Utah Launching COVID-19 Contact Tracing System With Apple and Google API This Week

[4jasontv]

How would 3rd party app know whether I am exposed or not? Exposure Notification data is off limit to 3rd party apps without EN entitlement profile, which Apple does not grant easily. And you must grant access when using such apps.

1. People enable exposure notifications.
2. You install GooBook which logs your GPS.
3. Everyone else installs GooBook, because hey it's free!
4. You are exposed to someone who tested positive.
5. So are other people.
6. Exposure notifications go out.
7. A percentage of people follow exposure guidelines and have a sudden change in local travel behavior.
8. Algorithm reviews GPS coordinates of different users to identify primary intersect.
9. Algorithm predicts quarantine/isolation for users who were close enough to the primary.
10. Change in targeted ads based on the expectation of illness or isolation.
11. Profit.

 

[LeadingHeat]

How would a system update fix it?

iOS 14.5 blocks developers being able to track you unless you expressly allow it. Meaning if a developer created a covid app that could also track you to sell your gps data for ads you would know about it. (Or at least once they got caught they’d be kicked off the App Store).

 

[4jasontv]

iOS 14.5 blocks developers being able to track you unless you expressly allow it. Meaning if a developer created a covid app that could also track you to sell your gps data for ads you would know about it. (Or at least once they got caught they’d be kicked off the App Store).

What? Why does the app have to have anything to do with COVID to track exposure? It just needs location logging enabled by the user.

 

[nutmac]

1. People enable exposure notifications.
2. You install GooBook which logs your GPS.
3. Everyone else installs GooBook, because hey it's free!
4. You are exposed to someone who tested positive.
5. So are other people.
6. Exposure notifications go out.
7. A percentage of people follow exposure guidelines and have a sudden change in local travel behavior.
8. Algorithm reviews GPS coordinates of different users to identify primary intersect.
9. Algorithm predicts quarantine/isolation for users who were close enough to the primary.
10. Change in targeted ads based on the expectation of illness or isolation.
11. Profit.

You lost me at 7-11.

People who are exposed to COVID-19 patient will not change their local travel behavior all that drastically. At best, they will get tested and when the result comes back negative as it would be in most cases, will resume their normal routines.

And if you are that paranoid, you can disable "Precise Location" Location Services setting (which is the default setting). Most apps don't need to know my precise location.

 

[4jasontv]

You lost me at 7-11.

People who are exposed to COVID-19 patient will not change their local travel behavior all that drastically. At best, they will get tested and when the result comes back negative as it would be in most cases, will resume their normal routines.

And if you are that paranoid, you can disable "Precise Location" Location Services setting (which is the default setting). Most apps don't need to know my precise location.

Here you are asked to self isolate until you are cleared. Assuming you get tested the same day it takes about 48 hours to get results. It wouldn’t even take a dozen people not doing their routine to realize you need to scan for the common person they all recently met. I suspect there is enough money in it that it will ever

The name of the game is subtle but sudden changes. It’s not only feasible it’s reasonable. This is the new normal. We won’t get to grocery shop without masks for five years (if your an optimist) or 20 (if you’re a realist). Being the first to know when someone is limited to their home will pay handsomely. The temptation is to great.

I suspect there is enough money in it that adverts will show up before people get tested.

 

[nutmac]

Here you are asked to self isolate until you are cleared. Assuming you get tested the same day it takes about 48 hours to get results. It wouldn’t even take a dozen people not doing their routine to realize you need to scan for the common person they all recently met. I suspect there is enough money in it that it will ever

The name of the game is subtle but sudden changes. It’s not only feasible it’s reasonable. This is the new normal. We won’t get to grocery shop without masks for five years (if your an optimist) or 20 (if you’re a realist). Being the first to know when someone is limited to their home will pay handsomely. The temptation is to great.

I suspect there is enough money in it that adverts will show up before people get tested.

I don't see what that has to do with Exposure Notifications. If an app has "always" access to location services, as your use case requires, it will detect your sedentary lifestyle and might suggest ads based on that.

The app won't be able to leverage Exposure Notification to target people in any way.

 

[LeadingHeat]

What? Why does the app have to have anything to do with COVID to track exposure? It just needs location logging enabled by the user.

Ahhh. Okay. Reading back through our comments I must have misunderstood your initial fear. You’re saying an app would be able to see which location you go to frequently (your home) and if you suddenly stay at said location (your home) for a week or two or three, it would guess you’re in quarantine. And then serve you ads. That does make sense, and it does seem easy to do! As long as the user enabled always allow on location. Which I don’t think much do anymore now that iOS reminds you that an app has been using it in the background.

If Facebook were to do it though, people are on that app enough multiples times throughout the day that even if “when using” was on it would have enough time to grab that data. And knowing Facebook, I definitely wouldn’t put it past them.

I think we got off on the wrong page because the article is talking about the covid contact tracing API and you’re talking about an individual app being able to do nefarious things if people quarantine and it notices.

 

[4jasontv]

Ahhh. Okay. Reading back through our comments I must have misunderstood your initial fear. You’re saying an app would be able to see which location you go to frequently (your home) and if you suddenly stay at said location (your home) for a week or two or three, it would guess you’re in quarantine. And then serve you ads. That does make sense, and it does seem easy to do! As long as the user enabled always allow on location. Which I don’t think much do anymore now that iOS reminds you that an app has been using it in the background.

