Take this DP-3T project for example. It’s really interesting tech, and a great group of people behind it. But the government doesn’t care for this nuance of what is privacy preserving tech and what is not. For now, maybe at the beginning, privacy will be emphasized. But the important part is conditioning citizens to be okay with the underlying idea of technology assisted self-surveillance, and compliance with notifications on their phone telling them to stay inside.
Schneier raises the point of false positives, which is important with regards to this idea of conditioning. What do you do when you get a notification that someone “nearby” tested positive? Do you take time off work and isolate yourself in your house for two weeks, just because some beacon passed within two meters of you within the past two weeks? Even if you have no symptoms at all? Just because you got a notification on your phone? This just seems unrealistic to me.
My other worry is the classic “slippery slope.” Maybe people are okay with these apps in their current form, if they’re privacy-preserving. (Personally, I doubt anyone outside tech can recognize the difference anyway, but let’s assume the wider populace takes its lead from us). Isn’t there a risk that eventually people will forget about the underlying details and privacy will be deemphasized?
“You were okay with TrackingApp 1.0, why wouldn’t you be okay with TrackingApp 2.0?”
If we give an inch now, will the government take a mile later? Who’s to say the emphasis on privacy will remain in place? Heck, it’s not even clear whether it will be in place from the beginning. The NHS is already saying they don’t want to use it, choosing instead to build their own centralized solution.
Again — it’s extremely concerning to me to see the general vibe of excitement coming out of the tech community around these apps. I’m really disappointed and would expect to see more skepticism. So, kudos to Schneier for going against the grain here.