COVID-19 tracing without an app? There's an iOS and Android update for that Google and Apple have updated their COVID-19 contact-tracing tool to make it possible to notify users of potential exposures to the novel coronavirus without an app. The new Exposure Notifications Express spec is baked into iOS 13.7, which emerged this week and will appear in an Android update due later this month. This is …
If I were to be optimistic, I would like to think that Covid gives us the right opportunity to rethink our attitude towards anonymity, personal responsibility towards society and our general attitude towards sharing our personal data where it matters and where it does not.
My experience with general populace makes me a bitter pessimist, though. This looks good on the surface but I don't like where it leads. It gives the incentive for keeping the perceived Covid thread alive long after the real threat will have been dealt with. Remind me again, are we still at war with Eurasia?
It's nice to be paranoid, but as best I can make out (which may be wrong) you have to work fairly hard for this protocol to leak personal data. My understanding of how it works (and I'd welcome correction!) is:
If you've turned it on, then phone generates a random cookie every little while, keeping enough old ones to cover the plausible time-constants for an infection, after which time it forgets the cookies. When phone sees other phone they exchange cookies. The phone remembers the cookies it has seen for long enough to cover an infection, because after that they have no value: the other phone will have forgotten its cookie. If you get infected, then at your discretion, the phone will upload its last few cookies (not the ones it's seen, its own) to some central place. In any case, every little while the phone goes to the central place and says 'tell me your list of cookies of people who have volunteered that they are infected recently' and compares them against the cookies it has seen: if there's a match it then tells you that you have been close to an infected person.
I'm trying to work out what an attack on this would be which did not involve compromising many phones. The central cookie register can keep their stash of cookies for much longer than they should, but I don't think they benefit from that, since they already presumably know who those cookies belonged to, and all the other phones which had them will have aged them away.
Obviously if you can persuade enough phones to keep their stash of cookies they've seen for much longer *and* you can tell them to give them to you, then you can build a network of who has been near whom. But that requires compromising many phones.
Well, it would be interesting to know from people who actually have read the description of it if this is right. Just not from the tinfoilers.
Why would Apple (or Google) want to abuse it? If they want to track you, they control the OS so they don't need to go to great lengths to find a way to abuse this feature when they can just track you directly.
As always, look at motivation. Why would a company want to a track you? There needs to be financial incentive for them to dedicate resources to it.
Several important variables aren't known. For example, how frequently cookies are changed. If it's twenty minutes, we're probably fine. If it's two days, we could very well not be. The reason we might not is that people already use Bluetooth to fingerprint passing devices. They do this in a variety of electronic things placed in places where people walk, including advertising screens. If someone evil did want to create traces of people's movements, they could use machines like this and infrequently changed cookies to track people over short periods. With two days of someone's movement, it's probably much easier to connect it to their next cookie because many people stick to some sort of routine. Alternatively, how could the feature be used to get everyone's cookies uploaded regardless of a test? If that's possible, it's potentially rather valuable from a tracking perspective.
Do we really have to worry about this? Probably not. If you wanted to track someone as a government, there are better options out there. However, these are sadly questions we have to ask. If I had never been subject to involuntary data collection at the hands of governments (in some cases not mine) and companies (in some cases companies I have never voluntarily interacted with), then I would be able to dismiss the worries with the argument that they don't want to track me and this tool would be poor at doing it, and if it's going to help prevent new infections I'm willing to take the minor risk. However, the appetite for data has been proven to be extreme, and the degree of consideration that data collection organizations have for my privacy has proven to be zero. With these facts in mind, the risk is greater. With this higher risk, I have to give real consideration to the other aspects, which aren't good. If this doesn't really help much, is it worth it to me to take a risk that it will be used against me? Might it be better for me to continue to stay socially distant instead?
Opt in if you can. If you select "Exposure Notifications" from the menu, then select UK it says:
"Exposure notifications have not been turned on for your region by your public health authority". Because those servers have to be set up I suppose.
But you can toggle a switch to be notified if it does become available in your region.
Warning app (german) running since it came out.
Although lots of drum-beating by unknowledgeable privacy advocates (all using watsapp and facehook) has resulted in less than stellar uptake, it seems to be checking 100-300 contacts every two weeks (introvert rural lifestyle). Certainly not full coverage, but still 100-300 contacts less to worry about.
I have substantially more faith in this solution than in the current crop of strange-haired world leaders..
As opposed to the wifi ID that Google and others are constantly sniffing for as a way to triangulate location? Or the cell tower ids that Google and others are constantly sniffing for, as a way to triangulate location?
Look, you interact with someone, they are wearing a mask, you are wearing a mask, you've both santized your hands. Bingo ONE LESS CONTACT, one less interaction to try to mitigate after the fact, ONE LESS SPREADER EVENT to trace.
