Apple and Google announce a joint effort to introduce iOS and Android APIs in mid-May for opt-in Bluetooth-based COVID-19 contact tracing

A huge step forward in the fight against COVID-19 — Apple and Google announced a system for tracking the spread of the new coronavirus …

The Verge 2020-04-11

Discussion

Vox Vox on x
Apple and Google want to turn your phone into a Covid-tracking machine
@tim_cook Tim Cook on x
Contact tracing can help slow the spread of COVID-19 and can be done without compromising user privacy. We're working with @sundarpichai & @Google to help health officials harness Bluetooth technology in a way that also respects transparency & consent. https://www.apple.com/...
@sundarpichai Sundar Pichai on x
To help public health officials slow the spread of #COVID19, Google & @Apple are working on a contact tracing approach designed with strong controls and protections for user privacy. @tim_cook and I are committed to working together on these efforts. https://blog.google/...
@pogue David Pogue on x
This is SO BRILLIANT. @Apple and @Google are teaming up to develop completely private, opt-in, Bluetooth contact tracing. Example: if you're exposed to someone who's tested COVID positive, you'll get a notification, so you can get yourself tested... https://www.apple.com/...
@max_read Max Read on x
i dont get the idea that americans wont agree to public-health surveillance. just a few weeks ago people were like “americans will never agree to large-scale lockdowns” and then they did. americans love to follow the law! unless they are the law or have its boot on their neck
@ashk4n Ashkan Soltani on x
On a lighter note — oh to be a fly on the wall when the @Apple and @Google PR teams were forced to create this logo... “We need a bold line — almost like a firewall — dividing the two.... and more whitespace... MORE” https://twitter.com/...
@caseynewton Casey Newton on x
Is there anything in the Apple/Google API to stop me from pretending I tested positive to troll everyone my phone passed on the street? They'll never know who triggered the alert, right? Seems ripe for abuse.
@ashk4n Ashkan Soltani on x
Bluetooth signals traverse walls, linking you to your neighbor even if you've never actually been in actual physical contact (for example, in an apartment building).
@panzer Matthew Panzarino on x
Here's how the system works, basically https://twitter.com/...
@pkafka Peter Kafka on x
Everything Apple and Google are saying here seems helpful. Next q: Assuming the tech works/is useful, how will we get people to download and use the tracing apps? https://www.apple.com/...
@waltmossberg Walt Mossberg on x
Kudos to @Apple and @Google for cooperating on contact tracing to help curb infections. But they are not actually building an app, just making it possible. I wish the companies were making the app and auto-installing it. People would still have to opt in, but usage would rise. ht…
@reckless Nilay Patel on x
Huge news from Apple and Google: partnership on Bluetooth APIs for virus contact tracing https://www.theverge.com/...
@neilcybart Neil Cybart on x
Apple and Google are partnering together to help get a contact tracing apparatus off the ground in an effort to battle the pandemic. Contact tracing has been positioned as a tool for navigating the next ~18 months until a vaccine becomes available. https://www.apple.com/... https…
@lam_barrett Lindsey Barrett on x
combine that with a dataset that does include a person's movements, purchases, etc, and things still get pretty revealing pretty quickly. but hey, it's not like *checks notes* apple or google have other sources of information about you https://twitter.com/... https://twitter.com/…
@ashk4n Ashkan Soltani on x
While the privacy of @Apple/@Google contact tracing system look robust (user-controlled rolling ephemeral subkeys) — the architecture still side-steps the HARD issue of how-to verify if a user is actually diagnosed (vs is just 'crying wolf') #abusability https://www.apple.com/...…
@caseynewton Casey Newton on x
This is a common misconception about what's happening. Google and Apple aren't jointly releasing a contact tracing app. They're creating an API that public health apps can use. Which means you still need to figure out a way to get people to download a 3rd party app. Very hard. ht…
@jsnell Jason Snell on x
Apple has experience with something similar to contact tracing thanks to the new Find My system. Probably gave them a head start. Good to see Apple and Google doing this and emphasizing consent and privacy. https://sixcolors.com/...
