Contact High

Speaker 1: How much do you know about Bahrainian game shows?

Speaker 2: Absolutely nothing. Perfect.

Speaker 1: That is audio from RU at Home, A game show that airs in Bahrain where the audience can win a big cash prize as long as, and this is important, they're in their home watching while the show airs live. If you win, you get a video call at home from this enthusiastic game show host, And as viewers, you get to watch people get this call, and it's exciting because they're excited, because they want a bunch of money. It's fun. Are You at Home is fun. Are You at Home is broadcast by Bahrain TV, a state run television network, and the Bahrainian state, a constitutional monarchy overseen by King Hamad bin Isa Al Khalifa, has, like every other state in the world, spent the last four months grappling with this global pandemic. Like many governments, in March, Bahrain rolled out their contact tracing app. It's called Be Aware. The nature of and how well a user's data is handled is really, really essential to how secure a contact tracing app is. How we achieve that is this big problem that some of the biggest tech companies in the world are grappling with right now. But if you want a secure contact tracing app, and if you want to know if a contact tracing app is secure, you need to make sure it's taking the right kind of data and storing it in the right way. Which brings us back to Bahrain, in this game show, Are You at Home? Imagine you're sitting at home watching this game show and suddenly you get a call. You've won. You answer the call. You chat with the host. You get a prize. What a day. But persistent in the back of your head is the fact that you did not sign up to take part in RU at HOME. You didn't give anyone your name or phone number or physical location, and yet this program, operated by a state run television channel, seems to have all of it. And considering the fact that instead of anonymizing your data, you have to use your national ID to sign up for Be Aware, tethering the data the app accesses not just to your device but to your name, we can pretty easily imagine how RU at Home got all that incredibly private, incredibly privileged information. If you had any question whether your data was secure, not just your location but all the other private information Be Aware has access to, just know that it was given to a game show. Just know that the Bahrainian state has publicly published this sensitive personal information of suspected COVID-nineteen cases on the internet, including people's health status, nationality, age, gender, and travel history. You can go read it right now. Just know that if you live in Bahrain and you don't really like this, and you choose to not carry your phone, the government has begun using Bluetooth bracelets to make sure that certain people never get too far away from the machine that's now tracking them. Removing the bracelet is punishable by a very large fine. Contact tracing is a contradiction. On one hand, it's a potentially powerful tool in our arsenal as a society to fight the pandemic. If we're gonna keep the gears of our society turning in the delta between outbreak and vaccine, we need a way to accurately track the spread of the virus, to tell people when they've been exposed. We have the technology in our pockets to do this, we should almost certainly be using it. On the flip side, really

Speaker 3: the

Speaker 1: only people with a platform to publish these tools in a way that properly integrates them with our healthcare system is the government. And depending where on earth you live, you might not have the ability to keep that government accountable. On the other, other hand, go ahead and check the permissions on your phone right now, and think really hard about what you will give that data up for, if not for this. Amnesty International Security Lab has been investigating contact tracing around the world since April.

Speaker 3: We started really looking at this, in the beginning of and and end of April probably, and a couple of months then then it became obvious this was going to be an issue that was going to be the forefront of a lot of discussions around COVID nineteen in in many places.

Speaker 1: That's Amnesty International Security Director Claudio Guarneri, aka NEXX.

Speaker 3: And there was a lot of information coming out as well as a lot of misinformation coming out or misunderstandings coming out over what these apps were supposed to be doing, what they were actually doing. And so then we decided that it was kinda necessary to spend some more time and look a little bit more in-depth into into some of these. And, and then started kind of picking apart some of the ones that we immediately found to be a little bit more concerning.

Speaker 1: The Amnesty International Security Lab has been investigating and publishing findings on contact tracing apps in Kuwait, Qatar, Norway, and relevantly, Bahrain.

Speaker 3: Those that were either, you know, imposed as mandatory, for instance, which is something that we are advocating against, or that, quite openly, advertised access to to potentially sensitive data.

