US is taking a state-by-state approach to COVID-19 contact tracing apps, which could cause security and privacy issues in addition to hindering interoperability
With no nationwide Covid-19 notification software in sight, security and interoperability issues loom large. Tweets: @brianbehlendorf , @brianbehlendorf , @a_greenberg , and @wired Tweets: @brianbehlendorf : If only there were, like, some way for devs and companies to work together on common software code, to make it easier to get reviewed for security weaknesses and mistakes, to accelerate adoption, to coordinate on standards, to adapt it to local needs... https://www.wired.com/... @brianbehlendorf : In case I was too oblique with this - there are efforts afoot to address this. If you are associated with a government public health authority who wants to fix this, please DM. https://twitter.com/... Andy Greenberg / @a_greenberg : With the rollout of Covid-19 contact-tracing and exposure alert apps (as with so much else) the federal government seems to be leaving all the work to the states. Here's why that state-by-state approach could cause fragmentation, security, privacy issues: https://www.wired.com/... @wired : It seems increasingly unlikely that any US federal agency will release a nationwide Covid-19 contact-tracing app. Instead, it seems like these apps will launch on a state-by-state basis—and they may be anything but united. https://www.wired.com/...
Context & Ripple Effects
The dozens of smartphone tracking apps built since April were always going to collide with America's federal structure: with Washington producing nothing, deployment falls to governors. The one piece of shared infrastructure is Apple and Google's Exposure Notification API, which at least three states were already building on when this piece ran.
Brian Behlendorf's point in the Wired thread is that fragmented codebases mean fragmented security review — every state audits its own app, or doesn't. The alternative on display internationally is a single centralized app like India's 75M-download Aarogya Setu, which privacy advocates flag as a standing surveillance tool once the pandemic ends.
First-order effects
- Each state that builds its own app must independently fund security review and privacy auditing, duplicating work and raising the odds that a weak implementation ships somewhere.
The trend: US pandemic-response software is fragmenting along state lines while Apple and Google's shared API quietly becomes the national standard by default.