imply such invasive measures?
It's fine, but as Jean Yang pointed out on Twitter, no-one would ordinarily call disclosing everyone you'd shared a location with over weeks "privacy-preserving". And once you've done it for some large fraction of infected people, you end up with a country-wide social graph built up, even though you weren't conducting mass surveillance in the usual meaning.
It's a loss of privacy either way (whether done via location or Bluetooth contact). I'd rather just have the conversation about how we've decided to suspend physical metadata privacy to combat the pandemic, than act like the Singapore model is going to preserve it.
This is much better than tracking people via facial and video recognition captured with near-omnipresent camera feeds. This is tracking signals that an optional device optionally broadcasts (and has for years). You can easily avoid this tracking by not having your phone broadcast bluetooth or by not carrying a phone.
Not to mention any number of actors could have already been tracking this signal for years. It's the nature of how bluetooth devices broadcast their presence.
This would be a point if near-omnipresent camera feeds were reduced in favor of using this.
But the much more likely outcome is that this will only end up increasing overall surveillance capabilities, not reign them in.
Until government makes it mandatory.
Yea, but it's much worse than non-shitty suggestions. Obviously if you pick the shittiest option anything will look good.
If you believe you aren't being or can't be tracked already then you live in oblivion...
"Never let a serious crisis go to waste" - Rahm Emanuel.
I agree with this and your sentiment, but I think it is misplaced in this instance.
As I understand it, the TraceTogether app collects (and stores locally), information on other users running the TraceTogether app nearby. If our government's contact tracers contact us, we can provide the information, and it can help in contact tracing. This seems to me to be at or near the minimum amount of information collection necessary to fulfil the function. Assuming voluntary widespread adoption, it is useful, and can be uninstalled at any time once the crisis blows over.
Shoot, I didnt realize that quote was attibuted to Rahm. I fucking hate that guy.
Also - its really disturbing that a few years ago, Apple created an update where you cant turn off wifi or bluetooth - you can now only "pause it"
But there has not been a look into proving that it is actually OFF when your little soft icon is grey...
You can still turn it off by heading to settings and turning it off there (both WiFi and Bluetooth).
It turns the functionality off completely, and stays off until you manually turn it back on.
In control centre it only partially turns off. But that’s not unreasonable as many people don’t understand how many feature rely on Bluetooth. They would probably get annoyed when the stop working, just because they wanted to quickly disconnect some headphones.
Check out the bottom of this page for more: https://support.apple.com/en-us/HT208086
I understand that, but I still dont trust it.
I want an app that tells me EVERYTHING that my phones radios are doing. ALL of them, and ALL the data.
That’s tricky without building a phone yourself from opensource hardware and software.
At least with Apple, they’re under so much scrutiny you can be fairly confident that if their software was lying it would quickly appear in the news.
Finally the above clearly shows that your assertion you can’t turn off the WiFi or Bluetooth radios is false (assuming the software isn’t outright lying, if think that then you should have said so in your first comment).
No, I didnt understand that the "OFF" meant different things in the control panel vs the settings panel.
THAT is "apple software lying"
And your point is absurd "If you want a phone you can trust, then you need to build your own phone"
Fuck that logic.
That's an old principle, and it is, unfortunately, still true. It all depends on where you want to put the trust slider, but push it far enough in the conservative direction and, yes, you enter "build your own machine from scratch" territory.
How do you know the hardware you use doesn't have a microdot that can bypass the monitoring logic and physically manipulate the radio without the OS's consent?
How do you know the software you're running doesn't embed its own bluetooth stack and use a 0-day exploit to gain physical control over the radio?
Oh, you compiled it yourself? With whose compiler? Are you sure that compiler faithfully adheres to the spec of the language and doesn't know how to embed a bluetooth stack that, etc.
Push the paranoia slider far enough, and you end up having to care about all this stuff.
Something like Disklabs' Faraday Bag ought to solve that problem.
Honestly, as both a free software and privacy advocate... yeah. If contact tracing significantly improves our ability to eliminate the epidemic, and my current understanding is that it does, this seems like a pretty good implementation. So long as the data collection is explicitly voluntary, I'm asked for my permission first, and it's for an important cause like this one... I really don't mind!
I would much rather have a system like this than to be indiscriminately tracked and lose more privacy potentially indefinitely. The tracking can't be indefinite if I'm asked for permission, because if I don't think there's good reason for it I'll just say no. And if I'm worried the app's privacy measures aren't good enough and it'll be abused, I'll just uninstall it.
