Academics: We hate to ask, but could governments kindly refrain from building giant data-slurping, contact-tracing coronavirus monsters?
- Reference: 1587394088
- News link: https://www.theregister.co.uk/2020/04/20/coronavirus_contact_tracing_academics_social_graph/
- Source link:
Published today, the open letter has been signed by professors from 26 countries and urges governments to think about the dangers of building pools of data revealing precisely who you meet, when and where.
Referring to other countries' experiments with contact-tracing apps as a way of halting the spread of the infection, the academics said: "Though the effectiveness of contact tracing apps is controversial, we need to ensure that those implemented preserve the privacy of their users, thus safeguarding against many other issues."
The Register [1]explained in broad terms how the apps work a few days ago. The problem is that there are two competing approaches for contact-tracing apps: a centralised one, where data from the population is concentrated at one hub for analysis; and a decentralised one, where apps tell the user if they have been in contact with someone who has COVID-19.
The academics fear that a centralised approach would either create an irresistible temptation for "mission creep", fuelling the worst authoritarian instincts of governments collecting population-scale social graph data – or simply create a hugely valuable store of that data ripe for criminals, spies and similar undesirables to hack into.
In the letter, the academics warned that the centralised approach could "catastrophically hamper trust in and acceptance of such an application by society at large." If people didn't trust a government-backed app for fear that data harvested from it could be abused for other purposes, they simply wouldn't use it or would find ways of spoofing the data.
On the flip side, trusting the population to input its own medical diagnoses into a decentralised app is a risky approach. Aside from those not wishing to declare their status, for whatever reason, what about those with mild symptoms who might think they've had a bad cold instead of the coronavirus?
"Research has demonstrated that solutions based on sharing geolocation (i.e., GPS) to discover contacts lack sufficient accuracy and also carry privacy risks because the GPS data is sent to a centralized location," said the letter. "For this reason, Bluetooth-based solutions for automated contact tracing are strongly preferred when available."
Google and Apple, two companies not known for their devotion to privacy, have jointly released a set of specs for a Bluetooth-based contact-tracing app. Singapore released, and later open-sourced, a Bluetooth-based app, [2]having explicitly discounted GPS on practical grounds.
The letter, full details of which El Reg can't publish because our version has people's email addresses baked into it for media use, highlighted four consortia whose decentralised approaches it endorsed: the Western world's [3]TCN Coalition ; the Swiss-led [4]DP-3T collective , which includes the co-founder of VMware as one of its advisors; and two American academic initiatives, [5]PACT (MIT) and [6]PACT (UW) . Despite the similar names, the US organisations are not formally linked.
Trouble at t'monitoring mill
Meanwhile, a contact-tracing app creation collective originally billed as pan-European has started to wobble as it appears to back away from one decentralised approach.
The PEPP-PT project, a German-led initiative that started off backing both centralised and decentralised models for contract-tracing apps, seems to have fallen out big time with the project building its decentralised model, DP-3T.
Cryptography prof Kenny Paterson of DP-3T told The Register the first he knew about PEPP-PT's apparent change of tack was when its organisers stopped talking to him last week, adding that other institutions had seen this and began socially distancing themselves from PEPP-PT as a result: "There was a leaking away of support over the weekend from the international community at the same time as we were getting [today's] letter ready."
Other academics expressed surprise and discomfort last week to El Reg about PEPP-PT's new direction. ®
Sponsored: [7]Choosing A Low-Code Vendor
[1] https://www.theregister.co.uk/2020/04/14/coronavirus_phone_app/
[2] https://www.theregister.co.uk/2020/03/26/singapore_tracetogether_coronavirus_encounter_tracing_app_lessons/
[3] https://tcn-coalition.org/
[4] https://github.com/DP-3T/documents
[5] https://pact.mit.edu/
[6] https://covidsafe.cs.washington.edu/
[7] https://go.theregister.co.uk/tl/1936/-8579/choosing-a-low-code-vendor?td=wptl1936
Re: And the non-centralised approach
The intention is you go and get a test, with the results turned around in, at most, a small number of hours.
Being in the UK we can of course only dream of such efficiency. Without the supporting infrastructure it doesn't matter what approach is taken - the data will be flipping useless.
Re: "the data will be flipping useless"
Well, if you are only considering COVID-19, then: yes, the data from these apps will be useless.
