Germany changes stance on Apple-Google contact tracing project

Posted:
in General Discussion edited April 2020
Germany has changed its stance on Apple and Google's work to create a contact tracing system for tracking and managing the spread of COVID-19, supporting a privacy-forward decentralized approach instead of using a centralized system.

A graphic explaining how Apple and Google's system would function
A graphic explaining how Apple and Google's system would function


On Friday, it was reported Germany and France were disagreeing with Apple and Google over security technicalities and the storage of data in the two tech giants' cross-platform system-level framework for contact tracing. Two days later, it seems that officials from one of the two countries have changed their mind to instead support similar efforts.

Germany was previously looking to create a centralized contact tracing system that relies on a central server, an approach that would allow health officials to be able to directly observe and potentially contact people suspected of carrying COVID-19. A central system approach is viewed as both a security and privacy risk by critics due to the handing over of potentially sensitive medical data to a single source, and paving the way to future state surveillance.

Apple and Google's system instead relies on a decentralized system, where contacts are stored only on user devices until they receive a positive COVID-19 diagnosis, with data only leaving the device upon that confirmation. The countries disagreed with the API's workings, and instead leaned towards the creation of a centralized monitoring system.

On Sunday, Reuters reports Germany has revised its plans to a "decentralized' approach. The country had backed the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) initiative, which relied on a centralized system, but Chancellery Minister Helge Braun and Health Minister Jens Spahn advised of the change away from PEPP-PT to a more private method.

"We will back a decentralized architecture that will only store contacts on devices. That is good for trust," said Braun in an interview.

At this early stage, it is unclear what Germany is planning for its own system, such as whether it will be taking advantage of the Apple and Google API, or if it would work with the Decentralized Privacy-Preserving Proximity Tracing (DP-3T) effort backed by Switzerland, Austria, and Estonia.

So far, it has taken the Fraunhofer HHI research institute off the project, with officials advising the group on Saturday of its removal. "The project will be handed over and others will be able to make use of the results we have achieved so far to build a decentralized solution," said Fraunhofer HHI chief Thomas Wiegand in a memo to employees.

On the news, DP-3T stated it was "very happy to see that Germany is adopting a decentralized approach to contact tracing and we look forward to its next steps implementing such a technique in a privacy-preserving manner."
«1

Comments

  • Reply 1 of 27
    Translation they have figured out how to use this to use this data against their citizens.  

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    This app sounds perfectly reasonable.  Just like all the worst ideas in history did when first proposed. 
    viclauyyclkruppsvanstrom
  • Reply 2 of 27
    normmnormm Posts: 653member
    Germany was previously looking to create a centralized contact tracing system that relies on a central server, an approach that would allow health officials to be able to directly observe and potentially contact people suspected of carrying COVID-19. A central system approach is viewed as both a security and privacy risk by critics due to the handing over of potentially sensitive medical data to a single source, and paving the way to future state surveillance.
    Just to be clear, in the Apple/Google system people who report having COVID-19 are verified in some manner by a health authority to actually have it; that information is known to the authority.  

    What the authority does not know is who spent time near an infected individual;  that information is only on people's devices, and is not reported to any authority.
    bageljoeyPetrolDaveCarnageStrangeDayscaladanian
  • Reply 3 of 27
    chaickachaicka Posts: 257member
    Singapore launched 'TraceTogether' app on 20th March, which tend open-sourced it to become the BlueTrace protocol released to the world to use and contribute to improve it. Australia has just recently released a COVID-19 tracing app which is developed based on BlueTrace protocol with its own modifications.

    It is interesting to see many countries/nations adopting the similar model of contact tracing, even Apple-Google's API seems to be similar on the model where contact data stays on the users' devices until permitted by users' to upload/share with health authorities.

    dewmejony0
  • Reply 4 of 27
    mattinozmattinoz Posts: 2,299member
    chaicka said:
    Singapore launched 'TraceTogether' app on 20th March, which tend open-sourced it to become the BlueTrace protocol released to the world to use and contribute to improve it. Australia has just recently released a COVID-19 tracing app which is developed based on BlueTrace protocol with its own modifications.

    It is interesting to see many countries/nations adopting the similar model of contact tracing, even Apple-Google's API seems to be similar on the model where contact data stays on the users' devices until permitted by users' to upload/share with health authorities.

