This is of course nothing new. But it's worth noting considering how high the tolerance for extremely intrusive government action currently is and how extremely weak any resistance is bound to be.

I'm not saying I'm against contact tracing in the current situation. But that shiny new button that governments get to press will never go away.

Edit: Reading the spec, I found a piece of information that may be of interest: This technology allows contact tracing without necessarily revealing the location where that contact has taken place. So that could indeed be a privacy benefit over alternative approaches.

https://covid19-static.cdn-apple.com/applications/covid19/cu...

At least this way you will get some control of the info and you'll know what was collected and have control of it's disclosure (for now).

In other words, this is no worse than what the government is already capable of, it just makes it easier for you to share the data with health care providers.

The government already has all these abilities.

Bluetooth has a quite small range, which may give higher tracking precision (to anyone receiving the signal) than the data cell phone companies have.

https://arxiv.org/abs/1803.09478

https://www.simula.no/news/digital-contact-tracing-qa#How%20...?

doubt it.

in fact, it should remind us to take away those prior surveillance capabilities, and demand any contact tracing system to give control to users and be fully off-limits to large power structures (e.g., only shared between users and researchers).

and being hard to do so is no excuse. we have millions of people we can work on the problem if it's so important to warrant such massive effort.

It's pretty clear that we will get contact tracing applications in many parts of the world, regardless of any action Apple or Google might have taken. Might as well base it on something that does not compromise the user base wholesale.

You could also view it as high demand for government functionality, with an accompanying commandeering of the governmental power by the public, which has leverage of its own. Consider, for example, that 1/3 of the country is on a rent strike right now, a proportion which will likely grow. That part of the polity is learning to flex its political muscle for the first time in a while, because the economic and political establishment suddenly finds itself at a severe disadvantage.

Of course, the government commands asymmetrical strength through police and (less directly) military force, but that's only effective insofar as disparate groups rarely have broad common interests that transcend regional, economic, or social boundaries. Since the internet provides many of the tools to facilitate collective action and COVID-19 has provided a sufficiently broad incentive, political incumbents are discovering that their powers are only as extensive as the willingness of people to cooperate and that they do in fact require the consent of the governed.

I would remove the Android FAILED_REJECTED_OPT_IN status code (https://www.blog.google/documents/55/Android_Contact_Tracing...).

I cannot find it in the Apple API specs, but maybe it's not defined in there yet.

This should be an app users can install and uninstall, not a feature governments control.

PS Governments are already accessing your phone records and tracking behaviour without your permission, along with recording everything you do online for at least 30 days. O Tempora, o mores!

https://news.sky.com/story/coronavirus-government-using-mobi...

https://en.m.wikipedia.org/wiki/Tempora

See: https://www.wired.com/story/apple-find-my-cryptography-bluet...

But it was labelled as terrible. I was for the secret service.

Now it's going to be culturally accepted, and in the hand regular administrators.

This is on order or magnitude worse, for something that was awful.

There are no good choices in a pandemic.

I think that framing is slightly counterproductive to be honest. The alternative are efforts that, from what I see so far, seem to fall on one of two sides:

a) sensible privacy defaults like the proposal by Google/Apple, open development, limited traction in the community and not well connected to political decision makers

b) company initiatives, closed developments and promises of openness while working on centralized solutions

I feel like your scenario would be more worrying in terms of privacy if Google/Apple didn't introduce this protocol extension. They are essentially forcing the b) group to adapt something sensible. Another positive is that this seems limited to the OS level, whereas both have more extensive infrastructure they could have pushed for but intentionally did not.

tl;dr: I think it is a beneficial proposal and well placed, the alternative would likely be worse for the user base.

- Advertisements change every 15 minutes, are not trackable unless keys are shared.

- The only central bit is a repository of "infected" daily keys.

- No knowledge about contacts is shared with a central authority.

Nothing is shared unless you are infected and decide to share your keys, which are only valid for one day. I don't see how you could have a real argument against this unless you are a privacy extremist. It also seems more privacy friendly than the Singapore or German apps.

The authors of DP-3T (which seems quite similar to this spec) have a huge list of privacy caveats in their whitepaper [1], in section "5.4 Summary of centralised/decentralised design trade-offs".

I haven't seen any analysis on how the Apple/Google spec prevents those problems.

[1] https://github.com/DP-3T/documents/raw/master/DP3T%20White%2...

