The interesting thing about ideas like this is that they reveal how authoritarianism during times of stability does a terrible amount of damage during times of crisis.
This is the sort of problem that could be solved in a better world; collecting location data to find interactions between people would allow you to get them tested faster and prevent a disease from spreading. But it simply can't be done in this country primarily because everyone has the entirely reasonable fear that the feds want this power for nefarious reasons and will never give it up - and they're probably right.
If we had a society where privacy was an absolute right, and civic trust in our community organizations and institutions was built up over time, during a crisis like this one we could come together and find agreement on a way of providing this data to a responsible institution that would use it only for the purpose of saving lives and then delete it when the crisis was over. And they'd lose access to future data at that point too. Anyone who still didn't trust the communal institutions could opt out, but the point of building up this trust is that it makes people want to work together and feel safe doing so.
We're so far from that in this country that we're not only paranoid about privacy issues, it seems altogether most likely that our secret agencies are actively planning to exploit this crisis to be able to spy on us in the future.
I don't know, maybe it is. Maybe the politics of our world simply are that cynical and won't allow for such a thing to exist. But I guess I'm hoping it isn't. I'm trying to imagine how a non-authoritarian institution would work; it wouldn't have the "authority" to compel anyone to turn over their data, but just about everyone would have enough trust in the community and its decision making process to be okay with it.
What I guess I'm asking is ... what if the organizations we built looked more like the WHO, and less like the CIA?
What if information could be revoked? Imagine the government suspects me in some investigation. I give them a key that gives them all information about me and my recent activities. Then once some period elapses, I revoke that key and they no longer have any of that information. Nor, of course, were they able to copy or independently distribute it in any way when they had it.
This is probably pure fantasy, but if there was any way this scenario would be possible, I think it would go a long way to assuaging people's concerns. As it is, we know data can be copied and distributed without permission. That's kind of been the underlying problem of spies throughout the history of the world.
I think this concept is where Stephenson was going with Snow Crash, but his scenario for this seemed like fantasy as well to me.
What if information can't be revoked on systems outside your control? That's the reality, however many secret handshakes you do, blockchain, etc, eventually some person or process knows something and can do something with it (e.g. copy it).
You could pull a gmail and say, there is no human in the loop, it's just a process of personal data ingestion and ads come out the other end. That might be more comforting if it was open source, but even open systems have things can be hidden in obscure technical details.
The truth is, we are all human, including our leaders. Your average human is weak and susceptible to trading a vast privilege like having control of everyone's whereabouts for favors (e.g. money, position, control, sex, etc...).
I'm a sucker for an open source process (e.g. robot) that would look at the data and tell us who needs to be quarantined, but again, you still have human technical people, with all their failings, controlling the system (e.g. source code). How much do you trust the open source process is a matter open for debate.
I maintain that copying is fine in some or a lot of cases because stale data has a diminishing ROi and eventually becomes useless. Doesn’t mean the govt couldn’t amass data from multiple sources to provide a complete picture of you. But you just proposed DRM for your personal data and we all know about the analog loophole...
Every time I think about this issue, the closest I can get is a distributed world of APIs, where everyone hosts their own data [however], and for any service whether it be government, commercial, work, friendly, etc, the entity's agent makes an API request and gets a result. But that result isn't the data - it's a privacy-focused result that can be used in place of the data.
The simple example would be "I'd like to send indigochill a gift", which would send a request to your API (with some notification for you to approve or deny receiving said package) and return an id that could be written or printed on an envelope. That id is unique and the mail service would scan the id and the package would be routed. And the mail carrier would scan the id and get an actual address (or a blip on their map of the block or something). Nobody along the way has learned your address or name or anything - nor do they know my address, which is just another unique id.
There are some very interesting implications in that data can become stale so quickly. If you approved of receiving the package but were out of town for the week, the package could be routed directly to you without any interaction whatsoever. Nobody along the way would know the difference between your home or your hotel room.
The same could easily be done for lots of personal data. Phone numbers, email addresses, etc. All your shopping history could be stored on your own private data store and the local grocery stores would send out a mailer "Address this mailer to all people in the neighborhood who have purchased discounted burgers in the past month". The store doesn't know who is getting the flyer, but the people who would be likely to use a coupon for buying burgers would get a notification and likely go buy some burgers on sale - or reject the notification and not be bothered - to the savings of the store and the recipient.
Social Media could still exist with this sort of thing but the services would be querying engines rather than the creepy data warehouses that they've become.
This of course gets significantly harder with the queries this article is about, but the idea is the same. Instead of "give me everyone's location for the past month", the request would be "give me the anonymized ids of people who have been to x locations for x amount of time within x amount of space between one another". The response would provide data that could be used for the purpose in question, but the underlying data remains private.
I've been pondering this idea on random occasion for about 15 years, but I don't care enough about it to make it my life's work. But I sure would like to live in a world with that level of data ownership and privacy.
Sounds like an interesting possible world that might one day get built.
In the meantime, sounds like most likely outcome is the government hits CTRL C, CTRL V on Facebook/google’s user database and starts a China/Tencent style SQL dB on every American.
Or even more likely, this already exists and now the government can start using it more openly.
This could be possible if the data is stored encrypted in a public ledger (blockchain), which has time-locked script functions that permit another key to decrypt certain pieces of data for a limited duration. I think something like this is a primary goal of most decentralized identity projects, some of which have been underway for around a decade.
Of course none of this stops the person with temporary access from making a copy to save forever. I doubt that problem has a technical solution but would love to be proved wrong.
