<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">There has been fairly big debate among the development tech community on the use of - mainly mobile phone - data for helping managing big crises, and it is not clear that the tracking was that useful then, but the privacy safeguards were very thin.<div class=""><br class=""></div><div class="">E.g. following the Ebola outbreak<div class=""><br class=""></div><div class=""><a href="https://cis-india.org/papers/ebola-a-big-data-disaster" class="">https://cis-india.org/papers/ebola-a-big-data-disaster</a></div><div class=""><br class=""></div><div class="">More broadly on the Data for Good movement from GSMA<br class=""><div class=""><br class=""></div><div class=""><a href="https://www.nature.com/articles/d41586-019-01679-5" class="">https://www.nature.com/articles/d41586-019-01679-5</a></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Javier<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 16 Mar 2020, at 00:48, Bill Cox <<a href="mailto:waywardgeek@gmail.com" class="">waywardgeek@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class=""><div class="">I work for Google in the sealed computing group (there are just a few of us). The project you probably never heard of that I worked on is called <a href="https://developer.android.com/about/versions/pie/security/ckv-whitepaper" class="">Cloud Key Vault</a>, where we encrypted your Android backups so that Google can't decrypt them, unlike Apple iPhone backups, <a href="https://9to5mac.com/2020/01/21/apple-reportedly-abandoned-end-to-end-icloud/" class="">which they hand over to law enforcement thousands of times per year</a>. I can't speak for Google, but many of us who work there take your privacy extremely seriously. In fact, to the point that likely we will not build a system like the one you suggest to track COVID19 and report to our users and health officials when we think someone was potentially exposed.<br class=""></div><div class=""><br class=""></div><div class="">It is just my personal opinion, but I feel we should build a secure facility audited by folks like the Electronic Frontier Foundation, and pay security experts like the NCC group to aid in verifying we have workable security systems that allow high performance computers to run open-source algorithms which the public can attest is running verified code for themselves. The algorithms would detect who had been in close proximity to people who later tested positive for COVID19, and encrypt notifications to users such that even Google could not easily determine who is being notified for potential COVID19 exposure. As a Google user, I personally would want to know if I was recently in close proximity to a COVID19 positive person. We also could encrypt results to health workers responsible for tracking down these folks, assuming user's are OK with that. We also could provide aggregate anonymized data to researchers. We'd just use the <a href="https://slate.com/technology/2019/02/reverse-location-search-warrants-google-police.html" class="">short-term location data we already have access to</a>.<br class=""></div><div class=""><br class=""></div><div class="">Unfortunately, I would be amazed if Google were to build such a system. The recent pressure on Google to back-door end-to-end encryption simply had the effect of causing most leadership at Google to avoid the issue like the plague. I suspect this is how Apple got stuck handing over your non-encrypted iPhone backups to law enforcement: after the San Bernardino mess, everyone internal to Apple probably found other projects less risky to work on, and eventually law enforcement figured out Apple had access to your iPhone backups.</div><div class=""><br class=""></div><div class="">Bill<br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></div>
-- <br class="">Liberationtech is public & archives are searchable from any major commercial search engine. Violations of list guidelines will get you moderated: <a href="https://lists.ghserv.net/mailman/listinfo/lt" class="">https://lists.ghserv.net/mailman/listinfo/lt</a>. Unsubscribe, change to digest mode, or change password by emailing <a href="mailto:lt-owner@lists.liberationtech.org" class="">lt-owner@lists.liberationtech.org</a>.</div></blockquote></div><br class=""></div></div></div></body></html>