Speaker 1: We wanted to understand the contradictions at the heart of contact tracing. So we hopped on a call with Nex to talk about the tech behind these tools, the vulnerabilities that they expose, and whether or not you should download them. Here, on Hacked. We should probably define what contact tracing is. Sure. Probably should have done that before I just told a six minute story.

Speaker 2: About contact tracing.

Speaker 1: About contact tracing.

Speaker 2: Contact tracing is an old paper pen process of essentially finding out who someone's been in contact with. Literally contact tracing.

Speaker 3: Digital contact tracing, at least, is an attempt at digitizing that process of establishing contact between people who have been potentially exposed to the virus. So in epidemiology, contact tracing from a human perspective is a very well established practice.

Speaker 2: So if you, you know, come down with, you know, a virus or something else or, you know, any other reason why they need to know who you've been in contact with recently, somebody comes and asks you a long list of questions. What have you done? What did you do these days? Where were you? Who did you see? Do you talk to anybody? Etcetera etcetera. And they figure out kind of what your social your physical life social network has been, you know, for trying to trace who you've been in contact with because they need to be in touch with those people.

Speaker 1: Contact tracing apps look to do digitally what health care workers have been doing manually since at least the late eighteen hundreds, when public health officials would manually track the spread of smallpox from one household to another.

Speaker 3: The problem with it, though, that came apparent with COVID nineteen was kind of the scale, obviously, of the pandemic and the burden that these all put on on health authorities. It kind of brought the argument that these needed to be streamlined and digitized in order to relieve the health health workers from doing this as well, given the scale of this problem and and the wide distribution of the infections that were happening.

Speaker 1: How do you digitally track who has been in contact with who? Because who someone has contacted is different than where they've physically been.

Speaker 3: There's been few different kind of approaches or proposals on how to do that. Leveraging different types of data. You have seen early on proposal to, collect records from from cell towers, for instance. So that eventually was sort of abandoned because it was obvious that it was not accurate enough, and then it moved on to other possibilities. So, there's been attempts that, you know, or proposals to look at doing contact tracing using, GPS tracking, and some countries actually ended up doing so.

Speaker 1: Say you're a health authority trying to use smartphones to track who has had contact with who. You can't have contact unless you're in the same physical location, so your first instinct is gonna be to track people's physical location. The trouble is, cell phone towers are inaccurate, and if GPS works, you're now monitoring the physical location of your entire populace, not just when they potentially come in contact with the disease, but, like, all of the time. And people hate being tracked all of the time, which is when Singapore shows up.

Speaker 3: And at the beginning, Singapore, I suppose, was the one that put this on on on the spot as as a potential, method was using Bluetooth as as a vehicle for contact tracing. And many others have then followed, and Apple and Google and so on came with their own implementation. And with it, essentially, the principle is always the same. You know, authorities need to be able to, establish what are reconstruct whom with whom other people that have been found infected have been in contact in the period of incubation of the virus.

Speaker 1: But regardless of, like, which method a country ultimately decides to use, all of these approaches are really trying to do the same basic thing.

Speaker 3: And so did all of these try to to solve this problem. All of these different attempts try to solve this problem of how do you digitize human contact? How do you create a a a virtual record, an electronic record that represents as accurately as possible human contact, which it turns out is not a trivial thing to do. But, you know, we're seeing now kind of a trend towards, somewhat of a standardization around using Bluetooth as as a primary primary tech tactic, let's say.

Speaker 1: Before we dig deeper into this, like, what do you think about that tactic? What do you think about that trade off?

Speaker 2: Yeah. Like the you know, in the discussions about, you know, Bluetooth and GPS and all the rest of this stuff, You know, I think there's, what, 86% of North Americans, and I'll speak about North America because that's where we live, have smartphones. So there's a bunch of other people out there that, a, don't have phones, b, don't have smartphones, c, might not have devices with Bluetooth. So there would be a bunch of people left out of that equation even if we were to go GPS. But Bluetooth is way more fallible than a GPS solution. So it's like, at what point and at what error do we just not trust the system? Like, I'll tell you from a a lifetime in tech, garbage in, garbage out. And if the system is completely useless because it's only, you know, sub 50% reliable, then it's not even worth having. Because if we put any trust into it and it fails to perform, then we're just gonna trust it less and less.

