Everyone Agrees That Contact Tracing Apps Are Key To Bringing COVID-19 Under Control; Iceland Has Tried Them, And Isn't So Sure

from the solution-or-solutionism? dept

Given the massive impact that the coronavirus is having on life and the economy around the world, it's no wonder that governments are desperately searching for ways to bring the disease under control. One popular option is to use Bluetooth-based contact tracing apps on smartphones to find out who might be at risk from people nearby who are already infected. Dozens of countries are taking this route. Such is the evident utility of this approach, that even rivals like Apple and Google are willing to work together on a contact tracing app framework to help the battle against the disease. Although it's great to see all this public-spirited activity in the tech world, there's a slight problem with this approach: nobody knows whether it will actually help.

That makes the early experience of Iceland in using contact tracing apps invaluable. An article in the MIT Technology Review notes that Iceland released its Rakning C-19 app in early April, and persuaded 38% of Iceland's population of 364,000 population to download it. Here's what this nation found in its pioneering use of a tracing app:

despite this early deployment and widespread use, one senior figure in the country's covid-19 response says the real impact of Rakning C-19 has been small, compared with manual tracing techniques like phone calls.

"The technology is more or less … I wouldn’t say useless," says Gestur Pàlmason, a detective inspector with the Icelandic Police Service who is overseeing contact tracing efforts. "But it's the integration of the two that gives you results. I would say it [Rakning] has proven useful in a few cases, but it wasn’t a game changer for us."

It's only one data point, of course, but it's an important one. Iceland was not only early in tackling the coronavirus, it has done so with great success. And yet it seems that the contact tracing app played a relatively small part in that. Manual tracing techniques, by contrast, were absolutely key.

That's not to say other countries may not have more success with their apps. It's interesting to note, for example, that Iceland's Rakning C-19 tracks users' GPS data in order to establish where they have been, and who they met with. It's generally agreed that GPS information is too coarse for this, and that a Bluetooth approach should, in theory, provide better insights. It will be interesting to hear how apps based on Bluetooth interactions work in practice. Maybe they will provide the hoped-for means to bring the COVID-19 virus under control. Let's hope so, and that the eager embrace by governments of contact tracing apps is not just another example of "solutionism" -- the idea that any problem can be solved simply by throwing technology at it.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: contact tracing, covid-19, gps, iceland, rakning

Hard Pass: Clearview Offers To Help Out With COVID-19 Contact Tracing

from the [incoherent-screaming-into-the-void] dept

Clearview AI is inserting itself into a discussion no one invited it to participate in. The discussion around contact tracing to manage and (hopefully) impede the spread of the coronavirus involves multiple governments around the world. It also includes Google and Apple, who are partnering to create a platform for contact tracing apps.

At least in the case of Google and Apple's offerings, there appears to have been a serious discussion about protecting users' privacy as much as possible while still offering a valuable service to government health agencies and people concerned about contracting the virus.

Now, Clearview has blundered into the discussion -- a company that has shown utter disdain for the millions of people it has force-fed to its multi-billion image database via social media site scraping. There is no opting in or out of this collection -- one that Clearview is selling to law enforcement agencies in the US and to government agencies around the world. If it's on the web, it's likely already in Clearview's database.

In a brief discussion with NBC News, CEO Hoan Ton-That pitched his idea for a Clearview-based contact tracing program. What Ton-That wants to do is tie his app and its database to thousands of CCTV cameras located in stores, parking lots, gyms, and other locations where, as he puts it, "there's no expectation of privacy." Ton-That doesn't explain how his system will be notified of a person's COVID status, but he's pretty sure his software will be able to recognize faces accurately. Clearview's facial recognition AI remains unproven, but it's supposedly capable of making guesses about faces using images as small as 110x110.

Ton-That also seems unconcerned about the privacy implications of adding people's health status to his enormous database of scraped personal information. He says any limitations on gathering/storage of this info would be up to whoever decides to take him up on his unsolicited offer.

Obviously, no one should do this. The AI is unproven and Clearview is far from trustworthy. Activist group Fight For The Future has issued its official statement on Clearview's contact tracing pitch. It's short but punchy.

“Absolutely the fuck not,” said Evan Greer (she/her), the groups Deputy Director.