@pkafka Peter Kafka on x
I keep seeing references to a 60% usage rate to make contact tracing effective. Is that a real number? How would we get there? Let's assume that at least a third of the country won't participate bc of range of objections, from well-founded to tinfoil-hat-wearing. https://twitter.…
@samfbiddle Sam Biddle on x
just think of all the insanely invasive things americans have welcomed over the past decade in the name of amusement or slight convenience, now imagine what they'll accept if they're told it might help them not die https://twitter.com/...
@patrickc Patrick Collison on x
Well done, Apple and Google. https://twitter.com/...
@panzer Matthew Panzarino on x
@waltmossberg @Apple @Google That's phase 2 of the project. It will be eventually pre-installed at an OS level on Android and iOS.
@kaifulee Kai-Fu Lee on x
Opt-in contact tracing won't work. If 10% people opt-in, 50% always-on bluetooth, 40% people infected voluntarily report, then only 10%*10%*50%*40%= 0.2% pairwise contacts get reported. Am I missing something? https://twitter.com/...
@benedictevans Benedict Evans on x
Apple/Google partner on automatic, anonymised bluetooth-based contact tracing. Very clever. https://twitter.com/...
@raamana_ @raamana_ on x
FINALLY: a bluetooth based decentralized framework for digital contract tracing by Apple & Google I expected NSA/CIA to step up early-on with their massive abilities and infra to track and map the #COVID19 spread precisely but nothing so far! https://www.theverge.com/... @Techmem…
@drericding Eric Feigl-Ding on x
I am glad Apple and Google are moving forward in developing contract tracing technology to help public health. What it will look like will need to be seen. But we may need to exchange a little piece privacy for great good of public health. #COVID19 https://www.apple.com/...
@zephyrteachout Zephyr Teachout on x
Contact tracing is important Basic questions: Have Google and Apple committed to destroying all health information gathered and not using it for any advertising purposes? What oversight provisions is the gov putting in place so contact tracing info isn't used for targeting ads? h…
@tylerwinklevoss Tyler Winklevoss on x
Big Brother inside? https://www.wsj.com/...
@rontkim Ron T. Kim on x
This is the moment our nation goes from surveillance capitalists to a surveillance state. We need decentralized, self sovereign technology, not hyper centralized opt-in solutions. https://www.apple.com/...
@matthew_d_green Matthew Green on x
I feel like the crypto in the COVID tracing apps is so simple that it doesn't need much explanation. But I also see plenty of people nervous about the privacy these things provide. Is it worth explaining?
@glennf Glenn Fleishman on x
Effectively, they figured out a way (that's very similar to Apple's Find My system) to provide anonymized and cryptographically protected information that can only be checked by individual devices and only with the release by one party of non-identifying crypto data.
@glennf Glenn Fleishman on x
I just dug into the Apple/Google COVID-19 tracing system, and it's a lot of good decisions. It provides anonymity, privacy, and protects against spoofing. Full report coming shortly at @TidBITS
@juddlegum Judd Legum on x
This is the best news I've heard in awhile. We need to ramp up testing dramatically but testing needs to be paired with contact tracing. Google and Apple are teaming up to automate this process by embedding technology in their smart phone apps. https://www.nytimes.com/...
@timmarchman Tim Marchman on x
This sounds really promising; on the other hand Bluetooth can't reliably pair a phone I've had for four years to a car I've had for five https://twitter.com/...
@rafiletzter Rafi Letzter on x
I've written articles about the initial proposals around this stuff and the one thing researchers are absolutely clear on is that if this is gonna work in America it has to be handled by parties accountable only to the public. https://twitter.com/...
@antoniocasilli Casilli on x
“To bully governments into adopting privacy-invasive, discriminatory, and ineffective surveillance measures under the cloak of coronavirus-fighting app, Google and Apple are working on implementing OS-level proximity tracing. Tim Cook and I are dangerous political adventurists.” …
@kashhill Kashmir Hill on x
For a different, non opt-in version of this, let's look to a month ago in China, when it rolled out a mystifying app that gave citizens color codes for their danger level: https://www.nytimes.com/...
@rafe Rafe Needleman on x
Contact tracing is the nuclear energy of technology right now. Amazing potential to help cure the world, and terrifying power if/when it is used for ill. https://www.theverge.com/...
