The Swiss government released its SwissCovid contact tracing app yesterday. swissinfo.ch/eng/switzerlan… As many of our users have noted, the app’s use of Bluetooth makes you vulnerable to Google location tracking. Here's our perspective, as Switzerland's largest privacy company: 1/8
Switzerland’s app lets people infected with COVID-19 anonymously notify people they’ve been in contact with that they may also have contracted the virus. These people can then quarantine themselves, preventing further transmission of the disease. 2/8
SwissCovid uses the #DP3T protocol, which keeps all sensitive data stored locally on the users' device. Overall, the protocol is not too bad as we have explained here: protonmail.com/blog/privacy-c… However, it doesn't mitigate the privacy issues inherent to Android and Google. 3/8
The problem is that on Android devices, apps that use Bluetooth require location sharing permission. That means you need to enable location tracking to activate SwissCovid on Android, potentially letting Google monitor your location. This is unacceptable. 4/8
You can turn off location permissions for each of your apps, but Google may still have access to your location through other means. 5/8 apnews.com/828aefab64d441…
So while we are very concerned about the privacy issues here and advise you to turn off location access for other apps, the bottom line is the Internet surveillance economy must change. You shouldn't have to give up your privacy because you want to avoid getting COVID-19. 6/8
Letting a few companies have access to everything we say and do online (and increasingly offline) is bad for society, democracy, and, as we are now learning, public health. It’s time to take back control of our digital lives. 7/8
For those interested, Switzerland’s National Cyber Security Centre made a similar point in a security assessment of the app. 8/8 melani.admin.ch/dam/melani/de/…