As FFTF points out, adding Clearview to the mix just adds more potential privacy violations to the mix by dumping people's health info into a database that's already being accessed by a number of private companies and government agencies around the world. Ton-That appears to assume that anyone in a "public" area is fair game for his company. Adding thousands of cameras operated by hundreds of private companies would provide a steady flow of facial images (some tied to very personal information) into his database, making his product even more enticing to government agencies.

Hopefully, no one will let Clearview near any of this. Facial recognition adds nothing to contact tracing -- something that can be done almost anonymously using the platform developed by Google and Apple. Hoovering up facial images -- along with location data and health info -- is a privacy nightmare. And there's probably no company that should be trusted less with your personal info than Clearview, which has repeatedly demonstrated it cares nothing about the millions of people it has turned into fodder for its unproven tech.

Filed Under: artificial intelligence, contact tracing, facial recognition, hoan ton-that, privacy, trade-offs
Companies: clearview, clearview ai

Israel's High Court Blocks Country's Hastily-Erected Domestic Coronavirus Surveillance Program

from the all-shin-bets-are-off dept

When the coronavirus crisis hit, several countries saw an opportunity to engage in/expand domestic surveillance. Unsurprisingly, China and Hong Kong were some of the first to step up their snooping. But it was Israel that quickly deployed one of the more concerning virus-tracking programs: opening up a massive collection of cellphone data to its national security force, Shin Bet.

This was done without any legislative discussion or input from the millions of stakeholders whose cell data had just become a plaything for Shin Bet. To make matters worse, the backup plan involved Israel's premier malware merchant, NSO Group, which has offered its spy tools to governments to spy on journalists, attorneys, and activists.

Prime Minister Benjamin Netanyahu's unilateral declaration that telcos' data stores were open for government business may have been premature. While there's definitely value in tracking infected members of the population, a more voluntary program would have been the place to start.

The nation's High Court has at least temporarily blocked Shin Bet's use of cell location data.

[T]he ruling states that, “The choice to make use of the state’s preventative security agency to follow those who do not seek to do [the state] harm, without the subjects of the surveillance giving their permission, raises an extremely serious difficulty and a suitable alternative should be sought that fulfills the principles of privacy protection.”

The court says that if the government wants to do this, it needs to create legislation first -- something that will establish guidelines for use of the data collection, as well as provide an expiration date for this specific authority.

This isn't necessarily what the government wanted to hear. Haaretz reports a classified meeting between the country's Foreign Affairs office and the Defense subcommittee discussed concerns about the Shin Bet effort. But officials weren't concerned about the privacy issues the court raised in its decision. Instead, they were discussing a National Security Council report that said that if the government didn't do this, the other alternatives were pretty much useless.

Among other things, the report stated that the primary alternative would be monitoring by NSO group, an Israeli Surveillance company, to which Attorney General Avichai Mendelblit objected because it would undermine residents’ privacy. It was also argued that there is a huge number of people who use kosher phones that cannot download apps, and that this was an impediment.

Yes, you read that correctly. The government's National Security Council argued the NSO effort would undermine privacy. Somehow the same conclusion wasn't drawn about the country's national security agency using the same data.

In more helpful news, the High Court also ruled journalists' data off-limits. If journalists wish to be tracked as part of the temporarily-halted surveillance program, they will need to consent to the collection. Obviously, most journalists will opt out, given the risk this surveillance poses to their sources. Those seeking to opt out can obtain a restraining order from the court to block Shin Bet's access to their records.

All in all, it's a good thing someone's attempting to rein in government overreach in a time when a lot of government activity is going to go unquestioned. This still leaves unanswered questions about the virus-related surveillance -- namely how long it's going to last and how easy it will be to uncouple the government from this data when it's all over. Hopefully, the mandated legislation will answer the questions the Prime Minister apparently didn't ask before authorizing this new form of domestic surveillance.

Filed Under: contact tracing, covid-19, israel, mobile phone data, privacy, shin bet, surveillance
Companies: nso group

European Commission Wants Coronavirus Tracing Apps To Build In Strong Protections For Privacy -- Unlike The French Government

from the essential-requirements dept

Techdirt has just written about France's incredibly hypocritical attitude to privacy when it comes to contact tracing apps for COVID-19. The European Commission seems to be rather more consistent in this area. As well as pushing privacy legislation like the GDPR and ePrivacy Directive, it has released a series of documents designed to help EU Member States create tracing apps without compromising on citizens' privacy. For example, on April 8, it adopted a "Recommendation to support exit strategies through mobile data and apps", which called for "a joint toolbox towards a common coordinated approach for the use of smartphone apps that fully respect EU data protection standards". Details followed a week later, when the European Commission announced a pan-EU toolbox for "efficient contact tracing apps to support gradual lifting of confinement measures". A 44-page document spelled out in some detail (pdf) the "essential requirements" for national apps deployed in the region -- that they should be:

voluntary;

approved by the national health authority;

privacy-preserving -- personal data is securely encrypted; and

dismantled as soon as no longer needed.