    Australian government runs a significant trust deficit at the moment and is not opening code for review till well after release. Which impact speed of uptake. They are now in Full PR mode trying to get people to use it but most of the commentary is "Do it for the country, even if it isn't that good and highly suspect" or "don't let prefect be the enemy of good". The one I really like when it's pointed out Apple Google effort should be on device (that in the 10's of miilions) by end of week the response is we can't afford to wait. 

    I think Germany got it right especially in the context of a country that has land borders with other countries. Google Apple effort will work without revisiting the api once travel restrictions lift or if there is a trend reversal. Health departments will have what 14days of "exposure notifications" ready to go without having to overcome the lost momentum of people switching the app off. 
    PetrolDave
  • Reply 5 of 27
    dewmedewme Posts: 5,328member
    chaicka said:
    Singapore launched 'TraceTogether' app on 20th March, which tend open-sourced it to become the BlueTrace protocol released to the world to use and contribute to improve it. Australia has just recently released a COVID-19 tracing app which is developed based on BlueTrace protocol with its own modifications.

    It is interesting to see many countries/nations adopting the similar model of contact tracing, even Apple-Google's API seems to be similar on the model where contact data stays on the users' devices until permitted by users' to upload/share with health authorities.

    The Singapore tracing app sounds intriguing but isn't it a centralized system when its deployed, which Apple/Google (and now Germany) are specifically advocating against using? I have no doubt that Singapore has the technical chops to develop and deploy this kind of app, but from having spent quite a bit of time in Singapore I feel that its residents are probably more trusting of their government leaders than are people in other parts of the world like the US, and for good reason I might add. I guess we'll find out soon whether these apps help solve the problem. I'd personally have no problem using Apple's app, but I respect other people's right to decide for themselves whether they feel the benefit outweighs the risk, or vice versa. 
    edited April 2020
  • Reply 6 of 27
    p-dogp-dog Posts: 131member
    Toll! Deutschland hat sich gut entschieden! This is exactly the correct approach to take, and leaves France and Britain alone in their desire to have unlimited surveillance capabilities over the European population. All three major German-speaking countries now favor “decentralization”.
    prismaticsPetrolDaveGG1mattinozStrangeDayscaladanianchaicka
  • Reply 7 of 27
    croprcropr Posts: 1,122member

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    What a distorted view on the reality in most democratic countries. The chance that my government would be doing something like that is 0 percent, and the people would vote the government out of office at the next election.    The chance that a, possible foreign, company would abuse the data is much higher (just think of Facebook) and if this happens, I cannot do anything about it.
    GeorgeBMacStrangeDays
  • Reply 8 of 27
    GeorgeBMacGeorgeBMac Posts: 11,421member
    cropr said:

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    What a distorted view on the reality in most democratic countries. The chance that my government would be doing something like that is 0 percent, and the people would vote the government out of office at the next election.    The chance that a, possible foreign, company would abuse the data is much higher (just think of Facebook) and if this happens, I cannot do anything about it.

    So sad and ironic that those most vocally proclaiming the glories of Freedom and Democracy and denouncing authoritarian governments are the ones who have no trust their own government -- just cynicism and distrust.   It is a testament to the powers of propaganda that they could hold such contradictory views in perfect comfort.

    And, what is totally ironic is that the people's of those nations with authoritarian governments seem to trust their government far more than those proclaiming the glories of Freedom and Democracy.
    edited April 2020 headfull0wineblastdoor
  • Reply 9 of 27
    cropr said:

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    What a distorted view on the reality in most democratic countries. The chance that my government would be doing something like that is 0 percent, and the people would vote the government out of office at the next election.    The chance that a, possible foreign, company would abuse the data is much higher (just think of Facebook) and if this happens, I cannot do anything about it.
    Tell that to this guy:

    https://www.npr.org/2019/10/30/774788611/police-owe-nothing-to-man-whose-home-they-blew-up-appeals-court-says

    Of course, the country in which I live only claims to support liberty.  In reality, we've been trending fascist since WW II.
  • Reply 10 of 27
    avon b7avon b7 Posts: 7,621member
    It seems the debate on centralised vs decentralised is continuing even among countries which have opted for one or another. In Spain the technical committees are still evaluating different options. 

    This morning I was reading a quote from Richard Benjamins (Co-founder of odiseIA, an independent observatory on ethics and responsibility in AI) on the ethical side of things with people questioning privacy in centralised systems. 