@lexialex Lexi Alexander on x
I'm conflicted. Someone on a TV show I just watched made a good case for this...but knowing all of our governments...they will abuse this https://twitter.com/...
@balajis Balaji S. Srinivasan on x
As WHO and the UN fail ingloriously, global tech companies are filling the void. Multinational institutions that can actually execute. https://twitter.com/...
@kashhill Kashmir Hill on x
Apple & Google teaming up to trace everyone who could potentially have coronavirus is another science fiction plot made real. This is all “opt in” but how long does that last? What privacy looks like in post-pandemic world is unimaginable to me right now. https://www.nytimes.com/…
@fredbenenson @fredbenenson on x
Apple and Google's idea is smart and could make a huge difference in combating COVID19. And before you let a knee jerk privacy reaction set in, take the time to understand how it will work: • it is not tracking your location • it is opt-in • it is decentralized https://twitter.co…
@chrismessina Chris Messina on x
COVID19 tweets of the year? https://twitter.com/... https://twitter.com/... #ContactTracing https://twitter.com/...
@janelytv @janelytv on x
Note also that the infected person themselves has to report their status to the apps. According to the BBC, Trump is expected to endorse this partnership during the press conference today. Documentation for: - Google: https://www.blog.google/... - Apple: https://www.apple.com/...
@afp @afp on x
In Europe, officials, doctors and engineers look at how smartphones could be enlisted in the war against the spread of the #coronavirus, but can this be done without intrusive surveillance and access to a wealth of private information? https://news.yahoo.com/... https://twitter.c…
@llsethj Seth Weintraub on x
Feel like Apple will be opt-in and Google will be opt-out https://twitter.com/...
@nytimestech @nytimestech on x
In today's On Tech, @shiraovide poses two questions about pandemic-fighting technology: Does it work? Is it creepy? https://www.nytimes.com/...
@khanoisseur @khanoisseur on x
Apple and Google are partnering on technology for smartphones that will alert users if they've come into contact with a person with Covid-19 (but could be useful later for HIV, Ebola and other diseases). People must opt in and “privacy advocates” may fight this. https://twitter.c…
@acedtect Tom Merritt on x
Yesterday on @dailytechnewssh @arielwaldman talked about why Bluetooth tracking might not be as good as using human interviews. Today's @verge article from @CaseyNewton details why she's right https://www.theverge.com/...
@nprpolitics @nprpolitics on x
CDC Director Robert Redfield says the agency is working on a plan to ramp up America's capacity for “very aggressive” contact tracing of those who test positive for the coronavirus. https://www.npr.org/...
@natfriedman Nat Friedman on x
Huge thanks to Apple and Google for building privacy-preserving contact tracing into iOS and Android. Tech is emerging as a pillar of civilization and a critical reservoir of competence. https://www.theverge.com/...
@pkafka Peter Kafka on x
@felixsalmon @hblodget I mean, you could do ad hoc stuff so that anyone who wants to see an NFL game in person needs to opt-in, and I guess the NFL could run that? Etc. But that's not getting you to real contact tracing.
@cwarzel Charlie Warzel on x
I am very very very skeptical that people (especially the people who are like 'open the economy now mr president i want my freedom') will agree to contact tracing
@pkafka Peter Kafka on x
@felixsalmon @hblodget Well - Apple and Google won't make you download it. But I can certainly see it being tied to things you'd like to do, like travel, apply for bailout $, etc.
@trycatchhcf @trycatchhcf on x
Practice responsible social distancing. Also, keep Bluetooth turned off. That advice was solid long before the pandemic, but you know full well that this initiative is a hell of a slippery slope. https://twitter.com/...
@hblodget Henry Blodget on x
App-based contract tracing will be a critical tool for USA to move past this quickly. Judging by response when I point this out, it will also face huge resistance from Americans who view it as a non-starter privacy intrusion. https://twitter.com/...
@ashk4n Ashkan Soltani on x
This type of approach is likely to generate significant FALSE POSITIVES and FALSE NEGATIVES — which is highly problematic when this data is (eventually) used to make decisions that will affect citizen's freedoms — voluntarily or not.
@seanspicer Sean Spicer on x
while we must do every we can to overcome #coronavirus they need to explain much more about their commitment not collect personal data: via @washingtonpost @Apple, @Google debut major effort to help people track if they've come in contact with coronavirus http://t.com/...
