Thread by @quantumcatgirl

The slides and the materials for my #37C3 presentation on Singapore's TraceTogether contact tracing system is now out!

I have some thoughts about digital contact tracing systems. A 🧵(1/n)github.com/bitowlonline/T…

Digital contact tracing systems can expose a lot of personal information - who we have been with, where have we gone, etc. People are naturally concerned about how this information would be collected, stored and used, especially in a centralized contact tracing system. (2/n)

Tech can be used to do a lot of good in this world, and while building tech can be fun, as hackers we need to understand how tech we build can be (ab)used by different actors, and being able to think in terms of policy design & analysis is important even for hackers. (3/n)

I personally opine that getting hackers to go for a "teardown session", knowing they can only give assessments based on the hardware presented to them, putting their assessments on press releases, then introducing a SafeEntry Gateway months later, is disingenuous at best. (4/n)

The public should have the right to know how this tech works, what is inside the tokens and especially what is inside the SafeEntry Gateways.

I thus consider it a duty of hackers everywhere to inspect similar systems, and present their findings to the public responsibly. (5/n)

Here are some photos of the inside of the SafeEntry Gateway, for your reference and enjoyment.

It uses a STM32WB55, as the TraceTogether Pod V1.2 Rev F but with a nRF9160 4G IoT cellular modem. (6/n)

Here are also pictures that I have taken of what I know to be the last version of the TraceTogether Token: TraceTag-Apollo V4.7 (7/n)

A video recording of this presentation will be provided soon. Thank you, those who attended or helped me out with this in any way!

There is still to work to be done with this - watch this space for more, like possible firmware dumping! (8/8)