Apple and Google tweak key bits of contact-tracing privacy plan
- Reference: 1587973514
- News link: https://www.theregister.co.uk/2020/04/27/decentralised_contact_tracing_wins_europe/
- Source link:
In an [1]updated FAQ document released late last Friday, the companies explain their plans to employ a "privacy-preserving identifier - basically, a string of random numbers that aren't tied to a user's identity and change every 10-20 minutes for additional protection". The pair's previous plan was for a key to be associated with each device.
The new shifting identifier will make it more difficult for those tracking Bluetooth signals to associate the keys with specific users.The companies said they made the changes after consulting government and health agencies around the world.
The companies also clarified that data will never reach a public health authority - or Apple and Google - until a person tests positive for COVID-19 and opts in.
However apps using the API will check health authorities databases of self-confessed carriers daily, and match those records with encounters recorded on users' phones. What happens if there's a match is not made clear.
The regime outlined in the new FAQ appears also to have ended the debate over whether to use "centralised" contact-tracing that creates on source of data, or the "decentralised" scheme advocated by Apple, Google and the [2]DP-3T contact-tracing effort. Germany's health minister, after the nation previously favored the [3]PEPP-PT scheme, [4]told Die Welt the government is now backing the decentralised approach. Switzerland and Austria have done likewise.
“This app should be voluntary, meet data protection standards and guarantee a high level of IT security,” they said. “The main epidemiological goal is to recognise and break chains of infection as soon as possible," Chancellery Minister Helge Braun and Health Minister Jens Spahn said.
Apple and Google say their system will be released in two phases. The first will release a whitelisted API to authorities in each country. "Apps will receive approval based on a specific set of criteria designed to ensure they are only administered in conjunction with public health authorities, meet our privacy requirements, and protect user data."
The second phase will see the software installed at the operating system level. Apple hopes that this will encourage widespread adoption of the tracing app, which experts say is necessary to its success. ®
Sponsored: [5]Forrester Build a Digital Experience Portfolio
[1] https://covid19-static.cdn-apple.com/applications/covid19/current/static/contact-tracing/pdf/ExposureNotification-FAQv1.0.pdf
[2] https://www.theregister.co.uk/2020/04/20/coronavirus_contact_tracing_academics_social_graph/
[3] https://www.theregister.co.uk/2020/04/06/pan_european_privacy_preserving_proximity_tracing_plan/
[4] https://www.welt.de/wirtschaft/webwelt/article207509833/Corona-App-Bundesregierung-favorisiert-dezentralen-Ansatz.html?cid=onsite.onsitesearch
[5] https://go.theregister.co.uk/tl/1936/-8554/forrester-build-a-digital-experience-portfolio?td=wptl1936
It's likely to put pressure on vendors to make this update available PDQ. As the update is an OS update then presumably any other pending OS update will be included.
"apps using the API will check health authorities databases"
So Google is going to have to its hand up the health databases skirt. There's a lot of reassuring noises in the communication, a lot of making it seem like user privacy is paramount, but Google made a mistake in communicating that they will approve apps that correspond to their criteria of privacy.
There's a lot of wiggle room there.
But we'll see how it goes down. I didn't have a problem with the centralized approach, but at least now we know the direction apps should take.
Looking forward to reading about the API functions, and if there are any hidden ones.
My biggest concern
While anything like this sort of app carries potential risks, the risks from governmental abuse are far lower than the possibility that Apple, or even Google, might misuse it or pass it onto some other organisation.
The problem is that US "medical insurance" looks to be one of the most profitable scams in history and it desperately wants to spread to the developed world. Any help could help them make Billions!
Chances of an Android update appearing on any actual phones any time soon?