@carnage4life Dare Obasanjo on x
Love the privacy model behind this workflow. Really great to see Apple & Google collaborating on this. https://twitter.com/...
@joannastern Joanna Stern on x
The fact that Apple is involved here, btw, makes me feel a lot more confident in the privacy behind it all. https://twitter.com/...
@carnage4life Dare Obasanjo on x
Apple & Google are both going to add OS-level APIs to enable contact tracing apps that use Bluetooth LE to track whoever you've been close to that later tests positive for #COVID19. This is the only way we can get back to normal until vaccine but still 🤨 https://www.theverge.com/…
@hblodget Henry Blodget on x
@felixsalmon Yes. Apple and Google are building APIs that will provide location info to government apps. Government agency or agencies will have to build those apps and persuade people to use them.
@joshuatopolsky Joshua Topolsky on x
You know this is a crazy virus if you got Apple and Google to join forces to literally make THE PHONE TRACKING SHIT FROM THE DARK KNIGHT https://www.inputmag.com/...
@davedufournba Dave DuFour on x
Good to see them put their beef aside for public health, but I'm still not sure how you turn the data faucet off when this is all over. Governments don't usually relinquish this sort of power. Civil liberties groups will be working overtime when this is all over with https://twit…
@aslavitt Andy Slavitt on x
BREAKING: New infrastructure for contract tracing is coming to our phones using Bluetooth. Strong privacy protections— but I hope EVERYONE opts in for one another. This is time to pull together in new ways. Thank you to @Apple & @Google https://www.apple.com/...
@atulbutte Atul Butte on x
This is HUGE news! There are no guarantees here, but digital contact tracing like this might be one way forward out of lock-downs... (would need to get the #SARSCoV2 results consistently reported and linked to our phones, through #FHIR?) https://twitter.com/...
@chriswelch Chris Welch on x
Truly a fascinating use of technology. Apple and Google are partnering up to track coronavirus and build contact tracing into iOS and Android. https://www.theverge.com/... https://twitter.com/...
@nicnguyen Nicole Nguyen on x
What's most interesting about this is that it seems to not actually be about location data—it's about proximity data (ie, what other phones were nearby the infected persons' phone) https://twitter.com/...
@sethsandler Seth Sandler on x
Google and Apple launching coronavirus contact-tracing system for iOS and Android. https://www.theverge.com/...
@markgurman Mark Gurman on x
Major news from Apple and Google: The companies have partnered to add Covid-19 contact tracing to iOS and Android so your phone can notify you if you've come into contact with a person who has tested positive. Frameworks for public health apps in May, deeper OS integration later.
@chillmage @chillmage on x
Apple and Google are working together to make iOS and Android devices capable of letting you know if you came in contact with someone infected with coronavirus https://twitter.com/...
@caseynewton Casey Newton on x
Last point for now: 80 percent of the commentary you read about this today is going to be about the privacy implications. But before we even get there, we need to talk more about why people think that Bluetooth-based contact tracing is an effective way of tracking exposures.
@stroughtonsmith Steve Troughton-Smith on x
Wild. This is a reasonable signifier that at least some of the original plans for iOS 14 may be out the window in favor of urgently addressing pandemic-related needs: https://www.apple.com/...
@willoremus Will Oremus on x
This might be what we need, but announcing it on a Friday afternoon is shady as hell. https://twitter.com/...
@profcarroll @profcarroll on x
apple and google will not save us
@mcwm Mike Murphy on x
that's a lockup a never expected to see... https://www.apple.com/... https://twitter.com/...
@reckless Nilay Patel on x
That said, the only way this works if if the two dominant platform providers collaborate, so Apple and Google teaming up is a massive development. And they have already shared the spec, so they are being transparent about it.
@fredwilson Fred Wilson on x
And just like that Apple and Google announce a partnership on tracing “Apple, Google Bring Covid-19 Contact-Tracing to 3 Billion People” https://www.bloomberg.com/...
@joannastern Joanna Stern on x
This is fascinating and also frightening. https://twitter.com/...
@jbarro Josh Barro on x
What about BlackBerry? https://twitter.com/...
@sethjlevy @sethjlevy on x
Just know that law enforcement will access and use this data against you. https://twitter.com/...