Consent is the key!
https://tracetogether.zendesk.com/hc/en-sg/articles/36004373...
https://www.tracetogether.gov.sg/common/privacystatement
What data is collected? Are you able to see my personal data?
The only data that we collect is your mobile number, so that MOH can contact you more quickly if you were in close proximity to a COVID-19 case.
With your consent, TraceTogether exchanges Bluetooth proximity data with nearby phones running the same app. However, this data is anonymised and encrypted, and does not reveal your identity or the other person's identity. Also, this data is stored only on the user’s phone. Should MOH need the data for contact tracing, they will seek your consent to share it with them.
That's the definition of PII and will eventually be abused for purposes other than emergency contact.
There are several teams working on better privacy preserving functionality: https://github.com/covid-apps-tracker/tracing-apps.
What would be useful is a common standard for Bluetooth transmission so all these apps could talk to each other.
Safety is indeed far more important for some people than privacy and liberty.
I think in these extraordinary times, it’s nice to see the government proactively trying to do more to counteract the worst pandemic the country has ever seen. As much as we might all cry foul over the curtailing of freedom, there is a lot to be said in this current environment about contact tracers immediately knowing who a known covid carrier has come in contact with, which in turn means a speedier response from the medical teams.
That being said though, the app is absolute garbage on iPhone. Obviously not really their fault, but needing to have the app actively on for it to work is absolutely going to lead to people not bothering to turning it on.
I agree this is bad, but I don't understand why it is. Not an iOS developer but I was under the impression apps can run in the background to maintain Bluetooth connections.
Assuming Apple's policies are in fact preventing them from running in the background, does Apple have a mechanism to grant them an exception for this use case? Does someone have a contact at Apple who could reach out to them?
Not an iOS developer either, but I think apps cannot make new bluetooth connections in background, which is a requirement for this app.
I just got out of a call where we arrived at the exact same design as a way to track down the infection spread.
Thank you for posting this!
I feel like this would be a lot easier and have a higher rate of usage/compliance if our tech companies actually worked with people to release or opt-into sharing this information for when it's necessary (information which is already secretly shared with governments for security).
For the majority of people if they go to https://www.google.com/maps/timeline they'll have a tracker of everywhere they've visited and the time they were in each location.
If you could take people's accounts who've been infected and give them the ability to opt-into sharing this information you could have a pretty good source of information about the locations where they dwelled for long periods of time and who should go into self-isolation.
I don’t in my case because I’m not comfortable with the commercial information that gives Google.
One of the gestures I think Google could make in this fight is to allow people to opt into that data sharing on a strictly limited basis. I’d opt in if it was only going to be provided for the purposes of medical infection contact tracing while this pandemic is rife.
I don't think anyone trusts Google enough. They can help by providing governments with anonymized data they already have. Immediately what comes to mind is identifying to governments public hot spots while lockdowns are supposed to be going on so that they can send people to disperse the gatherings. I'm sure people can come up with better ideas
What is contact tracking? The article does not tell us.
As I understand, contact tracking is recording which people come into proximity so that if one gets sick the task of contact tracing can be facilitated by the contract tracking data.
Once you have an identified case, you trace who they have been in close contact with recently and start contacting/testing/isolating them and trace it further from there
E.g. In Switzerland this was done manually (by medical staff mostly i think) in the very beginning, but they gave up very quickly on it because of lack of resources.
For context, Singapore has a team of 20 that can call contacts of confirmed cases, they are able to make 4000 calls a day. Those in contact with confirmed cases are made to a mandatory home quarantine, i think something like 35k people in Singapore are currently serving home quarantines.
There is also an app/project out of MIT called 'Private Kit', which is primarily designed to address the privacy issue.
[1] https://www.wsj.com/articles/mit-researchers-launch-location...
[2] https://safepaths.mit.edu/
It should be opt-in, if you don't opt-in,mandatory quara tine for you. And this should not be something they can renew after the crisis like the US Patriot act.
I built a react native version: https://github.com/yonahforst/trackandtrace
Looking for contributors!
I’m currently working on a community-run contact tracing app in the open: https://github.com/epicollect/epi-collect
It is not a mobile app. You export your data from Google (thanks GDPR!), and filter out personally identifiable data points before submitting. We also let you know exactly who is about to use your donated data (we only allow academic researchers to have access), and give you advance notice so you can delete it if you don’t want your data to be used in a particular project.
We are MIT licensed and are figuring out how to make data donation safe via UX and engineering. We need all the help we can get - even if it’s just feedback. Feel reach out! Nessup@gmail.com
Update: has now been open-sourced [1]
[1] https://github.com/OpenTrace-community