2) Enable epidemiologists to analyse the spread of SARS-CoV-2

So anything in that table with epidemiologists is gone.

The remaining caveats are pretty boring:

To do so, the attacker uses strategically placed Bluetooth receivers and recording devices to receive EphIDs. The app’s Bluetooth broadcasts of non-infected people and infected people outside the infectious window remain unlinkable.

...

On the other end, a proactive tech-savvy person can abuse any proximity tracing mechanism to narrow down the group of individuals they have been in contact with to infected individuals. To do so they must, 1) they keep a detailed log of who they saw when. 2) they register many accounts in the proximity tracing system, and use each account for proximity tracing during a short time window. When one of these accounts is notified, the attacker can link the account identifier back to the time-window in which the contact with an infected individual occurred.

So, yeah, these vulnerabilities still exist and have been pointed out on this thread... but I find it hard to care about these at all.

The group of non-infected people is getting smaller and smaller. The infectious window is presumably weeks long (times the number of diseases this system will track). These risks don't seem that easy to downplay, even before we get into the "security concerns" section.

To my mind this phrase under 'Privacy Considerations' in the Cryptography Specification stands out:

"A server operator implementing this protocol does not learn who users have been in proximity with or users’ location unless it also has the unlikely capability to scan advertisements from users who recently reported Diagnosis Keys."

That phrase explicitly mentions that server operators cannot learn about user proximities.

What I reckon may be unstated there is that it could be possible for adversaries with sidechannel / network monitoring capability to learn those kind of details about users (i.e. internet, cell data, and other data network operators).

If such a side door did exist, it would seem in the public interest to be aware of the scope of the availability of that data, especially given the potential (physical, social) vulnerability and risk of those users.

I'd also like to be proven wrong about the possibility of such sidechannel attacks by anyone who understands the spec in more detail.

[1] - https://covid19-static.cdn-apple.com/applications/covid19/cu...

Source: Providing apps with that functionality.

That's why this involvement is really huge and welcome! And besides clearing out existing arbitrary API limitations, Apple's involvement in potential protocol design for such tracing technology is a welcome addition in my view as well, because in contrast to Google, Apple at least earned a modicum of trust when it comes to putting the privacy interests of their customers first.

Could probably flip it to be a 4 byte prefix (to identify this packet for contact tracing), followed by 16 bytes of the Rolling Proximity Identifier, but not sure if the underlying hardware (the BLE chips) can do low-power matching on a pattern like that. Something only Apple and Google could make work, so this is exciting.

(Or, it could be iBeacon to wake, then making a connection to fetch the Rolling Proximity Identifier. Though, in my experience, not requiring a connection will be more reliable in practice, especially for Android.)

If people complain about EARN IT, they should investigate privacy implications of this "enhanced" tracking technology.

It leads me to believe that the proposed loss of privacy isn't the best way to fight a virus such as a flu

2. Lots of old people, which for Covid is about 65, still work full time jobs. Some of them fly every week. These aren't 95+ year olds.

3. I'm sure people of all ages think their life is very valuable, and very few people consider themselves candidates for sacrifice. Certainly not for privacy concerns.

4. 10x deadlier than the flu.

I would rather see new phone sensors that scan the air, the breath and the body for diseases than a new tracking technology. We could also develop new medicines, etc. Not tracking.

Edit : we also don't have much knowledge about why the virus is more lethal for some people than others. We should focus effort at predicting who will be asymptomatic and who will develop complications, rather than trying to stop the virus from spreading by isolating people

https://github.com/DP-3T/documents

paper: https://github.com/DP-3T/documents/blob/master/DP3T%20White%...

data protection aspects: https://github.com/DP-3T/documents/blob/master/DP3T%20-%20Da...

Here's an overview comparing that approach to some others (such as Singapore's tracetogether): https://github.com/vteague/contactTracing

It means that contacts with infected persons can't be linked across days, and it means that I can't build an app that alerts me that someone who was previously infected just walked by.

This is plainly incorrect. See the "EphID Generation" section of [1].

[1] https://github.com/DP-3T/documents/blob/master/DP3T%20White%...

DP3T specifies that SK _t = H( SK _{t-1} ). In that design, you share the daily key when from when you started to become infectious, and then the subsequent ones can be computed. Then you go into quarantine, stop being infectious, and (see spec) create a new random daily key going forward (or delete the app).

In the A/G proposal, daily keys can’t be correlated, and you share the daily key for each day you were infectious.