@caseynewton Casey Newton on x
Wow. Potentially huge. https://twitter.com/...
@superscientific Danny Winget on x
Wow. I actually think this is a good idea. What do you think? https://twitter.com/...
@carlquintanilla Carl Quintanilla on x
“If a person learns they have coronavirus, they could indicate on their app they've been infected — and people whose smartphones have been in their vicinity would be notified, regardless of whether their devices run on Apple's or Google software.” $AAPL https://www.washingtonpost…
@mattcutts Matt Cutts on x
This is wonderful + huge news about Apple and Google coming together with an approach to contact tracing: https://www.washingtonpost.com/ ... Really happy to see this.
@reneritchie Rene Ritchie on x
Apple and Google partner on COVID-19 contact tracing technology “First, in May, both companies will release APIs that enable interoperability between Android and iOS devices using apps from public health authorities. ” https://www.apple.com/...
@ashk4n Ashkan Soltani on x
While I suspect these tools will be framed as ‘voluntary / opt-in’ — they will eventually become compulsory once policymakers begin to rely on them in order to decide, for example, who can leave the house or who can return to work — setting an incredibly dangerous precedent.
@ashk4n Ashkan Soltani on x
This is what happened in China — where Chineses citizens needed to show their ‘red/orange/green’ code before they were permitted to leave the house or to use public trans, etc https://www.nytimes.com/...
@panzer Matthew Panzarino on x
Apple has pushed specs on its site here, Google should do so soon as well. https://www.apple.com/...
@zackwhittaker Zack Whittaker on x
This seems like a better-than-most approach. Privacy-focused, opt-in (via an app), cross-platform, and doesn't use location. https://techcrunch.com/... https://twitter.com/...
@panzer Matthew Panzarino on x
Some details: Privacy focused tool that uses Bluetooth and rotating identifiers that have no location or PID. https://twitter.com/...
@tonyromm Tony Romm on x
NEW: Apple, Google unveil major new effort to use their smartphones to help people see if they've come in contact with coronavirus. Major new contact tracing effort via bluetooth. https://www.washingtonpost.com/ ...
@panzer Matthew Panzarino on x
Wild news and BIG for tracking COVID-19. Apple and Google are launching a contact tracing tool for Android and iOS. https://techcrunch.com/...
@hypervisible @hypervisible on x
“... for now it seems worth saying that there's little evidence that phones are good at contact tracing — and a lot of evidence that human beings are.” https://www.theverge.com/...
@malteengeler Malte Engeler on x
“Why has surveillance become the only device through which we can effectively act?” Open letter to the #DP3T GutHub. #Corona #Tracking https://github.com/...
@granick @granick on x
Let's stop talking about using location data to identify individuals that were in close contact and could have been infected by a person testing positive. It doesn't work: https://www.aclu.org/...
@hypervisible @hypervisible on x
With some notable exceptions, a LOT of the discussions about using computational tools to address the pandemic largely ignored the impact these “fixes” would have on vulnerable populations, so this essay is a welcome addition. https://github.com/...
@bradlander Brad Lander on x
But even beyond the privacy, feasibility, and enforcement concerns (and there are many), it's not clear bluetooth apps will really work. So we will need to hire a lot of people to work on contact tracing. By definition, this is a local & state effort. https://www.theverge.com/...
@ashk4n Ashkan Soltani on x
MOST IMPORTANTLY there's a REAL risk of abuse from these apps — generating false alarms and Denial-of-Service attacks from people falsely flagging that they're infected with COVID19 (crying 'wolf) — thereby potentially affecting the others they've digitally been in contact with
@zackwhittaker Zack Whittaker on x
Earlier this week, the ACLU warned about the limits of using location tracking during the coronavirus pandemic. Made some really thoughtful points. Would be curious to see what @granick and @jaycstanley think about this latest effort. https://www.aclu.org/...
@pinboard @pinboard on x
The professional privacy crowd is being intentionally obtuse about the possible uses of location data in epidemiological tracking, as demonstrated in this white paper. Thread: https://twitter.com/...