I think the solution would be sending as little data as possible to answer the query, and choosing which/how many queries to respond to. Any large scale requests for data would have to be designed in a way that minimizes intrusiveness or risks being largely ignored. I don't think there's a great way to counter spoofing or sending garbage results without sacrificing user control, but the onus to de-noise should be on whatever institution is attempting to collate data. Additionally, if it's an opt-in system focused on public good there would generally not be much incentive to mess with it as long as users are somehow verified as being in the community (cert generated/granted once after initial identity check, etc). Sadly this is all very pie in the sky at the moment, the amount of cultural change + added infrastructure required for any system like this at the scale of a country would be insane
That's a good point. A common example is how a bar doesn't need to know your birthday, let alone your home address or driver license number, but right now it's common to hand over your entire id. All they need is a yes/no answer to "is this person 21+ today?"
Personally, I think the only way we will retake our privacy is when hobby level, readily available hardware, software, and 3d printable parts enable hobbyists to create “good enough” phones with encryption and privacy options that won’t exist in mass market phones.
Then an enterprising startup can deliver marked-up, preassembled devices, then people might have privacy again.
The goalposts on "good enough" keep moving. When everyone else has a holographic direct-to-eye refraction display, people are going to be as disappointed in a 2020-level smartphone as people were with OpenMoko devices, which still had a pressure-sensitive touch screen with a plastic stylus when the iPhone has just come out with its relatively massive capacitive multitouch display.
I was disappointed with the OpenMoko for many reasons, but the screen wasn't one.
Things like it wouldn't read my sim (bug 666), the stylus was almost required, but there was no place to put it, audio issues, sleep/wake issues, poor battery indication and tricky to charge from a flat battery.
Sure, the screen was kind of small, but the resolution was high, so you could claim hidpi before Apple invented it?
Depends...'good enough' goalposts are for a particular audience. Technophobes seeking privacy are certainly less motivated to upgrade to a holographic direct-to-eye display, than a technophile.
Personally, I like the idea of a Fairphone with Lineage/MicroG.
I say like the idea of as opposed to use as currently Fairphone is out of my budget and I can't find a phone in my budget range that's supported by Lineage/MicroG so I just have somewhat reliable <£100 phone with as much de-googling as I can while still having normal android.. (Not much)
Edit: the bonus of phones in this price range is like Fairphones they almost always make it easy to quickly remove the battery so you're certain nothing's running.
It exists. Its not that people "don't allow" non-authoritarian institutions/solutions. Its that they have their own limitations in dealing with complexity. Rationality is Bounded. Know what the bounds are. Read some Herbert Simon - https://en.wikipedia.org/wiki/Satisficing
Look at the EU. There is no dearth of cockups there, even though their instinct at everything is non-authoritarian.
I would trust the CCC or the EFF with this I think, and the other paranoid fighters for privacy. But only as long as it takes for the to rotate their members enough for takeover by others.
We've seen that wit smaller political parties as well. When membership suddenly become a viable path to power things change in the structure and people.
I agree. Once you cross the point in organizational size where people stop feeling personally responsible for the organization and start feeling responsible to the organization it starts behaving like a sociopath in pursuit of whatever it's official goals are (shareholder value, catching criminals, etc).
You can mitigate this to some extent by having one or a couple people who are personally responsible for the whole organization (royal families in monarchies, the owners of privately owned companies, etc) but then your organixation is not resilient to bad leadership.
I disagree that "large" authorities could be fantastic. Authority, like most things, is better when smaller. For one thing, a small authority is more likely to notice those people subject to it.
Just to be clear, I don't subscribe to it. But I have noticed that pretty much any time anyone has a good idea, their next idea is to force everyone to do it.
I agree. Ironically the measures that should have increased national security are endangering social contracts established around fundamental rights in a way the opposite is achieved. But I guess you are preaching to the choir here...
But that aside, I don't think the measure would be worthwhile even now. Instead focus should be to fortify local health services and provide support where needed.
A damaged believe that fundamental rights are compromised has of course negative repercussions on the willingness to cooperate with authorities of any kind.
Trust cannot be enforced and authority is always limited. I wouldn't call it paranoia, because in that case the respective fears aren't confirmed that often by people now in solitary confinement because some hot shots thought they were in control and did was was allegedly necessary.
I had this conversation with my dad a month ago, are we not already past the point of no return on this? Can’t the government legally buy purchasing data from credit bureaus and other vendors? Can’t they legally buy location data commercially from at&t and other entities? Don’t they already do it anyways to monitor food shortages etc,?
It’s not a question of can they, but have they yet. Don’t police officers already have access to this data therefore the feds definitely do?
The boom in location based advertising a decade ago was the final nail in this coffin because it made the availability of location tracking data required and highly accessible.
> a responsible institution that would use it only for the purpose of saving lives and then delete it when the crisis was over
The UK managed to get rid of ID cards in 1948 on pretty much this basis. The problem is, that war ended, but the one started on 9/11/2001 hasn't. For temporary authority we need both clearly defined end conditions, a belief that they will be reached, and faith in the authorities to work in good faith towards the ending of that crisis.
It just shows that different people have different triggers that makes acceptable for them to restrict basic rigths and liberties. For some it is terrorism or child pornography, for others it is pandemic.
We do not really need to find agreement, it would suffice if mobile operators implement opt-in that could be easily enabled in web portals. Then society can just advertise this opt-in.
Privacy should be a right. In the USA it should be up there with the Bill of Rights. The only way it can be gone around is with a warrant or something similar. Cops don't like that and neither do police state regimes.
> This is the sort of problem that could be solved in a better world; collecting location data to find interactions between people would allow you to get them tested faster
NO. Global data about who interacts with who and where should NOT be available to anyone. Especially NOT to HEALTHCARE orgs, I couldn't imagine less trustworthy and skewed-incentives institutions! At least you can trust that a country's secret service like your NSA would keep most of that data safe (as in "safe even the eyes of from judges & prosecutors unless you have a national security issue" etc.). Like in I'd rather have +10k deaths from preventable contagious diseases per year and take the chance of being amongst them then having this on a wide scale.
