More information here:
However, we're going to be seeing a lot of discussion about infectious disease surveillance and the more nefarious types. As Maciej Cegłowski has pointed out, we are already doing the nefarious kind on a massive scale in order to target ads more effectively.
I do believe there's a middle ground, that this stuff can be done in a way that preserves human rights. But it will require attention and holding those who have the power to abuse the system accountable.
[1]: https://journalofethics.ama-assn.org/article/surveillance-in...
But when you mark yourself to infected, how does that resolve to notifications for all your contacts? At some point that must hit the cloud and fan out to everyone, meaning the contact list is shared at that point, and with a large enough network becomes identifiable info. Esp if you combine that with skimming contacts.
Is the GDPR compliance and on the wire encryption what keeps it private?
If you test positive, you publish your recorded close proximities ids on a public server. Authorities can supply you with a one time tocken with the test result to append said server.
There are certanly more efficient and elegant ways to solve this problem, but it is solvable.
> ...and will inevitably remain installed on many devices
But I really hope that on one hand when this is over the central tracking servers will then be disabled and on the other hand users will be motivated to uninstall the app and/or switch off bluetooth/gps/whatever to save battery (even if tracking by cell tower would still be active, if used by the app).
I’d be willing to compromise here if along with the compromise we replaced “hope” with laws around destroying this technology/platform at a certain defined point in time, along with sufficient criminal penalties for continued usage of the technology/platform after said point in time.
If the Patriot Act proved anything, it’s that we as citizens must demand laws with teeth around the deployment and usage of these dangerous technologies.
See: https://blog.cryptographyengineering.com/2019/06/05/how-does...
I think that with two tweaks, we could cast a pretty wide net and remain privacy preserving:
1. Phones record a 14 day history of every pseudonym and public key they generate, as well as every pseudonym and public key they observe. Observers (potentially exposed contacts) could encrypt these observations with their own public keys and upload them using the same method Apple uses, I believe.
2. People who test positive can opt in to publishing those pairs publicly, which would allow any device to scan its history for those pairs and determine if its owner has been exposed. Or alternatively, Apple or another company could perform this on a user's behalf using the central database.
I think the privacy preserving aspect is dependent on users opting in to sharing information for the past 14 days following a covid-19 test. That would allow the contacts to perform the same "have I seen this device" search locally.
Edit: This actually seems a lot like "haveibeenpwned" more-so than anything else. As long as a case's device generated unique IDs continuously, logged them privately and broacasted them to nearby devices, then a potentially exposed contact's device could regularly query a central database for hashed prefixes of IDs they've seen in the past 2 weeks. Any person (case) who tests positive could opt-in to publishing all of the IDs their phone has generated in the past 2 weeks.
The contacts could then opt in to publishing the location said contact occurred, and a hash of a geofence could also be logged - allowing contacts who have been exposed to opt in to publishing that someone in a particular vicinity had tested positive and was present at a particular date and time.
If you're using "Find My Phone" on your device, you're already relying on this sort of surveillance. I'm not sure what's "scary" about using the exact same feature that many people are in fact relying on for their convenience, to mitigate an ongoing disease outbreak.