Have worked in security a long time. Insecure software that processes PII is designed to be deniable. This is why we need hackers like this fellow to verify anything that processes PII.

I see this fairly often, where a manager in an institution wants to do something illegal or deniable with valuable PII and skirt regulations, they make the external commitment that it's "secure," and then push the implementation down to technologists to implement without serious controls.

If it mattered to the owners of the contact tracing app that it were trustworthy and secure, it would have been. If you want to see what it looks like when security matters, check Apple Pay and other payment specs. It didn't matter in this contact tracing app because someone decided it didn't. I'd argue the so called "professional" pretense of goodwill and sincere intent when it comes to the mass collection of PII is gaslighting bullshit.

In 30 years I could see there being a truth commission where now-aging ad-tech and other developers will confess how they created the systems to facilitate a very dark period.