> civic trust in our community organizations and institutions was built up over time
You have no reason to trust anyone and anything. Stop doing so.
> a responsible institution
There's no such thing. Any institution should be considered thoroughly corrupted in the absence of evidence to the contrary.
> our secret agencies are actively planning to exploit this
It's their job to do so! If you want to provide solid security in globally connected world the "protectors" need to be a bit above the law - it's OK as long as what they collect stays in their archives and you prevent them from holding political or financial power.
The point is to build societies that can function TRUSTLESSLY and where everything is SECRET BY DEFAULT unless explicitly shared.
That's the only way to have an open society! Sure, in small isolated pockets you can have your "trust" in institutions and stuff.
Otherwise it's a choice between:
(1) accept framework of trustlessness + secrecy-by-default + broad exceptions for security agencies mostly as long as they DON'T share data with anyone (no, not even to "save lives", unless you're taking more than thousands...)
(2) drop the global interconnectedness, drop most free travel and work (I don't mean relocation - you'd also need to drop the kind of temporary travel that can't be easily monitored!), move to a more localist society - here you can have trust in the institutions of your own "pocket" that you voted for yourself.
Unfortunately it seems that the pendulum will now swing towards (2) as you seem to say you prefer - ...too bad, I'm sure we could've made the global-village thing work too :( probably we need to try again when tech advances a few extra steps, eg. neural-interfaces + pervasive-AI + usable distributed financial tech. and use the tech properly to make the openness and interlinking irreversible!
Android's GLS service has an absolute insane data ingestion pipeline consisting of sensor fusion from GPS, Wifi, accelerometer, barometric data, and cell tower locations. It's accurate to within meters, can locate you inside buildings, can count your footsteps, and even knows what floor you've been on.
It's been used by Google to tune its indoor WiFi maps and improve location accuracy for years.
Anyone who has high location accuracy mode turned on and has Google Play Services has already been unwittingly uploading "anonymized" location data multiple times an hour for literally years. In many cases such anonymized data is accurate to within a meter and contains accelerometer data that can literally count your footsteps and determine if you are walking, running, riding in a car, etc. Anonymized GLS data is what informs traffic congestion and many other "non scary" services.
Google believes the negotiation of a 7-day expiration of randomized UID is sufficient anonymization to meet the legal definition in all of its markets. It might be right about the legal definition. It's wrong if it believes it actually anonymizes data. Google believes a popup notifying that high accuracy mode may upload "anonymized usage data" to Google's services constitutes informed consent according to GDPR. I think the EU would disagree if they knew the technical capabilities of Google's infrastructure.
Google's internal privacy review system believes that they are safeguarding the privacy of its users. Their model does not take into account NSLs or interference from intelligence agencies. And it absolutely did not foresee this.
The surveillance dystopia is here, folks, and your Android phone won't do anything noticeably different. They'll flip some switches in their ingestion pipeline and have an insanely powerful draconian surveillance network instantly.
5G is the next piece of the puzzle in the surveillance dystopia. Consider how much money has been spent to erect it. Who is paying the bill? Telecom companies are freely able to sell the data they accrue - that was the first step. 5G connects to every IoT device you own. It can make 3D representations of its surroundings https://www.here.com/en/company/newsroom/press-releases/2020... . It maps out the insides of buildings. It knows where people are located, by Verizon's own admission https://www.youtube.com/watch?v=ZmYk-yk0FXw . This is not about giving people faster internet speeds, or miraculous rescues after natural disasters.
Of course, the range of the transmitters is lower because the signals get absorbed by materials in the way. Trees and buildings absorb the radiation, and attenuate it, and thus, to be effective requires the installation of untold numbers of transmitters covering the world. If trees and buildings absorb the radiation, you can bet that your body and brain absorb them as well. We used to keep cell towers far away from people's homes; now we are putting higher frequency transmitters right in front of them. 5G is for surveillance and control. It is a weapon and this weapon is being pointed into people's bedrooms.
Majority have been doing it unwittingly, true. But you do get services in return. I actually know about the collection, and in case of Google, in my opinion I get compensated in a reasonable way. I'm contributing to wigle and osm as well to counteract the monopoly, but in practice - it's worth it. We could attach some risk to everything and consider what would happen if gov abused it, but we'll all have some threshold of saying "I'm ok with it in exchange for participation in modern society" (it can be re-evaluated later of course)
The alternative is to not accept any of the risks and live in a disconnected commune. Which is ok if that's what you're after, but... that won't apply to most people.
I don't want to call you out personally, but I absolutely hate how servile this attitude is.
Its as if you can't even imagine a world where you get some of these benefits but where your privacy is protected either legally or technically. Both are totally possible, but your lazy attitude about it is part of the problem.
One of these days all this data we've just been casually giving out is going to be used for a pogrom or some other terrible thing and then it will be too late for this facile "the benefits outweigh the costs" bullshit.
>it will be too late for this facile "the benefits outweigh the costs" bullshit.
No it won't, because the horrible, but realistic, take is that the benefits indeed will outweigh the costs. For all the people who are not targets of the pogroms.
Horrible as it sounds, a lot of people don't really care about things that happen to other people. Even if those other people die. Especially when the other people are not like them.
Sometimes I wonder whether apathy is the true root of evil, not really money. I'm no different, I'm guilty of that tendency towards apathy as well. I'm certainly up in arms about privacy, but I really don't get the same way about women's issues. Nor black guys being gunned down by cops in their apartments. I may lament those situations, but I certainly don't donate money or time to those and other causes.