    Basically he favours a centralised system and said if such a system actually worked it would be unethical not to use it in crisis situations. 
    GeorgeBMac
  • Reply 11 of 27
    gatorguygatorguy Posts: 24,176member
    cropr said:

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    What a distorted view on the reality in most democratic countries. The chance that my government would be doing something like that is 0 percent, and the people would vote the government out of office at the next election.    The chance that a, possible foreign, company would abuse the data is much higher (just think of Facebook) and if this happens, I cannot do anything about it.
    Tell that to this guy:

    https://www.npr.org/2019/10/30/774788611/police-owe-nothing-to-man-whose-home-they-blew-up-appeals-court-says

    Of course, the country in which I live only claims to support liberty.  In reality, we've been trending fascist since WW II.
    https://worldpopulationreview.com/countries/freest-countries/
  • Reply 12 of 27
    mjtomlinmjtomlin Posts: 2,673member
    At this early stage, it is unclear what Germany is planning for its own system, such as whether it will be taking advantage of the Apple and Google API, or if it would work with the Decentralized Privacy-Preserving Proximity Tracing (DP-3T) effort backed by Switzerland, Austria, and Estonia.


    Two points to note:

    1. The Apple/Google implementation can be integrated into other protocols such as DP-3T.

    2. Apple and Google no longer refer to it as "contact tracing", they are now calling it "exposure notification", which better describes what their API actually does.
  • Reply 13 of 27
    rerollreroll Posts: 60member
    This article, as the one before on this topic, gives the wrong picture. Apple / Google is a centralized protocol, because diagnosed user send their hash to a centralized server owned by Apple / Google. Other participants to the program regularly download the list to check if they were potentially exposed. The solution proposed by the French government, actually not the French government but by the French research institute in computer science is to not push the diagnosed user hash to a centralized server, but the hash values of all users that were in contact during the relevant period. This means that it’s not even the covid positive hashes that are pushed, but users that crossed path with one. While I personally think that the difference is not worth deciding not using Apple / Google protocol, this is 1/ their right and 2/ Apple / Google protocol is not more decentralized than the French alternative. Not getting into the details of the French proposal is understandable, I had some difficulties to get into the details. But Apple’s protocol is available for everyone to read on their website. Read before spreading nonsense. 
  • Reply 14 of 27
    GeorgeBMacGeorgeBMac Posts: 11,421member
    avon b7 said:
    It seems the debate on centralised vs decentralised is continuing even among countries which have opted for one or another. In Spain the technical committees are still evaluating different options. 

    This morning I was reading a quote from Richard Benjamins (Co-founder of odiseIA, an independent observatory on ethics and responsibility in AI) on the ethical side of things with people questioning privacy in centralised systems. 

    Basically he favours a centralised system and said if such a system actually worked it would be unethical not to use it in crisis situations. 
    Democratic societies have known throughout my lifetime that neither is a perfect answer:   We need centralized control when the nation or its people are threatened and decentaiization to enable growth, development and expansion into new areas.

    Unfortunately, ideologues have developed major propaganda outlets that espouse that it is their way or no way and they developed and propagated cults into jihadists and evangelists preaching the Gospel of their ideology. 

  • Reply 15 of 27
    gatorguygatorguy Posts: 24,176member
    avon b7 said:
    It seems the debate on centralised vs decentralised is continuing even among countries which have opted for one or another. In Spain the technical committees are still evaluating different options. 

    This morning I was reading a quote from Richard Benjamins (Co-founder of odiseIA, an independent observatory on ethics and responsibility in AI) on the ethical side of things with people questioning privacy in centralised systems. 

    Basically he favours a centralised system and said if such a system actually worked it would be unethical not to use it in crisis situations. 
    Democratic societies have known throughout my lifetime that neither is a perfect answer:   We need centralized control when the nation or its people are threatened and decentaiization to enable growth, development and expansion into new areas.

    Unfortunately, ideologues (in both major US political parties) have developed major propaganda outlets that espouse that it is their way or no way and they developed and propagated (Democrat) cults into jihadists and (Republican) evangelists preaching the Gospel of their ideology. 

    George, I think Salon is right up your alley as a solidly liberal and Democrat supporting bastion against the far right media you complain about. They don't like the direction you're taking either. 
    https://www.salon.com/2019/09/22/doomed-delusional-divided-and-corrupt-how-the-democratic-party-became-a-haunted-house/

    Now back to the topic, I don't think we're going to see too many complaints about the Apple/Google exposure notification efforts once it's been rolled out. The problem now is that too many people completely misunderstand how it will be designed and end up posting FUD either by intent or accident. The problem later may be that too few take part in it. Heck even the widely praised BlueTrace that Singapore came up with was only used by around 16% of their population, and they actually trust their government for the most part. That small a percentage is hardly enough to have been very effective. Australia will suffer the same fate I'm afraid.