The end result seems pretty much the same for me.

This seems to align with the statement that knowing the key for one day (i.e. once it is uploaded following diagnosis) allows one to derive all future keys. Is there another section I am missing?

Edit: clarified that daily keys are shared post-diagnosis, to trace prior contact.

I have the impression that all of this is forced upon us as to make us believe that it is safe to get back to work ASAP. Wouldn't it be better to just wait ? (I'm not interested in the economical debate : this will invariably lead to compromises such as how many victims can we afford to keep the economy going ? (nobody will tell it that way, but in the end that's the truth behind those arguments))

The troubling thing is, bluetooth-based contact tracing is in no way easy. Different android phones handle background bluetooth scanning / advertising differently and some tend to require additional config changes - such as disabling battery saving features - to even make it work. And iOS bluetooth advertising in background is just bad. Since u can't add custom UUIDs to the advertisement package, just advertising data is often not enough, so u have to connect too, which creates a range of other problems. I suspect they will release OS upgrades to solve some of these issues, but not all devices will be fixable (eg, older Android devices). This, combined with the fact that they will start rolling out this feature in May, makes me think it will not help us much for the latest wave of COVID-19 infections. Might come in handy for the next epidemic, though.

[1] - https://github.com/cryptekio/corridorapp-android

As a matter of fact I see this as a very likely scenario as this is precisely what South Korea has already done.[1]

[1] - https://www.youtube.com/watch?v=BE-cA4UK07c

Not sure whether that's what this implementation would look like.

> alice can also hide messages from times she wants to keep private

If there's a need for this, doesn't that imply that the scheme does not actually keep Alice's privacy in all situations?

Furthermore:

> the random messages give the hospital NO INFO on where Alice was

This seems to assume that the hospital (or anyone with access to the data, such as governments) didn't capture the broadcast messages together with their location. With enough Bluetooth receptors in busy areas, a government could easily find out where Alice had been by looking up each of her messages in their list of message/location pairs?

Experts can probably come up with nastier and/or easier exploits...

In particular, given an adversary who has several points (receiving these codes) and knows the receiving location of each of these points can de-anonymize a person "A" who is COVID positive if they know, e.g., a minimal amount of A's usual daily movements (from cellphone tower location, for example).

That being said, the government probably has better ways of knowing who has COVID-19 and other infectious diseases :)

Once the crisis is over, they'll continue to use such "safe" apps, for other purposes ...

https://blog.google/inside-google/company-announcements/appl...

Also, the Apple logo is first. I wonder how this was decided?

This. It would look weird if the order were the other way around.

Someone probably said — "how about this?" and scribbled something. May have even been a Googler.

Then everyone else just said "sure".

At least, that’s how I’d like to think it went.

https://covid19-static.cdn-apple.com/applications/covid19/cu... Cryptographic Specification

https://www.blog.google/documents/55/Android_Contact_Tracing... Android API

https://blog.google/documents/57/Overview_of_COVID-19_Contac...

Apple and Google should have included the chart in their announcements, IMO. It illustrates the process in a way that's easier to understand than text alone.

https://www.gov.sg/article/help-speed-up-contact-tracing-wit...

https://github.com/OpenTrace-community

Not really. This is based on the TCN approaches by Covid-Watch, Co-Epi and DP-3T (submission to PEPP-PT). TraceTogether fundamentally functions very differently.

I was expecting that people would organize around git repos - but no, just one of the many COVID tracing initiatives published their code.

It is https://github.com/tripleblindmarket/covid-safe-paths by the way.

> Upon a positive test of a user for COVID-19, their Diagnosis Keys and associated DayNumbers are uploaded to the Diagnosis Server. A Diagnosis Server is a server that aggregates the Diagnosis Keys from the users who tested positive and distributes them to all the user clients who are using contact tracing.

Is this scalable? Earlier in the document they mentioned that the tracing keys are 16 bytes long. Let's assume that there are 3 million patients in a country. That'd be 48 megabytes each user has to download and process per day to check whether they've been in contact with an infected person (processing involves calculation of 144 HMACs per tracing key). I don't think this is feasible at scale and one can't avoid thinking about area recognizing diagnosis servers.

E.g. Smartphones of patients would upload not just the diagnosis keys, but also the areas (county, district, something like that) they've been inside during that day. Then smartphones querying the diagnosis servers would have to send the areas they are interested in. But it's easy to see that this approach is then quite privacy invading. On the bright side, this info is already available to carriers so it's already a sunken cost so to speak.