Point is, root of the issue is that no one cares. Everyone has their own concerns. Which is democracy. And that's great.
But inherent in that environment is a kind of built in "divide and conquer" quality that provides political and economic élites a convenient control mechanism.
Yes we need a model where this can be done on a large scale with the way to compensate that doesn't involve private data. But realistically we just don't have that model. We can imagine the world where that's the result. The hard part is imagining how did we get there, and that's really not trivial - anyone has a chance to do it and succeed right now and it's just not happening.
Then there's the technical issue of: We can't guarantee no collection right now, without rebuilding internet from scratch. Then we need to solve the spam/credible information problem again without existing identity information.
So again, unless you want to live in a disconnected undocumented commune, you're drawing your own acceptance line somewhere. If you don't have own solutions to propose, calling others lazy is a bit of glass house situation.
Without Google, yes. But I said: this applies to everything. Do you want medical records staying with your doctor? Do you want a driving license? Do you want a passport? Do you want to register the birth of your kids? It's where you draw the line of convenience -vs- privacy.
That is not equivalent to the tracking discussed here. I don't share any location data with Google or any service for that matter. I think most do not.
Its not over - I switch to oldschool phone that I'll regularly switch off. I'll have some lagging in communication, but at least it's a way to raise awareness among my friends.
The internet presents a unique challenge to privacy. You have to physically connect somewhere. Normally that connection is also tied to your account. This means you they know who and where you are at all times. VPNs can help but are a single point of failure if the government ever shuts them down or installs backdoors.
If you go for the free Starbucks Wi-Fi plan on a tablet, you have some chance but you need to always have access to this kind of proxied connection. Additionally, you are likely to get fingerprinted fairly quickly based on services used and how the ad networks cross target. At the very least, they will know when and where you are at that Starbucks. I really think we have lost. The best we can hope for is E2EE baked into secure chips on our devices to at least protect our messaging.
I don't have anything of that shit activated and I am far from alone with this. My GPS is maybe turned on once a year, so probably pretty inconclusive.
The problem is if the try to form conclusions from the data collected that would concern me too.
If more people were aware what data Google collects, I believe far more people would be careful with Google services.
What is true is that Android basically become a shitty OS, something open source should have prevented, but we know how that turned out.
I don't think that I miss anything with opting out of it to be honest.
I use iOS, but the iron grip Apple has on its walled garden puts advanced users at great disadvantage.
You want a privacy-friendly browser like Firefox? No, you are only allowed to use a Firefox skin on good old Safari instead.
You want local ad/tracker blocking? No way, you are allowed to use a VPN instead, and hope it doesn't sell your data too.
You want to jailbreak and stroll outside the corral? Better hope iOS keeps having zero-days, because there's no official way, and Apple actively works against the unofficial way.
Could you roll your own vpn to say your home where you have a a rpi set up as a pihole and your own adblocking dns like you could on android? (Common roll your own VPN's like Wireguard or OpenVPN)
That is exactly my point, these are not solutions, but workarounds we end up with. A sensible approach would be a local blocklist, which would save not only battery and bandwidth, but all the material resources needed for the workarounds.
I understand Apple will never implement this because ads and a captive audience are a crucial part of their business model; I just resent that Apple actively blocks people that want to implement this themselves.
A more hopeful interpretation. This can be a tool for good. It's not necessary for the state to have access. We already have access.
This capability is precisely what we need to generate data that can be used to resolve this crisis and allow us to safely exit from quarantine.
The GDPR allows individuals to request access to their own data.
They can voluntarily share this with their health systems, communities, and governments, such as when testing positive for SARS-CoV-2. This doesn't have to be open-ended, just for recent data that could help track transmission and find other contacts.
On the flip side, individuals who don't know if they're carriers can plug their own data into a system that relates it with the movements of affected people and warns them if they need to get tested.
> A more hopeful interpretation. This can be a tool for good. It's not necessary for the state to have access. We already have access.
The state has had realtime, direct access to the data without
a warrant or meaningful oversight on a query-by-query basis since the 14th of January, 2009, when Google joined the PRISM collection program.
It would be a very simple matter to expand that access to send wider selections of data. It may already have the capability to perform such queries.
I argue if everyone would increase their Vitamin D level drastically (by 10000IU), this sole intervention would save much, much more lives than tracking location of phones.
‘in moments of crisis, people are willing to hand over a great deal of power to anyone who claims to have a magic cure—whether the crisis is a financial meltdown or, as the Bush administration would later show, a terrorist attack’ (Naomi Klein, The Shock Doctrine)
If the government asked for constant location data in exchange for $1k / month "UBI", most people would take that, and they'd be silly not to because that's likely the highest price their data will ever fetch.
Klein has gotten lost in the anti-Trump personality rhetoric, she should re-gain her focus on the critic of society / anti capitalism roots. Basically a Democrat would be doing the same things as Republicans with regards to her warnings but you don't get as many books sold if you say that. And its more comfortable to think that if you just change one person it will all change than knowing that one removing person really doesnt change much.
Maybe law can be created to allow state/local government to collect and use such info when "declaration of local infectious deceases emergency" by state governor. Especially allow for department of public health to access the Google's Sensor Vault data in emergency situation.
I would support that BUT I also understand how that might open the "pandora's box" for all other government requests/laws like the existing geofencing warrant.
The government tracking everyone's location all the time would be/is a gross infringement on privacy. The government tracking everyone's location for a limited time period in order to curb a deadly epidemic seems much more reasonable. The difficulty is trusting them to give back that power when the crisis is over. If not for the experience of the Patriot Act, I'd be more inclined to give the benefit of the doubt there.