@rowlsmanthorpe Rowland Manthorpe on x
Amazing stat in @CaseyNewton's latest column. One public health expert says that to do contact tracing effectively (ie. not with Bluetooth), the US would need to hire *300,000 people* to work in phone banks and knock on doors https://www.theverge.com/... https://twitter.com/...
@kennethbaer Kenneth Baer on x
Excited about the Apple/Google announcement about Bluetooth-enabled contact tracing for #COVIDー19 exposure? Read this bucket of cold water from @CaseyNewton https://www.theverge.com/...
@kevinroose Kevin Roose on x
I share a lot of the skepticism about contact tracing, but the adoption part I think could be surprisingly easy. If you tell people the only way they can see their parents, go to church, eat at a restaurant, etc. is to download an app, they'll do it. https://twitter.com/...
@geoffreyfowler Geoffrey A. Fowler on x
Bluetooth tracing has promise, but is experimental, says @jsrailton “We've all spotted our neighbor's BT speaker through a wall or a floor. Or seen someone's headset in a traffic jam. That doesn't mean we will ever come within droplet distance of them.” https://www.washingtonpost…
@hblodget Henry Blodget on x
Agreed. And if usage of the app is not compulsory— or at least heavily incentivized — I just don't see enough people using it. Also, if CDC or other government agency doesn't know who may have been exposed, how do they follow up? How do they find clusters before more infected? ht…
@caseynewton Casey Newton on x
There's been a lot of writing recently about the use of apps to help us track exposure to COVID-19. I talked to public health experts this week who explained why they're unlikely to be effective https://www.getrevue.co/... https://twitter.com/...
@mantzarlis Alexios on x
<3 @CaseyNewton's caveat. Great to underscore uncertainty. https://www.getrevue.co/... https://twitter.com/...
@jtemple James Temple on x
To say nothing of (a phrase that makes no sense) the high risk of false positives that @CaseyNewton highlights: https://www.getrevue.co/...
@dseetharaman Deepa Seetharaman on x
Voluntary participation is crucial, per public health experts & ACLU, but I'm curious how many Americans will download a health app. Per @CaseyNewton last night, ~12% of Singapore's population had its Bluetooth-based contact tracing app. https://www.getrevue.co/... https://twitte…
@xor Parker Higgins on x
Some of the more invasive proposals for contact tracing could make it harder for whistleblowers to anonymously get critical information to the press. That's a health and safety issue, too.
@reckless Nilay Patel on x
There's a lot of controversy around contact tracing using apps — @CaseyNewton wrote about it just yesterday. False positives are a big deal here. https://www.theverge.com/...
@caseynewton Casey Newton on x
It could also reduce likelihood of state agencies to invest in what we know works: hiring human beings to get out on the street and make phone calls. I'm open to the idea of this being effective. I hope it is. But public health experts have been extremely skeptical.
@caseynewton Casey Newton on x
From Duke: “Cell phone-based apps recording proximity events between individuals are unlikely to have adequate discriminating ability or adoption to achieve public health utility, while introducing serious privacy, security, and logistical concerns.” https://healthpolicy.duke.edu…
@caseynewton Casey Newton on x
Facebook is already getting inquiries from government agencies about working on contact tracing. I expect other big tech companies are as well. But I've yet to see a persuasive case that their involvement would be effective. If you believe otherwise please let me know!
@caseynewton Casey Newton on x
Just today, I wrote about why Bluetooth-based contact tracing is a flawed solution. - Hard to get population-wide adoption. Singapore managed to get 12%. - BLE data collection is not granular to the level of 6 feet. Can lead to many false positives. https://www.theverge.com/...
@sedyst SedaG on x
Privacy analysis on decentralised apps changes when tracing apps track globally, and are not interoperable instances managed by different organisations/government entities but global infrastructure. Not sufficient to analyse protocol only and here you start seeing the difference.…
@ctbeiser Chris Beiser on x
i usually don't RT threads to debunk them but this one is particularly bad and dumb point one is about a decrease in privacy. if I have coronavirus, allowing the last three days of my bluetooth presence to be correlated together doesn't really sound like the worst. https://twitte…
@moxie Moxie Marlinspike on x
So first obvious caveat is that this is “private” (or at least not worse than BTLE), *until* the moment you test positive. At that point all of your BTLE mac addrs over the previous period become linkable. Why do they change to begin with? Because tracking is already a problem.