Yes, healed patients who don't produce viruses any more aren't important, but anyone still infectious is still a danger. Even if you are supposed, often even legally required, to stay at home while being infected, there is no guarantee you aren't. I'd bet that most of these people also take their phones with them, after all far more serious criminals like actual murderers are often taking their phones to sites of crimes as well. The IDs of those devices are still relevant. Quarantine after diagnosis may last up to 14 days, so your phone should be uploading IDs for 14 days to the diagnosis server.

Given continuation of exponential spread, we aren't far from having 3 million new patients within a span of two weeks in populous countries like the US.

Seems doable, especially considering that you’d want to have fully blown lockdown during the exponential growth, and only then switch over to this contact tracing phase once the initial wave has abated.

1. https://en.wikipedia.org/wiki/Bloom_filter

I can foresee a large second wave due to this falling short if we relax social distancing measures. There have been cases where people test positive then test negative and then positive again. It would require redundant testing per individual on a schedule.

There are a lot of people who will not be tested, there are a lot of people without smartphones. This virus has spread so far at this point we’d need to test every US citizen to know the blast radius.

I understand people are hopeful and want things to return to ‘normal’ but I can’t imagine it without a vaccine in the US.

There's obviously a question of what you should do when you find out you have been in contact, and that will differ depending on the stage. We probably want to be in a position where everyone who has come into contact with an infected person can get a test asap and if necessary then go into full isolation, not just going out less.

(Iceland's outbreak is at about the same infection rate as the Bay Area if you estimate with hospitalizations/deaths. Daegu was significantly worse than the Bay Area per capita).

It’s quite obvious that more intrusive measures (lockdowns) are needed now, but what do you do once they’ve Had their effect? You can’t just abolish all measures, as you’d be back to square one. That’s where this comes in handy.

> You'd have to be naive and short-sighted to accept their pinky-promise of privacy-first in this context.

Or, more constructively, you could examine the spec and see whether it’s privacy preserving as promised, and ensure that the deployed software confirms to the spec. How about that?

But that can't/won't undo the effects of something being called "private" being exposed not to be afterall...

Is there a plan to verify test results? Are public health authorities in small countries/regions expected to build and maintain an app and a server from scratch?

I hate the fact that I definitely see a good reason for it and the goverment is more than happy to accommodate this power grab.

- Doesn't collect personally identifiable information or user location data

- People who test positive are not identified to other users, Google or Apple

- List of people you’ve been in contact with never leaves your phone

https://blog.google/documents/57/Overview_of_COVID-19_Contac...

edit: I just "read" it ( it is not even a spec - it is not even a powerpoint presentation ). You are down voting me for questioning a couple of pictograms?

Edit: I wasn't downvoting you, and the link was the source for the summary for the privacy considerations. The details are in the actual spec.

1. Bluetooth: https://covid19-static.cdn-apple.com/applications/covid19/cu...

2. Cryptography: https://covid19-static.cdn-apple.com/applications/covid19/cu...

3. Framework: https://covid19-static.cdn-apple.com/applications/covid19/cu...

It lets someone identify as Covid-19 positive and then if people have come into contact with them, you can be alerted. Most of the processing happens on device and it doesn't use location data.

It looks like it would be very hard to abuse by governments or businesses, but I'm not an expert on these kind of things.

Do I understand this correctly? It's almost all done locally, there's nothing about location, and almost nothing is send up until you mark yourself as infected, right?

EDIT: This is the best high level explained I've found: https://blog.google/documents/57/Overview_of_COVID-19_Contac...

edit: There is something that occurred to me after writing this. FB had an API at the beginning of their game when they were shooting to get developers' attention. They did. As the leaked documents show what really end up happening, API evolved in ways that benefited big boys. I guess my rambling point is that whatever current specs say, may quickly become rather distant past.

Privacy is really important: but we lost it all a long long time ago. Maybe saying "well now we can do a good job of contact tracing" is at least some good coming out of that loss of privacy. I just hope we don't end up wasting time trying to make the contact tracing "private" as if by doing otherwise we'd be giving something up that we didn't already give up long ago.

Presumably the bluetooth recording will give much better fidelity/precision about who is close to who, in all conditions (in buildings, in the subway, etc), where simple phone triangulation or GPS won't be accurate enough.