Still, if this were done in a truly open way, and the criteria for ending the program were clearly specified at its outset, it's something I could support. Looking at the Chinese response, advanced and extensive contact tracing has allowed them to restart significant commerce in areas where initial outbreaks have been controlled through social distancing. Doing the same here might not only save lives, but also livelihoods.
Of course I would be nervous about the potential for overreach, misuse, and acclimatization. But if the allowable uses and time-frame were set into law, perhaps those concerns would be outweighed by the potential benefits.
> But if the allowable uses and time-frame were set into law
They were with the Patriot Act, though. And many of its provisions are still being routinely extended.
The problem is that once all this data starts flowing in, government agencies who want to use it will find loopholes to apply it in scenarios it wasn't intended to be used, but which the law didn't anticipate. And then, once it proves useful for something important, they'll point at it as the evidence that it's too useful to allow to expire. Again, we've seen that with Patriot Act - originally passed solely to "combat terrorism", DoJ is now justifying their asks for extensions by, among other things, the need to fight child porn. Which means that any politician who votes to not extend it, risks being painted by their opponents as aiding and abetting sexual predators.
This has all the potential to be an order of magnitude worse. A real-time location database for practically every person in US would get all law enforcement agencies salivating immediately. And worse yet, it will actually let them solve otherwise unsolvable crimes etc, and set up a showcase. Probably terrorism and/or child porn again, because it pushes so many emotional buttons at once. And who would dare say that it's not justifiable, because child porn is less of an issue than coronavirus? More importantly, who would get elected after saying that?
That's the real danger of creeping police state - it works more or less as advertised, and it's just too easy to ignore all the "abstract" stuff about freedom and privacy (until you're its target - but most people don't expect to be one, and most of them won't be). So every inch that it gets is nearly impossible to wrestle back.
This is happening already - anyone who use Google map has their location data collected for the past 10 years with default setting. Police can issue geofencing warrant against the location/time and Google will share that data.
I read the first one in detail, and it's not Google Maps, but worse, it's cell phone location data for all phones, for up to a decade, probably more, in a database called SensorVault. So it can be used as a global surveillance database.
This is not surprising, since data companies always have a database like this, but we should have privacy laws in place to limit retention time and access.
There is no need to track everyone's location, even for a limited time.
South Korea only tracks the locations of people who were confirmed to have been infected, and cross-checks their location data with CCTV footage as well as credit card records. That's a lot of data, but only for certain people. For each case outside of the Daegu area, local governments are tasked with publishing a list of locations and timestamps -- easily visualized on a map -- to help others figure out if they were in the same place at the same time as an infected person. There is no need to track the other people, as they would show up at testing centers on their own. Also, the people in charge of doing all the tracking have no obvious ties to law enforcement. The government is not a monolithic institution; there are both legal and technical barriers to sharing data among the various agencies. The police in S.K. only gets involved when known-infected people refuse to cooperate, since it's a crime to interfere with an epidemiological investigation.
I'm not sure who "the feds" referred to in the article are, but if they have any ties to law enforcement or are asking for data about an unnecessarily large number of people, beware!
Once you know someone was infected, you need to go back and see where they've been up to that point. That's only possible if you're tracking everyone. Of course you don't need to keep the tracking data on everyone for more than ~14 days.
Yes, there are other ways to do this tracking and contact tracing, but they are much more labor-intensive and imperfect. Governments can and should still do this, but once a certain percentage of the population becomes infected, it's no longer feasible. Also the more contacts that are missed through these tracking measures, the more potential avenues for spread. Hence the attractiveness of a system that would both be more comprehensive and require much more manual work.
Is it reasonable to track everyone's detailed location during a pandemic though? What purpose does it serve in the absence of good molecular testing info, which would be an even grosser violation of privacy?
General levels of social distancing can be gleaned without phone location info. All you need to do is have police drive around and look.
The problem with requests like this, for detailed phone data, is that everyone can imagine vague benefits in the abstract, and wants to be helpful, so you're more willing to cede protections of privacy (which are ultimately protections of liberty). But those vague abstract benefits don't necessarily translate into actual benefits if you think it through.
I don't see anything necessary about phone surveillance at this time whatsoever. What is necessary is mass testing.
It's very helpful, because as soon as someone has symptoms or tests positive, you automatically know everyone they've come into contact or close proximity with, and can have those people isolate. You can also better determine whom to test, since there is nowhere near the testing infrastructure to blanket test everywhere.
In China they also have an app where anyone can see locations where an infected person has been, and how recently, both so they can avoid those places, but also so they can feel more confident being out in society otherwise (in areas without significant current outbreaks). This video demonstrates how it works in one Chinese city: https://www.youtube.com/watch?time_continue=4&v=YfsdJGj3-jM&...
I agree with many of the problems pointed out, but it does appear that the benefits during the pandemic would be significant.
They already have a mechanism to do this -- it's called a John Doe (wiretap) warrant.
What they really want is full take -- the complete location movements of the US population. This would be useful for COVID-19 tracking ... and authoritarian control.
If you're following HK/China, you know that they are already doing this tracking. Visitors and quarantined people are being required to do this in HK by a number of reports.
Many governments already track and save all communication in a big graph database - in order to know who communicates with whom - so they can find "terrorists". It's just that in some places "terrorist" means people, journalists, etc, that oppose the corrupt government.
So the government already know who communicates with who. And now they also want to feed everyone's location to that database, so they can know everyone who has ever met with or talked to a "terrorist". Where I live you can be sentences to wear a tracking device instead of a prison sentence. Now everyone will be prisoners.