Finally, as if to underline the importance of respecting citizens' privacy yet further, the European Commission released another communication (pdf) providing "Guidance on Apps supporting the fight against COVID 19 pandemic in relation to data protection". The whole section on security is worth reading in full, since it offers a good summary of the current thinking on the best ways to preserve privacy with these apps:

The Commission recommends that the data should be stored on the terminal device of the individual in an encrypted form using state-of-the art cryptographic techniques. In the case that the data is stored in a central server, the access, including the administrative access, should be logged.

Proximity data should only be generated and stored on the terminal device of the individual in encrypted and pseudonymised format. In order to ensure that tracking by third parties is excluded the activation of Bluetooth should be possible without having to activate other location services.

During the collection of proximity data via [Bluetooth Low Energy communications between devices] it is preferable to create and store temporary user IDs that change regularly rather than storing the actual device ID. This measure provides additional protection against eavesdropping and tracking by hackers and therefore makes it more difficult to identify individuals.

The Commission recommends that the source code of the app should be made public and available for review.

Additional measures to secure the data processed can be envisaged notably with automatic deletion or anonymisation of the data after a certain point in time. In general, the degree of the security should match the amount and sensitivity of personal data processed.

All transmissions from the personal device to the national health authorities should be encrypted.

The contrast between this rigorous and comprehensive approach to safeguarding the rights of citizens and France's cavalier disregard for the same, is stark. Unfortunately the Commission's guidance is not legally binding and is likely to be ignored by the French government, which often insists on going its way, as with its terrible implementation of Article 17 of the EU Copyright Directive.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: contact tracing, covid-19, eprivacy directive, eu, france, gdpr, privacy

French Hypocrisy: Fines Google For Being Soft On Privacy; Now Angry That Google Won't Let It Spy On Users

from the who-said-what-now? dept

We keep trying to explain to people that privacy is always about trade-offs, and arguing for privacy laws that protect "privacy" as if it's a constant thing, will run into trouble. Most of that trouble is in the form of locking in big companies, but sometimes, the trouble is in showing you why understanding trade-offs matters so much.

France has been among the most vocal critics of "big internet companies" and demanding various regulatory pressures be used to punish them. Last year it fined Google $57 million for breaching privacy laws, and appears to be angling for even larger fines.

So it's difficult not to burst out in laughter after finding out that the French government is really, really mad that Google and Apple are protecting people's privacy, when suddenly the French government wants to use those companies to engage in contact tracing. Indeed, it's literally demanding both companies ease their privacy protections to help France track people who might have COVID-19.

France has become the first country to call publicly for Apple and Google to weaken privacy protections around digital contact tracing, after its government admitted that its current plans would not work without changes to smartphone operating systems.

The issue is that, as you likely recall, earlier this month, Google and Apple collaborated on an API system to enable some form of contact tracing in various apps, but that is (a) voluntary, (b) privacy retaining (via regularly rotating identifiers), and (c) limits how much information would be sent to the government. And apparently that's getting in the way of France's more aggressive tracking plans:

France wants to deploy its app by 11 May, without using the special measures Apple and Google have put in place, which are targeted for release in mid-May. That means the country will be forced to use the more limited features already built into iOS, unless Apple changes its policies and allows for far more invasive use of the Bluetooth radio at the heart of its devices.

It's quite incredible to see this play out in practice, in France of all places. Again, the French government has been among the most vocal and aggressive in attacking Google and insisting that its privacy practices are terrible... but as soon as those privacy efforts get in the way of the French government spying on people's whereabouts, its suddenly mad at these companies for doing too much to protect privacy? Maybe Google should see if the French government wants to pay back the fines it levied before it'll take the government's requests seriously.

Filed Under: contact tracing, covid-19, france, gdpr, hypocrisy, privacy
Companies: apple, google