If Facebook were to do it though, people are on that app enough multiples times throughout the day that even if “when using” was on it would have enough time to grab that data. And knowing Facebook, I definitely wouldn’t put it past them.

I think we got off on the wrong page because the article is talking about the covid contact tracing API and you’re talking about an individual app being able to do nefarious things if people quarantine and it notices.

Yeah. My point was the notification encourages behavior changes (which is good) but it could use behavior changes of others to estimate a risk. So it’s using it’s changes to its own location tracking to indirectly identify if you received an exposure notifications. So even if you don’t follow isolation guidelines it could figure out if you were recommended to do so and calculate a risk of infection based on others.

 

[4jasontv]

I don't see what that has to do with Exposure Notifications. If an app has "always" access to location services, as your use case requires, it will detect your sedentary lifestyle and might suggest ads based on that.

The app won't be able to leverage Exposure Notification to target people in any way.

See the other reply. It doesn’t need direct access to the notification to use the data provided. Notification warnings act as a catalyst to prompt behavior changes that can me mapped.

 

[nutmac]

See the other reply. It doesn’t need direct access to the notification to use the data provided. Notification warnings act as a catalyst to prompt behavior changes that can me mapped.

And so would getting tested positive for just about any ailments without using Exposure Notifications (EN).

The point being, you should be a lot more choosy with granting full "always" location services permission than worrying about EN. Take the opportunity to go through Settings | Privacy | Location Services and Bluetooth, and restrict access to only trusted apps. Most apps should only have Never or While using the App (with Precise Location disabled) and no Bluetooth access (unless you frequently cast video to TV). Limiting Background App Refresh also helps.

EN can provide a lot of value. While I have never been notified, back in early January, my "Matched Key Count" peaked at 5. That changed my behavior -- wearing more protective mask, keep more distance, and limit grocery shopping to late off-peak hours.

 

[4jasontv]

And so would getting tested positive for just about any ailments without using Exposure Notifications (EN).

The point being, you should be a lot more choosy with granting full "always" location services permission than worrying about EN. Take the opportunity to go through Settings | Privacy | Location Services and Bluetooth, and restrict access to only trusted apps. Most apps should only have Never or While using the App (with Precise Location disabled) and no Bluetooth access (unless you frequently cast video to TV). Limiting Background App Refresh also helps.

EN can provide a lot of value. While I have never been notified, back in early January, my "Matched Key Count" peaked at 5. That changed my behavior -- wearing more protective mask, keep more distance, and limit grocery shopping to late off-peak hours.

Not really. Because most things you might get you tested positive for won’t cause other people to stay at home. Don’t use gps isn’t a solution. This scenario will happen, likely with a large social network, a search based company, or a popular game funded by a foreign power. You can’t disable gps for maps, or geotagging or location based AR Games. Most people don’t want to deal with the app not working in the background so the authorize it to run when it wants.

 

[nutmac]

Not really. Because most things you might get you tested positive for won’t cause other people to stay at home. Don’t use gps isn’t a solution. This scenario will happen, likely with a large social network, a search based company, or a popular game funded by a foreign power. You can’t disable gps for maps, or geotagging or location based AR Games. Most people don’t want to deal with the app not working in the background so the authorize it to run when it wants.

Sure you can.

When it comes to location services, I try to limit to apps I trust. There are always few I don't trust all that much, such as Yelp. These apps are set to "while using". If I don't use the app, it cannot track whether I am home or not. And if I do need to use the app while I am home, I can always use the website.

I don't have any location aware games on my iPhone. But if you do, you are basically asking to be tracked whether you use EN or not.

I just don't see what EN has to do with this.

 

[4jasontv]

Sure you can.

When it comes to location services, I try to limit to apps I trust. There are always few I don't trust all that much, such as Yelp. These apps are set to "while using". If I don't use the app, it cannot track whether I am home or not. And if I do need to use the app while I am home, I can always use the website.

I don't have any location aware games on my iPhone. But if you do, you are basically asking to be tracked whether you use EN or not.

I just don't see what EN has to do with this.

You don't sound like most people, but most people don't want their app to stop working just because they stop using it. They want their establishment of choice app to pop up a notification when one is nearby. They want their friends to know where they are. They want their searches to be location-aware.

EN will initiate behavioral changes that apps can use to identify who might be exposed. The same way target knew a girl was pregnant before she gets tested. Except with target they figured it out based on her Target purchase history. They weren't monitoring her friends and neighbors. There are currently no rules in place that prevent an app from using changes in group behavior to identify individuals who were notified of exposure. The point is that enabling EN will make it easy for any app to figure out if you were exposed without needing access to your EN. The more popular the app the more likely it's going to be to figure out who has it. Hence why I said it was going to be GooBook, because you can be sure they are already comparing their location logs with user email message scans. The people who get test results emailed to them or post about exposure are calibrating the system.

And to head off the idea that I am paranoid - this is free money sitting on the table, so why wouldn't they take it. I promise that when it breaks out that one of them was doing this they are going to argue they never had access to EN and that their algorithm independently predicted they would be isolating. But that won't be true because EN recommended the behavior change which is what they will/are use(ing) to identify people.