@moxie Moxie Marlinspike on x
So it takes BTLE privacy a ~step back. I don't see why all of the existing beacon tracking tech wouldn't incorporate this into their stacks. At that point adtech (at minimum) probably knows who you are, where you've been, and that you are covid+.
@onekade @onekade on x
ACLU comment on the Apple/Google contact tracing scheme https://www.aclu.org/...
@moxie Moxie Marlinspike on x
That seems untenable. So to be usable, published keys would likely need to be delivered in a more ‘targeted’ way, which probably means... location data.
@tante @tante on x
Interesting thread with some thoughts on why Google/Apple does make people trackable in unintended ways (if they have covid) why probably location association will be implemented (otherwise the downloads of keys will be too large) https://twitter.com/...
@moxie Moxie Marlinspike on x
Not to mention the “prank” aspect of being able to light up everyone you've been near's devices with “you've been exposed to covid” (without them knowing you're the culprit) at any time, without some kind of pretty heavy manual ID/result verification at the moment of reporting.
@moxie Moxie Marlinspike on x
Second caveat is that it seems likely location data would have to be combined with what the device framework gives you. Published keys are 16 bytes, one for each day. If moderate numbers of smartphone users are infected in any given week, that's 100s of MBs for all phones to DL.
@jameeljaffer Jameel Jaffer on x
Illuminating thread about Apple / Google contact-tracing proposal. https://twitter.com/...
@glennf Glenn Fleishman on x
Great analysis from Moxie on the Apple/Google COVID-19 privacy-oriented tracing framework. B/c testing positive and reporting it releases to all devices keys associated with you, a Bluetooth-snarfer (run by ad-tech firms) in a given space could reconstruct your identity. https://…
@moxie Moxie Marlinspike on x
Third caveat is that it seems likely some kind of PII would have to be combined with what the device framework gives you. Keys published by a device have to then be in turn “published” to *all* devices in the world. That's a major DoS vector!
@moxie Moxie Marlinspike on x
If anyone can anonymously blast up keys, they can create a situation where there's GBs of data for all devices in the world to retrieve and compute. There would likely need to be some kind of rate limiting on a combination of stable IDs (phone number, IP, etc) to prevent it.
@rachelbovard Rachel Bovard on x
This thread explains how the Apple/Google corpstate will track people and let their adtech stacks know about it. 👇 https://twitter.com/...
@moxie Moxie Marlinspike on x
3) Your device keeps track of all “proximity IDs” it sees. 4) If someone tests positive, they choose to publish their (previously secretly) “daily tracing keys.” 5) Your device frequently DLs all published daily tracing keys and KDFs to see if they match recorded proximity IDs.
@moxie Moxie Marlinspike on x
All that aside, these APIs are novel in terms of what becomes possible from the app layer. I'm not super optimistic about opt-in contact tracing becoming a major factor, but I do kind of anticipate that someone will end up using this for some other interesting thing.
@antoniocasilli Casilli on x
It seems that the Apple/Google solution has the same privacy problem as other proximity tracers: it's anonymous as long as you are not positive. Moreover it'll most likely be linked to geoloc data+risk of linking to adtech+possibility of proximity “pranks” https://twitter.com/...…
@matthew_d_green Matthew Green on x
Looking forward to Apple v. FBI round 2: COVID-positive edition.
@matthew_d_green Matthew Green on x
I guess Moxie has a nice Twitter thread here. He found more potential worries than I would have, maybe we have different concern thresholds. https://twitter.com/... https://twitter.com/...
@mikarv Michael Veale on x
I really welcome the proportionate API moves, and the fact the proposed A-G collaborative protocol is decentralised is good. But going forward societies and communities need to have much more say in what gets put in operating systems, and how they can refuse it. https://twitter.c…
@ashk4n Ashkan Soltani on x
Reading between the lines — this API seems like a defensive play by @Apple / @Google designed to push back against the administrations efforts to get them to build a national #COVID19 surveillance network. https://www.politico.com/... https://twitter.com/...

Chronicles

Apple and Google announce a joint effort to introduce iOS and Android APIs in mid-May for opt-in Bluetooth-based COVID-19 contact tracing

Related Coverage

Discussion