I have been somewhat conflicted/despairing about Taiwan’s response (only 77 cases and 1 death as of right now, 2020-Mar-17, despite reslly cloze ties with China and an almost equally early onset) since I read this: https://jamanetwork.com/journals/jama/fullarticle/2762689 a couple of weeks ago. Paragraph 2 is especially instructive. I have historically been dead against the type of cross referencing and identification this article discusses, but their capability for pulling multiple disparate sources together to allow tracing, categorization and enforced tracking of all individuals is massively impressive. We really need to either figure out a way to execute on these capabilities without revoking privacy, or else accept that some granting of privacy (whether to Google or another entity) will be inevitable.
I've been posting that link in various comments on the web over the last week, it's a very interesting article. But Taiwan is not the US; they have shown a very healthy trend away from authoritarianism over the last 33 years since the lifting of Martial Law in 1987 (and the 40 years of 'White Terror' [1] that preceded it).
Also, on the question of authoritarianism, I think there is a case for greater tolerance of it during a defensive war, where a nation is battling for its survival. And I think a pandemic can be characterised as a defensive war against an invisible, completely merciless enemy. Not to say that blanket authoritarianism should be allowed but measures that make sense and help in the battle should be shown greater tolerance for a limited duration. Of course this is the whole idea behind (duration limited) emergency powers legislation. Going back to Taiwan, their 40 years of martial law also shows the risk of abuse, however I would describe the KMT as an invading power, not a native, somewhat trusted authority (as is more the case with their present, democratically elected government).
> however I would describe the KMT as an invading power, not a native, somewhat trusted authority (as is more the case with their present, democratically elected
A Taiwanese friend mentioned that the majority of indigenous peoples of Taiwan support the KMT rather than the DPP (the current party in power).
I suppose for them, all Han Taiwanese are “colonists” but the KMT gave them more benefits.
Even if we gave the feds access to cell phone data and even if we allowed them to cross reference it with border points of entry, it would be useless. Cellphone data doesn’t have a common data entry with info you give at the border, additionally even if that part worked: we don’t have a single EHRS. So getting that info to the people that need it would require some sorta convoluted fax scheme. Basically, there’s nothing we can use from what Taiwan did so don’t feel bad about it. (also at this point it’s no longer being spread by ppl coming from outside, its ppl inside the country giving it to each other.) We need to do two things to be ready for the next pandemic.
1) Come up with a system for tracking it at points of entry.
2) Create a system and process for containment once it’s no longer contained.
What good is phone data if they don't even administer sufficient virus tests? They should first tackle the low-hanging fruit that doesn't involve mass surveillance, to show good intentions, before being allowed access to such dangerous data.
I suggested something similar but based on using Bluetooth and running an app locally. This would be more sensitive to proximity while potentially giving away slightly less data about exactly where you are, and easier to opt out of, either temporarily (while at home say) or completely.
There could also be the option of logging nearby Bluetooth addresses locally only and looking up an online database of infected owners, or submitting collected data online to allow aggregation and preemptive notifications of potential exposure before symptoms show
I was thinking along similar lines. Maybe it's possible to use BLE for this (don't know if the standard PXP profiles would be applicable or you'd need something else).
You could also have app-level 24-hour rolling identifiers to prevent non-infected people's contacts from being correlated over time, even locally—if that would make people more comfortable using such an app. (The app would have to keep track of all its previous identifiers; if the user is found to be infected, all their previous identifiers would be marked as such in the database.)
Some challenges off the top of my head:
- What polling rate is needed? (How do disease experts define a "contact"?) What's the battery impact?
- What fraction of the population has BLE-capable phones?
- What fraction of the population keeps their phones physically on their person as they go about their day?
- Can distance be roughly inferred from RSSI? Does the mapping of RSSI to distance vary much depending on the transmitting radio / phone model?
- If you live in an apartment, you might be identified as a "contact" of your neighbor even if you never breathe the same air, etc.
in 2004 the authorities planned how to respond to this crisis, and got the necessary rights. Then they spent 15 years not abusing these rights, and now used them effectively (including phone data).
The middle part is important there, the one about "15".
Israel started using cellphone tracking as of today.
An in stable (transitional) government got an approval from the justice department.
The tracking is based on location / cell data stored at the mobile operators and should be used for tracking people around a positive covid person to send text messages asking them to get into their home to a lock down for 14 days.
Cellphone data is retrospective of course.
However, once asked to go home. Enforcement will used current location data.
The _interim_ government (_not_ an actual government), which is headed by a criminal who has been evading his trials on several corruption scandals for several years, has given itself approval to access people's geo-location data, phone conversation history, browsing history etc. using some covid-19-related excuse.
The government had initially tried to have parliament authorize this measure - but the "secret services" committee, discussing the matter, did _not_ approve immediately, requiring more information. So the government just used one of the draconian powers it has... thanks to anti-Palestinian legislation.
The tracking will _not_ be limited to covid-19 patients.
It is a total travesty.
It should be said in fairness that the legal infrastructure for this has been laid over a decade ago with the "Big Brother" law and the General Security Service law. People were silent about it then, and now the chickens have come home to roost.
They already had a law that allowed Shin Bet to collect that data without any warrants, though. And to use it for many purposes - just not an epidemic.
That sounds rather like the traffic feature of Google/Apple Maps than what's discussed in the comments here. The article you linked is very clear that it's aggregated and only segments with at least 20 people on them are reported.
If I understand the Hill article correctly, the US discussion is about the same kind of data ('An unnamed OSTP official told The Washington Post that they were “encouraged by American technology companies looking to leverage, aggregate, anonymized data to glean key insights for COVID-19 modeling efforts.”'), yet the majority of the comments seem to be assuming that it's about tracking individuals' locations to enable contact tracing. I don't get that impression from the Hill article at all.
What's actually being proposed, while not unproblematic, sounds rather more palatable than the authoritarian nightmare that's being discussed here.