    IMHO Apple/Google have the greatest chance of seeing something more than 15% uptake with as consistent and pervasive as it will be, but a lot more than that is necessary for a truly effective contact tracing plan. 
    edited April 2020 dewme
  • Reply 16 of 27
    blastdoorblastdoor Posts: 3,255member
    cropr said:

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    What a distorted view on the reality in most democratic countries. The chance that my government would be doing something like that is 0 percent, and the people would vote the government out of office at the next election.    The chance that a, possible foreign, company would abuse the data is much higher (just think of Facebook) and if this happens, I cannot do anything about it.
    I agree it's a distorted view, but I also think you're being too naive/optimistic when you state that the chance that your government would be doing something like that is 0 percent. The price of freedom is vigilance, and that doesn't sound very vigilant to me. 

    All individual humans, and groups of humans, and institutions created by humans, have the potential for both good and harm. There are are no easy answers, but Apple and Google appear to have arrived at a solution that balances multiple competing priorities. 
  • Reply 17 of 27
    basjhjbasjhj Posts: 97member
    p-dog said:
    Toll! Deutschland hat sich gut entschieden! This is exactly the correct approach to take, and leaves France and Britain alone in their desire to have unlimited surveillance capabilities over the European population. All three major German-speaking countries now favor “decentralization”.
    Expect others in the EU to follow as well. The Dutch government, in her infinite 'wisdom', completely botched an "appathon" in order to get to a tracing app as soon as possible. After that epic fail they are now changing the process, and to me it appears likelier by the day that the Apple|Google solution is going to bail them out, at least partly.
  • Reply 18 of 27
    StrangeDaysStrangeDays Posts: 12,834member
    Translation they have figured out how to use this to use this data against their citizens.  

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    This app sounds perfectly reasonable.  Just like all the worst ideas in history did when first proposed. 
    Paranoid nonsense. I think there is a cabin in the woods with your name on it.
    edited April 2020 GeorgeBMac
  • Reply 19 of 27
    StrangeDaysStrangeDays Posts: 12,834member

    cropr said:

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    What a distorted view on the reality in most democratic countries. The chance that my government would be doing something like that is 0 percent, and the people would vote the government out of office at the next election.    The chance that a, possible foreign, company would abuse the data is much higher (just think of Facebook) and if this happens, I cannot do anything about it.
    Tell that to this guy:

    https://www.npr.org/2019/10/30/774788611/police-owe-nothing-to-man-whose-home-they-blew-up-appeals-court-says

    Of course, the country in which I live only claims to support liberty.  In reality, we've been trending fascist since WW II.
    An atrocious event. They ruined his house over what began as the theft of a belt and two shirts. Clearly, the police/state has too much power via policy in that district. Unfortunately it is conservative courts that typically side with law enforcement over the citizenry. This needs to change; the state absolutely should have financial responsibility for damages they inflict in the name of the job. Without any checks or balances for accountability, they could bulldoze over anything in the name of getting the job done.

    However, the good news is, in our country we have a court system that goes up to the SCOTUS, and there are opportunities for them to correct bad policy. 
    edited April 2020 GeorgeBMac
  • Reply 20 of 27
    StrangeDaysStrangeDays Posts: 12,834member
    gatorguy said:
    cropr said:

    The difference between corporations spying on you and governments doing it is that a corporation can’t (yet) send armed mercenaries to your door at 3:00 AM.

    What a distorted view on the reality in most democratic countries. The chance that my government would be doing something like that is 0 percent, and the people would vote the government out of office at the next election.    The chance that a, possible foreign, company would abuse the data is much higher (just think of Facebook) and if this happens, I cannot do anything about it.
    Tell that to this guy:

    https://www.npr.org/2019/10/30/774788611/police-owe-nothing-to-man-whose-home-they-blew-up-appeals-court-says

    Of course, the country in which I live only claims to support liberty.  In reality, we've been trending fascist since WW II.
    https://worldpopulationreview.com/countries/freest-countries/
    The Cato Institute, that great Koch Industries libertarian think tank in the sky. No biases there..

    Strange that Russia isn't penalized more on their list, considering recent clamp-downs on free speech, like banning criticism of the government online. Oops.
Sign In or Register to comment.