Minimize the contacts. Minimize the risk.
Given you can be incubating and spreading for 5 days, that's a success. Tracing is after-the-fact partial mitigation of a failed interaction! Once its been spread, its spreading more. Nip it in the bud. Wear the mask.
Covid kills 1% of the population and mutates rapidly if you let it spread. So if you want to actually have a vaccine that works at some point, you have to stop it spreading. Fewer cases, fewer chances to mutate, fewer strains to vaccinate against.
If you let it spread, it has a large surface over which to mutate, and it will be like the Flu, new strains will keep coming back and there will be no Covid vaccine for the new strains, the jab will be for the old strains. Just like it is for the Flu.
There is no herd immunity for the flu, because there are an infinite number of strains of flu. Don't let Trump make infinite strains of Covid.
https://www.salon.com/2020/06/11/multiple-strains-of-coronavirus-are-now-circulating-in-the-us-heres-what-that-means/
Contact tracing is no substitute for mask wearing.
It is not being proposed as such.
It's a package deal. You distance socially, you wear a mask, and if you still get infected (as you likely will at some point), contact tracing is used to ensure that you don't spread it.
This is not a multiple choice area, you use all of it or you don't get the best results.
The countries that have had the least COVID-19 impact are all countries that have implemented confinement, testing and tracing to the fullest extent.
It's not rocket science. The procedures are well known. It just requires political will.
And that's where the cookie crumbles.
If you know anything about how hospitals are paid in some countries, you'd know that it's certainly possible, because many hospitals are run as for-profit businesses.
I know that in some countries such as Germany and the Netherlands the opposite certainly is the case: hospitals in the spring postponed operations and check-ups to provide the extra capacity for COVID that was, fortunately, not required. They weren't paid for those ops and weren't paid for providing capacity.
> If you know anything about how hospitals are paid in some countries, you'd know that it's certainly possible, because many hospitals are run as for-profit businesses.
"Possible" it might be, but I still don't understand how. Yes, for-profit hospitals, obviously, else there wouldn't be any profits to talk about. Still, how can hospitals' profits depend on patient death cause? Is there a "Covid Bounty" for letting people die of Covid (as opposed to other causes)?
Is there a "Covid Bounty" for letting people die of Covid (as opposed to other causes)?
No, but there are various schemes providing financial rewards for various treatments. And, initially, when they put people onto respirators for > 20 days that was very, very lucrative for some insurance-based schemes in some hospitals in some countries.
It's been known for a while that many healthcare systems are skewed towards expensive treatments over inexpensive prevention. For example, cancer research has had much more funding than vaccines for years. This started to change a bit with the "bird flu" epidemic when governments realised that there was virtually no vaccine research going on and also virtually no production, especially local capacity. We'd really be up shit creek if that hadn't been the case.
> they put people onto respirators for > 20 days that was very, very lucrative
That might be indeed, but I still don't see how an old person brought in because of a stroke and dying from it, can all of a sudden allow you to claim ">20 days" of respirator insurance pay. This is so lacking the most basic credibility you would be shut down quite quickly.
"Yes, all records show the deceased was brought here yesterday evening, but actually he's been already here for two weeks, using a respirator the records show somebody else was already using. I know it seems hard to believe, but you have to trust me, I'm not trying to scam you, no, no."
If you let it spread, it has a large surface over which to mutate, and it will be like the Flu
Fortunately, thus far, it doesn't seem to mutate as fast and as effectively as the flu. Otherwise pursuing vaccines would offer the same limited efficacy as flu vaccines. BTW flu in the UK is now killing more people than COVID-19.
Contact tracing is no substitute for mask wearing.
And mask wearing, especially outdoors, is itself of limited efficacy. Masks can be very useful in some situations but they are themselves no panacea.
Again with the single bit idiocy. A mask doesn't fall into one of only two categories: 'virus proof' or 'not virus proof'. instead a mask can reduce the quantity of virus-laden crud you breathe out and reduce the amount of virus-laden crud you breathe in. By doing that it can reduce the probability (not make it zero) that you will infect someone if you are infected, and reduce the probability (not make it zero) that you will get infected if you aren't.
"a mask can reduce the quantity of virus-laden crud you breathe out and reduce the amount of virus-laden crud you breathe in"
The former more than the latter I'd expect. By the time they comes to be breathed in the droplets will have shrunk by evaporation.
I'm old enough to remember that the term used to be "filterable viruses", i.e. (not very well characterised) infective agents that could pass through filters.
The tracing app is stealthily, you may already have it in which case you are a carrier. Look in settings,google. If you see it you must isolate (Turn off Bluetooth and/or switch of the mobile all to gather).
This post is in guest. Google is getting more and more brazen with what they can do with your phone,data and your live. The concept of Not without permission seems to be dead. Given the poor record of google technology wise this app could easily accuse you of being a carrier.