Cynic in me thinks that this is a request from the richest people and other elites, who want to isolate themselves from the infected, all the while blocking policies and measures that would actually help them.
I also want to point out, there are low tech solutions to track and control coronavirus spread. Simply isolate infected or suspected people, not in their homes, but in a hospital built specially for the purpose. Chinese did that.
Whether this is preferable to mass surveillance is your choice. I think it has merits and is less authoritarian overall.
Wouldn't it make more sense to work with the cell service providers? Surely at least some people turn off location permissions? I would think the cell service providers have much more reliable data.
> I would think the cell service providers have much more reliable data.
Google tracks location history from GPS and this is accurate to at most a few meters and it can be use to check if people walked by each other on the street.
As far as I know phone service providers don't have anything similar. The cell you're connected to can cover an entire neighborhood.
That was true for GSM, but 3g & 4g have directional signal management, and track location to enable cell 2 cell handover. Information is limited inside.
They have cell location data, but could have quite a few people in it. They already have this data, and I would guess that they find it useless for contact tracing. In contrast, Google/Apple and to some degree fb have super accurate traces of exactly which shops and offices you went to.
"The Fed" refers to the Federal Reserve, not federal agencies, branches, or the government in general. Not to be confused with "feds," referring to federal agents individually or in general.
Also, the submission title is simply missing a word: the article uses "Federal government in talks [...]" which is a very conventional usage, whereas "Federal" as a standalone noun is considerably more rare.
> We don’t know exactly what this new future looks like, of course. But one can imagine a world in which, to get on a flight, perhaps you’ll have to be signed up to a service that tracks your movements via your phone. The airline wouldn’t be able to see where you’d gone, but it would get an alert if you’d been close to known infected people or disease hot spots. There’d be similar requirements at the entrance to large venues, government buildings, or public transport hubs. There would be temperature scanners everywhere, and your workplace might demand you wear a monitor that tracks your temperature or other vital signs. Where nightclubs ask for proof of age, in future they might ask for proof of immunity—an identity card or some kind of digital verification via your phone, showing you’ve already recovered from or been vaccinated against the latest virus strains.
The conversation is dominated by the fear of gov't abuse. So few point to how successfully South Korea has leveraged their vast surveillance infrastructure to tackle this problem while maintaining a vibrant democracy. (When's the last time the US actually imprisoned a leader? Or even held a powerful person to account without pardon?)
The lack of trust in the US is really disappointing. Americans are so proud of its democracy---yet consistently hate and distrust the government.
I fear at the end of all of this, it'll be like the line at the end of The Big Short: "They will be blaming immigrants and poor people."
Some of the things you're saying seem contradictory (American politicians are rarely imprisoned for their crimes, therefore Americans should be more trusting of their government? That seems completely backward) so forgive me if I've misunderstood you completely. With that said...
> "The conversation is dominated by the fear of gov't abuse. So few point to how successfully South Korea has leveraged their vast surveillance infrastructure to tackle this problem while maintaining a vibrant democracy. (When's the last time the US actually imprisoned a leader? Or even held a powerful person to account without pardon?)"
South Korea isn't all sunshine and roses either. They had numerous military coupes in post-war half of the 20th century. One of their dictators was sentenced to death for massacring hundreds of pro-democracy protestors, but was then pardoned for this. Things might not be so bad in South Korea currently, but the nastier stuff is still in living memory today. South Koreans would be wise to tread carefully when empowering their government. I think the cautious attitude modern Germans have towards these matters is a good approach: "Never again" rather than "It could never happen again."
As for the attitudes of Americans, no organization nor individual is entitled to trust; trust must be earned. Insofar as Americans don't trust their government, it's because their government hasn't earned their trust. On the contrary, the American government has frequently violated whatever little trust anybody has in it. Modern America may not have any recent military dictatorships like South Korea, but there is nevertheless a lot of disturbing unpleasantness in recent history.
I don't think you've misunderstood, and I certainly didn't mean to imply that South Korea is all "sunshine and roses".
However, given that it seems that the American gov't hasn't earned its citizens trust after ~300 years, perhaps it's time to try something very different, or at least have an open mind to suggestions. Several countries now have demonstrated a range of options: China, SK, Taiwan, Singapore. Some are authoritarian, others are democratic. It may be time to stop arguing why each case won't work here and give it a chance.
I think a lot of people would like things to work differently, but trusting the American government, which has repeatedly proved itself unworthy of trust, doesn't seem like a good first step to effecting change.
I wish our politicians would just fucking own it and declare their own surveillance state rather than this bullshit death of a thousand cuts public/private partnership horseshit.
Which is based on discrete data from a graph built from phone calls, fixed line locations and SMS/email meta data. It doesn't have (from the Snowden dump) selectors for intersecting location tracks. TBH, I just don't think that is the way the FBI finds dead drops.
They were already drowning in data, and as reported recently, basically no arrests from it in years. It can't detect terrorists -- no Americans, not foreigners, fascist or religious extremists, any better than stuff the FBI was already doing.
Will they use it and risk the public asking how they came to know so much, as if by magic?
I'm hoping after this is all over perhaps the public might finally be in a mood more conducive to sitting down and discussing things in a reasonable manner, without the involvement of government and their corporate influence, and ideally on a platform with minimum censorship, and has a solution for dealing with ideological issues that have ruined so much of the rest of social media.
They could, of course, do this the way any other type of institution would do it: create an app that people would voluntarily install to gather this data. Playing by the rules isn't how governments work these days, though.
Best solution to this IMO is a special app which allows you to check in, prove your virus status (have it, had it, don't have it yet). Map of other users in the area so you know you're safe. You could then use that to check in to shops etc. and not be allowed in without showing status, those who have it have to stay home and check in for a given period. Uses biometrics to ensure a given user is using it.