*must get new keyboard. this one is clearely infected*
Re: And the non-centralised approach
Not only does it require a universal testing infrastructure to get it started, once you have that it moves from flipping useless to flipping pointless.
Re: And the non-centralised approach
> if my phone detects that I walked passed a railway line and somebody on the train flagged as positive
No it won't. You need to have received two successive beacon tokens from the other person's phone for you to be considered to have been in contact. The suggestion is that they will be generated at whatever the current "close contact" time is, around 15 mins.
Re: And the non-centralised approach
The point remains though:
If the system detects I might have been exposed - but only I know that result and the risk to me of revealing it (extended quarantine, job loss etc) is greater than the risk of being seriously ill (I'm <80 with no medical issues) then I'm going to ignore/delete it
Re: And the non-centralised approach
This just makes you a bit of a dick.
Re: And the non-centralised approach
No it may mean I live in a country with no paid sick leave, where I may become homeless if I l lose my "essential but minimum wage" job
Re: And the non-centralised approach
If [I thnk] the risk to me of revealing it ... is greater than the risk of being seriously ill ... then I'm going to ignore/delete it FOAD
That seems a reasonable interpretation
Re: And the non-centralised approach
First question... how do they know that someone tested positive was on that train?
When you test positive... what information is passed on to the government? At what point do they track information that isn't allowed by HIPPA at least in the US.
There's actually more to this... while the government can get your name because of the social impact of COVID, tracking you by phone is a no no. Not to mention, even w GPS-A, you're going to be off by 100m
So what happens if you test positive and hunker down in your apartment. Now the neighbors surrounding you are going to be alerted that they are close to someone who's infected, even though they may not be or even close to you ?
Its a cluster-F in the making.
Re: And the non-centralised approach
Your concerns are sensible, but have mostly been satisfied by the proposed designs of at least some of the contact tracing regimes. In particular the best proposed schemes (e.g. Gapple's) do not encode identity, or location, or even really time. They simply encode a device-device meeting based on a pair of continuously rotating keys. When you are diagnosed, you may (i.e. you may choose not to) upload all your keys for the past 5/10/whatever days to a public broadcast server. From there other devices will download these periodic updates and check, locally on that device, whether there are any matches in its local store of the last 5/10/whatever days.
Then and only then can you say for certain you came into contact with someone who has since tested positive, but you do not necessarily know who that person is or when or where it happened. There's no need for government involvement and the critical bit of joining the dots can only happen on a device that has received both a broadcast token and has downloaded a corresponding "I have tested positive" token from a central system.
Bluetooth has been around for over twenty years and is still a steaming pile of unreliable shite. The chances of anything bluetooth based either saving or destroying the world seem pretty minimal.
Pity the virus is transmitted by 5G rather than bluetooth, we would all be safe
Yeah, Right!
If people didn't trust a government-backed app for fear that data harvested from it could WILL be abused for other purposes...
FTFY
Re: Yeah, Right!
And this is the downside from everything that seemed a Good Idea. Trust has to be earned and it's a bit late in the day for governments to discover this.
Dedicated device
This should be a tiny disposable wearable.
Re: Dedicated device
But in Government Dreamland it will be...
Tiny, Permanent & Surgically Implanted.
Personal convenience
Judging by the slap-happy trails of some, many who get tested positive for the virus but still feel active will simply leave their mobes at home or switch off the app. How many will want to risk a reminder of what they already know perfectly well, that "You shouldn't be here", followed by a bunch of cops in bunny suits?
Armbands with a virus logo would be a better warning than some stupid app, plus a law to bang you up in solitary if you are caught without it.
Re: Personal convenience
Or just make people who are positive wear torn clothes a ring a bell as they pass.
Re: Personal convenience
Can't we have little coloured badges sewn onto our clothes?
What's the worst that could happen?
It won't do what it should, can't be effectively implemented, poses huge privacy issues, will arrive late, over budget, will have huge costs for no gain, will only funnel tax payer's money into the pockets of the usual suspects and at best provide another database for the security services.
It's certain to get government approval.
Academics: We hate to ask, but could governments kindly refrain ...
It's a sad statement on the current state of affairs that these august folks would even have to do this.
There's nothing like a group letter from academics to put a fire under governments.
And the non-centralised approach
Means that if my phone detects that I walked passed a railway line and somebody on the train flagged as positive - I will phone my boss, tell them to fire me and go and voluntarily spend 14days living in the shed away from the family.
Or I will uninstall the app, and reinstall to get a new "clean" id