That's far more data than the phone companies have on us right now, so it is a good thing that people are considering the privacy issues. Just saying "we've already lost" only makes things worse.

US public institutions seem frankly sclerotic. The fact that the government has or has not done something provides almost no signal on whether something is possible or not.

* cell tower data

* phone GPS data

* Bluetooth data about proximity to specific other people

For most purposes these are increasing in precision and sensitivity. But also, governments can demand that carriers turn over the first kind, but the second two are generally under some kind of user control according to mobile OS designs. There is no single place that automatically gets this data about every smartphone user.

Some of the discussions about privacy for the kind of technology that Apple and Google are working on here are based on observations like

* there actually is no existing way that health authorities could get detailed Bluetooth proximity information about all smartphone users

* this information is potentially more useful for epidemiological purposes, and also more privacy-sensitive, than just GPS sensor data, because it may more reliably map individual people's interactions with one another (for example, potentially confirming that people were likely in the same room rather than just in the same building)

* there are cryptographic concepts that could potentially make this data useful for contact tracing, if users cooperate to a certain extent, in a way that would still make it difficult to obtain or use the data for a different purpose

Another way of putting it is that many people looking at this question think that there is an incremental privacy harm from disclosing Bluetooth proximity data (compared to data that is already available), and an incremental benefit to epidemiology from finding a way to process this data for contact tracing purposes (compared to data that is already available).

https://www.imec-int.com/en/articles/imec-sets-new-benchmark...

"Hey everyone - so yeah, we're using all your data you're willingly providing all these apps on your phone, like location, contacts, camera...So thanks for helping...Okay, bye!".

But you're right. Every day there is so much information from the spies we carry around with us as they communicate that it'd be unfathomable they're just "ignoring" all of this information.

The chances are in some privacy policy it says they can share that data with their "partners" which silently gets back to the government.

Just use what you already have, what we already know you have, and if it saves lives then at least it was put to good use.

First of all how reliable this technology will be since its results will or can be used in courts.

Secondly how contact tracing logs will be secured since they can be stolen or sniffed in a real time.

I didn't read technology documentation drafts and I used Bluetooth last time on old generation of phones way before smart phones and I'm interested for how long this tracing sessions will last since you can map devices that have turned on bluetooth in any given area(Tran stations,libraries etc.) You can do something similar to Wardriving (en.wikipedia.org/wiki/Wardriving).

Please do not fuck this up.

No doubt much of this data is already collected in one form or another. But it is a big step from collecting data, to analyzing it in new contexts, to visualizing it well, to making it highly accessible to federal non-technical agencies.

That would be an incredible win for humanity.

Also, common cold mortality is extremely low.

Even if it's not the most important thing we could do, eliminating influenza and the common cold would be pretty fricking awesome.

That is so that once one is diagnosed others can check if they were close to that one (and when?). And even these lists aren't supposed to be any typical metadata but something that stays local and the third parties can't reconstruct.

The idea is, again if I understood, that those who remain negative never have to upload anything that gives any traceable information about them.

See my other post here with other relevant quotes from the specification.

----

Edit:

1) Actually what is uploaded is: "the Daily Tracing Keys for days where the user could have been affected"

"Upon a positive test of a user for COVID-19, their Diagnosis Keys and associated DayNumbers are uploaded to the Diagnosis Server. A Diagnosis Server is a server that aggregates the Diagnosis Keys from the users who tested positive and distributes them to all the user clients who are using contact tracing."

The matching is done locally on every device:

"In order to identify any exposures, each client frequently fetches the list of Diagnosis Keys. Since Diagnosis Keys are sets of Daily Tracing Keys with their associated Day Numbers, each of the clients are able to re-derive the sequence of Rolling Proximity Identifiers that were advertised over Bluetooth from the users who tested positive. In order to do so, they use each of the Diagnosis Keys with the function defined to derive the Rolling Proximity Identifier. For each of the derived identifiers, they match it against the sequence they have found through Bluetooth scanning."

You are more right than I was initially, thanks!

Actually, to be even more precise: only if infected, you upload the set of your own derived keys, and apparently only for the days you could have transmitted the virus to other people.

From the documentation:

"Upon a user testing positive, the Daily Tracing Keys for days where the user could have been affected are derived on the device from the Tracing Key. We refer to that subset of keys as the Diagnosis Keys. If a user remains healthy and never tests positive, these Daily Tracing Keys never leave the device."