Apple should be working on this.
After the virus is contained or has burned out everyone deletes the app. No feds snooping at location data required.
> Map of other users in the area so you know you're safe.
I think that would be a terrible idea. Not everyone in the world is a rational-thinking HackerNews reader ;). I would imagine it would lead to cases of mob-mentality which could be very thoughtful like community support for food/necessity delivery but also cases of unfortunate mob-mentality that could be very bad.
> You could then use that to check in to shops etc. and not be allowed in without showing status
This is exactly what's being done in China. But without the map of your neighbours. Everyone (that cares to go out) has a 'green' 'amber' 'red' status code via Ali or Tencent. Green indicates fine, Amber indicates movement (provincial or international, sometimes inter-city depending on province) within the past 14 days, Red indicates suspected.
We are in a pandemic and this won’t be the last. Gov’ts and society are scrambling to contain the virus, save lives, economy and society. Pandemics sow seeds of mistrust among neighbors, xenophobia and society starts falling apart. Be kind, compassionate and constructive if you can help it. This is about self-preservation. If there was ever a case for “move fast, break things”, this is it. Your location data is already whored out to target you in every which way. We have tremendous data and tech capabilities. We should absolutely use them to effectively track and quarantine the contagion. For me the threat of terrorism and Patriot act was bullshit reason to erode our rights and liberties, but this is different. We should absolutely revisit these encroachments on privacy by out gov’t in a post-mortem and legislate accordingly.
When it comes to gov’t, I share a healthy dosage of mistrust. This is one of the reasons I support the second amendment. But remember that the gov’t are of the people and for the people. It is THE institution to defend our individual selves against threats we can’t individually battle. As Michael Lewis puts it, we have got to stop gutting the gov’t due to reactionary fear-mongering and mistrust. We are only robbing ourselves and our children of their future. This is a reason to feel patriotic for me.
I’m young and thus likely naive. But, is it not possible for a company like Mozilla to make a small tracking app that users opt in for. Then, they get rid of this when it is all over. I say Mozilla because, from what I understand, it is very privacy orientated, but any trustable company would do (ie not google, amazon, or Facebook).
It would be so useful if I got a notification if I happen to have crossed paths with a person who later turned out to be infected so I can get tested too. This will preempt so many asymptotic transmissions.
We don't trust the government but what if it's just a private company who does it? Google already has your location info: https://www.google.com/maps/timeline
They are definitely already using the information in aggregate to provide traffic jam info. Hell I am sure facebook already does this for suggesting friends too. On the balance of privacy vs social good, I don't think there's even much slippery slope left to protect.
I'm curious, if I have no internet access and gps turned off on my phone (Samsung Galaxy S7) is there still hidden shit which is tracking my location? .. Like, is GPS not really turned off for example?
> I'm curious, if I have no internet access and gps turned off on my phone (Samsung Galaxy S7) is there still hidden shit which is tracking my location? .. Like, is GPS not really turned off for example?
Your location can still be determined by at least your service provider based on the strength of the signal it emits as received from the (presumably various) antenna sites in the area.
You can’t use a phone without the tower knowing where your phone is. When data is sent to you it’s not transmitted via every tower in the country; it is sent out only via the tower to which your phone is associated.
The only way to avoid this is to turn your phone off/disconnect from the network. Sadly network access and coarse location logging are impossible to unlink.
GPS is receive-only. You'd need substantial power to hit geostationary satellites.
If you truly have no cellular or WiFi connectivity, nothing will be tracking your location. However, hardware kill switches are the only way to be sure of that. Or physically messing with the hardware.
Potentially narrow down and identify asymptomatic spreaders of the virus in early forming geo clusters. This information could lead to more effective quarantine measures early on or post containment to avoid further outbreak eruptions.
What if every coronavirus victim voluntarily uploads their location data publically (their identity kept anonymous). Now you can, without uploading your own data anywhere, check if you have ever been in vicinity of any of them. If you have been, you can get tested and then upload your own data if that comes out positive. This way not eveyone has to share their data, only a few who have been infected.
Exactly, push right instead of pull. But it would require the systems to be designed in such a way that the user has ownership of the data they produce. GDPR should have solved that. Google location services have a complete history but it is not something I can download and share with a 3rd party which would in theory simply scan for possible encounters with infected people. We need to design systems that are interoperable, if a system is collecting data I produce, I should be able to retrieve that data at the click of a button, and share them to another service if I wish so.
This should've happened a long time ago. I really think there should be more cooperation between governments and tech companies so they can come up with solutions like this much faster like they did in China
Explicatory edit: The CCP, like every government in history, is motivated to conceal its human rights abuses. China also lacks a free press, an important window into its current events. Accordingly, there are obstacles in the way of justly assessing China’s response to this crisis.
This is the sort of problem that could be solved in a better world; collecting location data to find interactions between people would allow you to get them tested faster and prevent a disease from spreading. But it simply can't be done in this country primarily because everyone has the entirely reasonable fear that the feds want this power for nefarious reasons and will never give it up - and they're probably right.
If we had a society where privacy was an absolute right, and civic trust in our community organizations and institutions was built up over time, during a crisis like this one we could come together and find agreement on a way of providing this data to a responsible institution that would use it only for the purpose of saving lives and then delete it when the crisis was over. And they'd lose access to future data at that point too. Anyone who still didn't trust the communal institutions could opt out, but the point of building up this trust is that it makes people want to work together and feel safe doing so.
We're so far from that in this country that we're not only paranoid about privacy issues, it seems altogether most likely that our secret agencies are actively planning to exploit this crisis to be able to spy on us in the future.