Hacker News Reader

Is contact tracing technology categorically different from mass surveillance technology?

Yes. This has an identifier (RPI) that changes every 10 minutes (in a way that can’t feasibly be tied back together, unless you declare yourself infected and upload your diagnosis key), and it does not share or upload any location data whatsoever.

All it does is store the RPIs it sees, downloads diagnosis keys, and checks whether any of the RPIs it has stored “belongs” to one of the diagnosis keys it has downloaded.

If the individuals can’t be personally identified, yes.

They always can.

You could work with rotating anonymous uuids. 1. You log which uuids you see. 2. When someone is tested positively, you add the list of uuids you used to a public list (run e.g. by the government) 3. Clients fetch updates to the list and compare it to the logged uuids and alert the user if there is a match.

This way the government could not identify individuals, and individuals would be in control.

Yeah thats pretty much how the spec works. But with key pairs instead of UUIDs.

I said if they can’t be personally identified. Note the qualifier.

And I said that they can always be personally identified.

Reply on news.ycombinator.com