If this does really work, it could trace millions of people and give this pandemic some sort of order. Identify hotspots and show a heat map of spread.

Definitely a step in the right direction, hopefully it's executed well too. I'm pretty sure Microsoft be jealous they didn't win the Mobile OS market.

Not sure how ubiquitous it is. Nevertheless, given that Android is 90 percent of the market in India, may be this can help overcome the iPhone OS-level constraints that makes it necessary for both platforms to work together in markets like the US.

[1] https://covid19-static.cdn-apple.com/applications/covid19/cu...

I don't see how this can work unless it gets very high distribution. I wonder if local governments might do something where the shelter-in-place orders are lifted for some categories of people conditional on running the app?

Hell, vast numbers of people have been doing it voluntarily already with loyalty cards.

To get to 0 you need very high participation.

Even modest adoption will have some impact on the rate of spread.

(If 20% of people adopt it, you’d catch only 4% of contacts).

We're literally still fighting the wars that arose out of the last time we acted in a moment where we were "united by fear."

"A tech-savvy adversary could reidentify identifiers of infected people that they have been physically close to in the past by

i) actively modifying the app to record more specific identifier data and

ii) collecting extra information about identities through additional means, such as a surveillance camera to record and identify the individuals. This would generally be illegal, would be spatially limited, and high effort."

If I read this correctly, this means that a government could collect identifier data on a per-location basis and later link this to someone's identity (for example with cameras or by tracking the IP address of uploaded identifiers).

Unfortunately I can think of quite a few entities (e.g. governments) who are not too worried about doing high effort, spatially limited things in order to track people's locations. Saying that this is "illegal" (which is probably not even true in all countries) does not give me confidence it wouldn't happen either.

[1] https://github.com/DP-3T/documents/raw/master/DP3T%20-%20Sim...

Edit: I'm assuming that GPS level precision is sufficient to start the dystopia

http://jan-sampark.nic.in/campaigns/2020/04-Apr/Arogya/index...

Great!

https://covid19-static.cdn-apple.com/applications/covid19/cu...

"Privacy Considerations

• The key schedule is fixed and defined by operating system components, preventing applications from including static or predictable information that could be used for tracking.

• A user’s Rolling Proximity Identifiers cannot be correlated without having the Daily Tracing Key. This reduces the risk of privacy loss from advertising them.

• A server operator implementing this protocol does not learn who users have been in proximity with or users’ location unless it also has the unlikely capability to scan advertisements from users who recently reported Diagnosis Keys.

• Without the release of the Daily Tracing Keys, it is not computationally feasible for an attacker to find a collision on a Rolling Proximity Identifier. This prevents a wide-range of replay and impersonation attacks.

• When reporting Diagnosis Keys, the correlation of Rolling Proximity Identifiers by others is limited to 24h periods due to the use of Daily Tracing Keys. The server must not retain metadata from clients uploading Diagnosis Keys after including them into the aggregated list of Diagnosis Keys per day."

It doesn't look bad, at least, at the first sight.

A detail: I hope the "day begin" for the "Daily Tracing Key" is the same for all users? I.e. not a local day but e.g. GMT+0 day or something.

What it looks like it's application framework based on system service I hope they won't start advertising ios bluetooth all the time and only allow application to do it. In that case application can be safely removed.

I am also concerned about cloud Diagnosis_Keys

All it does is store the RPIs it sees, downloads diagnosis keys, and checks whether any of the RPIs it has stored "belongs" to one of the diagnosis keys it has downloaded.

This way the government could not identify individuals, and individuals would be in control.

for context, roughly 8000 people die per day in the US. the virus has killed 2 days worth of people in the US in the 80 days of known infection, and probably ~100 days of undiagnosed infection. so covid has killed 2% of the expected number of dead. it's serious, but it's not the black plague, or even the 1918 flu. and we're already seeing transmissions curb.

the virus overwhelmingly infects others in close and closed proximity with a lot of cross-breathing going on. random airborne infections or surface infections are likely small, certainly less than 10%, probably less than 1% of infections.