Anyone on Android 6 upwards received the Exposure Notification System API as part of an update to Google Play services. It's 'opt in' (Settings > Google, default is 'off') and still needs a Covid tracing app to be installed to work.
Or that's what they want you to think...
(not available on some Huawei phones... obviously they have other ways of tracking you!)
"A couple of dozen US states have signed up for the new tool but other jurisdictions – among them the UK, India, Singapore and Australia – are persisting with their own approaches on the basis that the Apple/Google tech makes it harder for their manual contact-tracers to access information."
This isn't true- the UK Gov are testing an app based upon the Google and Apple tools. Its called NHS Covid-19 and is available to folks in the IOW, LB of Newham and also NHS Responders for early testing..
Citation please ?
I do seem to remember that UK Gov specifically refused to use the Google/Apple solution on the basis that it used a decentralized approach, whereas UK Gov, obviously, wanted a centralized approach.
Please point me to the web page that says I'm wrong.
UK government initally refused to use Google Apple APIs, citing lack of distance estimation - and then wasted loads of money on a non functional (yet "World-beating") system from Dominic Cummings's Cambridge Analytica Vote Leave mates.
Then they discovered that Google and Apple know a little bit more about mobile phone systems than they do.
The other issue is that local public health authorities had been deprived of money for a decade - local professionals on the ground who would know which areas wpuld be more at risk of a pandemic. Contact tracing has been done fairly successfully in other countries by knocking in doors and asking questions.
Page 94 - the Private Eye podcast - has some useful background.
The thing is, they could still have used the Google/Apple solution and got one of their mates to make millions writing the app that is needed to employ it. But they decided to go it alone, even though they were warned that it wouldn't work as they hoped, because they wanted to gather a whole bunch of extra data. Instead of which they got - nothing.
lol, not in my non-update it won't :)
btw, if they decide to unlock the boot to let me update my android 6 something to get at least some criticial security updates due about 2 years ago, I'm willing to consider sharing my covid data. A deal?
...
nah, I didn't think so either
What's wrong with your phone that you don't receive Play Services updates anymore? Play Services get updated like an app, not like an OS update from your phone vendor.
Still, if your phone is five years old or whatever, you might not have Bluetooth 4 LE anyways - your hardware will preclude you.
Leaving it up to national (or in the case of the US where Trump has abdicated national response, the 50 state) authorities to develop an app was never going to happen very quickly. Having everything built in where you just the government to supply a template "here's where you report stuff that happens within our borders" which they could post on a website and the phone could automatically download when you opt in would have had it up and running already.
Though in the US we're nowhere near the place where tracing is useful. Most of the rest of the world that has had a competent response can benefit from it, so good luck to you guys hope this helps you get your tracking and tracing working better.
Here in the US we'll just let a thousand people die each day until there's a vaccine, after which a hundred will probably still die a day thanks to the antivaxxers who believe crazy shit like Bill Gates using a covid vaccine to implant a tracking chip in them. Meanwhile those antivaxxers will continue carrying their Android phone with them everywhere they go, searching with google, emailing with Gmail, putting an Alexa in every room of their house so they do all their purchasing through Amazon, and a Ring doorbell on the front door and Nest thermostat on the wall! But at least they'll be "safe" from Bill Gates tracking them...
The reasoning behind just providing an API and not a full app was that a method of entering confirmed cases is required - just letting people say "I've got Covid!" opens the door for all sorts of idiotic mischief. Artificial false positives just for the lols, for starters. So, the idea is that health authorities build an app atop the APIs and they are the arbiters of whether an individual has Covid, hopefully based on good testing. And that goes for the authorities accrediting private sector testing companies, if required.
Google and Apple assumed that competent health authorities exist.
They can still be the arbiters of who has covid without providing a full app. The data about the keys coming from phones with owners who has covid has to come from somewhere - you have point your phone at that source. Thus you can't claim yourself that you've tested positive, you can only identify to yourself to that source and if they confirm it they can make your keys available to others so they know they've been near someone who has covid.
The app removes a tiny of bit of configuration that the end user has to do (which could hopefully be made as easy as possible using QRcodes or some type of automated config from a website designed with standardized data layout) but doesn't add anything as far as securing the system from mischief. That has to come from whatever health authority you point your phone at.
Maybe a pedant alert *, but it bugs me that the phase 'silver bullet' is used when actually 'magic bullet' is meant. They are not interchangeable.
Silver bullets are for werewolves. They are the only solution to a particular problem. So the word 'solution' would work just as well.
A magic bullet (used, I believe, in describing how a single bullet could not have zig-zagged in the air to kill JFK) is something that will in 'one fell stroke' or 'a wave of a wand' solve a problem despite it being a complex one with many difficult issues.
Now that's cleared up, I'm sure they will never be misused again.
