A research paper was published looking into the privacy of the Google & Apple #covid19 exposure notification framework and Contact Tracing Apps scss.tcd.ie/Doug.Leith/pub… #GAEN
'We find that the apps are generally well behaved. In contrast, the Google Play Services component of these apps is extremely troubling from a privacy viewpoint.'
'Google Play services share the phone IMEI, hardware serial number, SIM serial number, handset phone number, the WiFi MAC address and user email address with Google, together with fine-grained data on the apps running on the phone.'
'Some may consider that the data gathering by Google is nothing new or unexpected and that mobile phone users have already factored in the risks of these kinds of corporate surveillance.' However
'this is an unsatisfactory response:
a) governments and public health authorities are strongly encouraging their entire population to use these apps, hence to take part in corporate surveillance'
a) governments and public health authorities are strongly encouraging their entire population to use these apps, hence to take part in corporate surveillance'
'b) it is highly likely that many users and even app developers are unaware of the detail and the level of intrusiveness and
c) the lack of an opt-out from this data collection seems in conflict with GDPR.'
c) the lack of an opt-out from this data collection seems in conflict with GDPR.'
Apart from from recommendations made in this paper, let me add that at least the GAEN component of the Play Services of course needs to become #FreeSoftware as well.
It looks like at least Apple now published source code for their exposure notification framework: developer.apple.com/exposure-notif…
And note that this was only what they've found after making Google settings as privacy friendly as possible. In the default setup, there's much more data being sent.
Google now also published code. Contrary to Apple, they published in a proper git repo, but this is just "snippets of code", not the real deal.