so, you don't need to social distance outside unless the other person is actively coughing/sneezing (or maybe singing/talking extra forcefully) in your direction within 6 feet. you don't need a mask unless you are in close proximity (less than 6 feet) to random other people for more than a couple minutes at a time. grocery clerks, and other service workers in close proximity to strangers, on the other hand, should wear non-n95 masks (but probably not gloves) during work. same with those who are often near folks with comorbidities like age, auto-immune disease, diabetes, etc. medical providers should wear n95 masks, gloves, gowns, and take many other precautions that make no sense for the general public. you are not lowering your risks in any percepitble way by doing so. allay your anxieties with those basics, rather than looking to buy more toilet paper. it's enough, really.

the overwhelmingly most effective way to prevent transmission is to not breath in a sick person's exhaust. that's it. that's all we need to do. and yes, we don't know everyone who's carrying the virus, so it makes sense to reasonably physically distance in enclosed places like grocery stores. but not more than that as you've already reduced risk to background noise with these basic distancing rules.

contact tracing only makes sense when groups of strangers come into close proximity. it doesn't need to track every single person you brush past on the street. so for instance, you could just provide "contact tracing" with beacons in stores rather than always-on phone tracing.

let's not lose our heads, and our rights, over this.

The part of this comment that actually addresses contact tracing proposes a method (beacons in stores that would have to rely on fixed identifiers, known geolocation, and central storage) that would not only be worse for privacy than what is proposed here, it is also the likely outcome without employing a technique that at least considers privacy concerns.

The other paragraphs read like a compilation of Facebook-based science, where not simply factually incorrect, all points made are debatable and by no means as clear as you make it out to be.

This is a opt-in API and a technical protocol specification which we can discuss on technical grounds. Nothing proposed and discussed here even affects data leaving the end user device, or your rights for that manner, yet.

https://twitter.com/dbrophy/status/1241434641250299905

Close contact detection and alerts at the mobile OS level

We need to get better and faster at stopping the spread of infectious diseases. Covid is already catastrophic. Next time R could be 5, and mortality could be 5, 10 or 20%.

I believe we can use mobile technology to track close contact between individuals, and alert at-risk individuals to potential infections. I believe this could drastically reduce R and the impact of infections diseases could be substantially mitigated. Simulations should be able to determine the effective reduction of R.

Apple and Google should work together to implement a worldwide close contact logging framework. It will use bluetooth to track close contact encounters. The architecture will be anonymised and encrypted to make it somewhat privacy centric.

Obviously privacy zealots will make noises, but to save millions of lives and economic disaster the general population could be convinced it's acceptable.

iOS and Android should have an always-on bluetooth scanner that logs the bluetooth ID of nearby devices. If a device stays nearby for a certain amount of time, a close contact is triggered. The severity of the close contact is determined by the amount of time the devices were close together for, and other bluetooth data. This is anonymised, encrypted and logged.

When an individual is diagnosed with an infectious disease, they activate a feature in their phone which displays a QR code. The health professional has an app that scans the QR code. The health professional will enter details about the disease, and how far into the past the person was estimated to be contagious.

Alternatively if the individual hasn't been tested or is unable to reach a health professional, they can answer a set of questions about their symptoms that will determine how likely they are to be infected. Obviously this method of self diagnosis is less reliable so the framework will take this into account when deciding who to deliver alerts to.

The system alerts people that have had close contact with the infected individual, giving advice about local testing centers or self quarantine. The system will be tuned to only notify the more severe close contacts as needed. Data about available local testing capacity could be used to further refine this tuning.

Problems:

* Privacy: how to make the data private / anonymous. Communication: how to convince the public that their data is private / anonymous?

* Power: Bluetooth on all the time - battery drain?

* Health professionals: how to make sure only health professionals can use the alert app, but also deploy worldwide without delays.

* Deployment: how to get this system onto all Android phones with such a fragmented ecosystem.

* Detection: how to most effectively determine infection risk from available bluetooth data.

* Tuning: too many alerts for low risk encounters and people will ignore them - tuning is needed.

I doubt this is an issue anymore for modern devices. Things like smartwatches connect via Bluetooth but still manage to keep the phone’s almost-all-day battery life.

Every single authoritarian regime is salivating over something like this.

The thing created here is a standard BLE characteristic that says I’M PERSON X and your phone is always looking for PEOPLE and recording when it sees them... then uploading that to Google and Apple.

You can decide for yourself if a contact recording system could ever be abused.

That apple's involved in this is hopeful -- their earlier work on anonymizing Maps.app directions is well worth thinking about here. tl;dr your route is broken up into n chunks, each chunk gets a uuid that isn't tied to your handset, and so serverside nobody knows where Bob's Iphone just asked to go. [0]

Doing this kind of "differential privacy" or whatever we want to call it today properly is very hard, but it is also very, very important to get right.