* OK, no 'maybe' about it.
Contact tracing is no substitute for mask wearing.
But carrying a rabbit's foot or a four-leaf clover would be a perfect substitute for that, and a lot less harmful to the bearer too.
CDC, WHO, US Surgeon General, Fauci, Australian health service, et al, in March, agreed that mask wearing by members of the public was not effective in slowing the spread of respiratory viruses, and that it could actually be harmful to people not medically trained.
That was, and is, the sum total of all of the human knowledge on the subject. Science is a slow process, and a paradigm shift like this doesn't happen within a few months (how long it took for all of the above entities to contradict their previous statements). Extraordinary claims require extraordinary proof, as the late great Carl Sagan said, and the idea that COVID is somehow unlike influenza, rhinovirus, cold coronavirus, SARS 1 coronavirus, and MERS coronavirus is an extraordinary claim. So is the assertion they made very early on, that unlike all those other respiratory viruses, this novel virus that we know nothing about absolutely, positively does not spread by aerosol.
The premise of droplets being the main modality of contagion is the basis for the six foot rule and the mask mania. Masks are useless for aerosols, and the evidence is quite clear by now that COVID is just a garden variety coronavirus, like all the others our species has known, and it spreads in the same way, which is to say, by aerosol. You'd have to ask the various "medical" government orgs why they refuse to state that the virus can and does spread by aerosol (airborne) the way that all the other respiratory viruses do.
Without the "it's about the droplet" excuse, we're back to the analogy of a mask (short of N95 or better respirator) to stop a virus being like using a chain link fence to keep mosquitoes out of your yard. If they admitted that the droplet thing was a ruse, they'd have to explain how their mask mandates and having us stand a couple a' meters away from one anothers have been the rule for weeks or months. Aerosols remain in the air for hours, and can be carried by HVAC systems into other rooms or even floors-- six feet isn't going to help you (or others around you), and neither is any mask short of a respirator of N95 or equivalent or better.
Preventing disease is not what masks are for, though... they're to give us a little ritual to carry out to make us think they're doing something about the virus, while demonstrating their subservience to their masters. Every problem calls for more government, right? People have been trained to think so. Despite their nearly perfect record to the contrary, people think governments solve problems, so when the media whips them into a lather with the latest out-of-context doom and gloom (in July, 73% of Americans surveyed thought COVID was getting worse, even though the death rate was by then down 98% from its mid-April peak), they get frightened and demand the government "do something." Mask rules are "something," all right, but "something effective?" No, quite assuredly not.
The virus is a force of nature. It's going to do what it is going to do until it runs its course. You know that little graph they showed when they were explaining what "flatten the curve" meant? Google it if you haven't. It showed the hospitalization rate from a virus like COVID if nothing was done, a curve that rose rapidly to a high peak, then dropped almost as quickly again to baseline. The "flattened" curve showed a slow rise to a peak in about July, and then a slow fall back toward baseline. The dotted line that cut across the highest part of the peak in the "do nothing" curve indicated the peak surge capacity of hospitals, while the flattened curve never crossed that line.
Note that the "do nothing" line didn't just keep rising, nor did it rise to a high level and stay put. It rose, then it fell rapidly. If you look at the death rate in the US (and probably other countries, but I don't know where to find their statistics... this is from the CDC), it rocketed to a peak in mid April, then began a drop that continues even now. There was a small peak in July (which did not show up in the stats until August, as it takes a while for the records to come in) that coincides with the riots/"mostly peaceful" protests, but it's been dropping again for well over a month since then.
From the way the media reports it, you'd think that without heroic measures by government officials, the death rate (and along with it the closely correlated hospitalization rate) would just go up and stay there. The media and pols breathlessly report the increased number of positive tests and imply that each one is virtually a death sentence, but they fail to report that the death rate dropped 98% (as reported by the CDC data from their site). It's not positive tests that made this thing so scary... it's deaths, and deaths are way, way down... but you won't hear that from the media. All you hear is the "this thing ain't goin' away" doom and gloom, even as it is in the process of going away. Despite our best efforts, the thing is in the process of running its course, just like pandemics always do. When you're going through hell, keep going! We keep trying to stop, and then they claim that slowing down will get us to the other side faster, which makes no sense.
Here's an experiment you can easily do. Wait for a foggy day. Go outside with a cloth tied over your face for half an hour. Come back in. The cloth will be damp. The reason it is damp is because it's picking up moisture from the fog as you breathe through it, and in the process of that it is stopping some of the fog from getting into your lungs. Fog is an aerosol.
So, gosh, masks are not 'useless against aerosols' at all, are they? They are not completely effective against aerosols but they are not completely ineffective, either. Masks help: who knew?
But of course, I'm sure you 'know' better. I mean who am I but a mere scientist, while you of course understand everything.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