[0] https://www.idownloadblog.com/2019/03/13/apple-maps-navigati...

https://twitter.com/MikaelThalen/status/1243281598037913600

Look how fancy the UI is!

I am generally someone that takes privacy very seriously, I mostly avoid Google products and others for this reason.

But... this may be a time that the privacy concerns are worth loosening a bit for the good of this. But that comes with the caveat that I hope this is disabled when this is all done, and preferably the code removed completely. I trust Apple to do this, not sure if I would trust google too.

Any right you're willing to give up now, you've demonstrated a willingness to give up. You won't get it back. Either it'll remain lost forever, or it'll be used as evidence for a future proposal to take it away permanently (rhetoric: you agreed to it for X, and clearly any person who isn't morally bankrupt values Y over merely X; you're not morally bankrupt are you? And the need for Y will never go away...).

By all means, let's carefully give people tools to supplement their memory, to help people voluntarily notify others who need to be tested. Let's not, however, make that information available to anyone other than the owner of the device.

The problem is, what's the better option right now. Clearly the measures that are being taken are not actually working, people are still being infected and the ability to track the person you happen to walk past or stand next to waiting for your pickup.

I am conflicted about this... but as of right now I also feel like its necessary.

Can anyone think of a recent situation where the UK government has given back a power it has temporarily taken? This is a genuine question - I cannot. The closest was a stand taken by David Davis against 90-day detention without charge during the Blair administration (though he has since proved rather more illiberal than this position would suggest).

In the UK at least, while it might not _have_ to work that way, in practice it does.

An involuntary mechanism for contact or location tracing that's accessible to governmental authorities without the consent of the user is a civil rights violation, whether it's being actively used at the moment or not.

The American public exercised their power to elect politicians who'd end the draft as the Vietnam War got progressively more unpopular. It's well within our powers, if we care enough.

This is something covert, like secret courts, unconstitutional data collection, manipulating the stock market for the 1%.

You won't get people to care once a new, barely visible leash is entrenched.

Public opposition ended the Vietnam War and the draft. It would be political suicide to reactivate it barring a full-scale world war.

Tangentially related - Singapore plans to open source their app. There's a few details about how it works here:

https://www.theregister.co.uk/2020/03/26/singapore_tracetoge...

Also interesting to read some of the reviews of the app here:

https://play.google.com/store/apps/details?id=sg.gov.tech.bl...

The tl;dr is that without a huge, nigh-omniscient program to trace individual cases, we have no choice but to go on and off Covid lockdown for a year or more, with potentially devastating economic consequences.

Having Apple and Google develop a built-in tracing program to their phones with firm privacy guarantees is not good, but it might be the least-bad solution we have right now.

This may be right, but how will said vendors "force it" on users? A system update? That still takes voluntary cooperation.

- Did contact tracing apps really save anything in singapore/taiwan/israel?

- Is sweden really doing that bad without this kind of surveillance?

- What is tracing going to help anyway? it will warn people to go to the hospital early ? To do what? there is no cure and they 'd better stay away from infection nests like hospitals anyway. It's not like people don't get symptoms days before they need hospitalization

- Is tracing really going to be workable? this is a highly infectious virus, and people networks have very short path length, which means that, without social distancing, 100% of the people will get notified that they might have been infected in any day

- This data does not need to reach anyone's servers. Infected people could just publicly and anonymously upload their location in a public server for other users to crosscheck. The less data are hidden behind walls, the less chance of abuse.

Even if tracing might slow down the curve, this slowdown shouldnt last forever and it should be targetted, not anonymous. It is important that the spread speeds up in the parts of the population that carry less risk (children, women). There is really no good way to do that other than specific , local measures of SD.

It would be very different if these phones had a thermometer, but i think some regulator removed them.

> First, in May, both companies will release APIs that enable interoperability between Android and iOS devices using apps from public health authorities. These official apps will be available for users to download via their respective app stores.

On iOS, entitlements?

The nefarious ad actor can do far more with the existing stack.

So now this nightmare is going to give historical tracking data to government entities without warrants forever.

And Barr is going to get encryption backdoors with his theater.

How about just making a test that costs a few cents in million quantities that you can take at home. It won't be the last time we need that tech for a virus.