Speaker 1: Starting something new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button is used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, that's shopify.com/hacked. This is not the first time that people have had to figure out the balance between security and autonomy in a big fat rush. Beautiful, isn't

Speaker 4: it? Beautiful, unethical, dangerous. You've turned every cell phone in Gotham into a microphone.

Speaker 5: High frequency generator receiver.

Speaker 4: You took my sonar concept and applied it to every phone in the city. With half the city feeding you sonar, you can image all of Gotham.

Speaker 1: And also, real things.

Speaker 6: Today, the president signed a big new anti terrorism bill that would expand the government's ability to track down terrorists, but at some cost.

Speaker 1: To figure that balance out, you really have to understand what info you're giving and what is being done with it in order to be able to draw a line of what you will and won't accept from one of these apps.

Speaker 3: You can look at this from different perspectives. You can look at it from a utilitarian perspective, and in that sense, the more data the better. Obviously, we look at at it from from a human rights perspective. So we try to provide a human rights interpretation to to this to this new technology as well. And when we do this, and we do this with every emerging technology, not just contact tracing, but everything sort of new that comes along, that has a potential to erode fundamental rights. Essentially, we apply two or three preconditions. The one the first one obviously being this technology that is being introduced and that has a risk of eroding people. So I'd say privacy in this case, needs to be necessary. And that's a very tricky one to answer in this case because of the fact that there's it's not something that has been done before, really, not at this scale. And and we we don't really know yet what will be the outcome of this experiment, let's say. So it's hard to really kind of argue both in favor and against the necessity of of digitizing contact tracing in this way. I think, personally, I think it's sort of an experiment that we'll have to live through and see the end of to really have a solid judgment on. Although, personally, you also have a lot of reservations in the darkest aspects of it.

Speaker 1: What's the second metric that you take into account in these situations?

Speaker 3: The second, criteria is is proportionality. We need to look at this new technology and see is what is being done or requested, citizens and people to to sacrifice in terms of fundamental rights, in terms of privacy, proportionate to the goal that this new technology is trying to achieve. And so in this case, when we look at proportionality of these technologies, essentially, we need to take a few steps back. So, if a technology has been proposed and a contact tracing approach has been proposed that has characteristics that by default are more respecting and preserving people's rights, so people's right to privacy, and still serve that purpose of, you know, provide a a functioning model to serve that original goal that that has been proven necessary. That for us, that's already an initial step that needs to be at least explored and taken before moving on to more, invasive measures and more kind of, models that would even further erode people's right to privacy.

Speaker 2: I think that is the good question because it's like, where is the trade off that we're comfortable with? Is are we comfortable trading off our personal privacy for a more of a community result? We all sacrifice our personal anonymity. We sacrifice, you know, privacy. We sacrifice lots of things, but we do that for the collective good. You know, we've just come through a period where we've all sacrificed a lot for the collective good, and this just begs the question of when do we stop sacrificing and who do we trust with our sacrifices.

Speaker 3: And there's the next question of what happens to this data? You know, who owns this data? How frequently it's being collected and where it is being collected and stored? And where the analysis of this data happens? And that's where the whole debate of centralization versus decentralization kind of comes in. But as it stands, so with all of the options that we've seen so far and all of the approaches and models that have been proposed so far, what seems to us is that, those that apply a decentralized architecture with Bluetooth contact tracing, with some phishing cryptography and privacy protection in place so that, you know, identifiers are rotated and all possible meet all possible de anonymization and attack that that could be done against the system are minimized as much as possible are the ones that we we think are favorable and are the ones that we think should be at least explored first. And and, and then needs to be a consensus of whether this is sufficient or not for the purposes of of of this pandemic.

Speaker 1: Pay me a picture of what, I guess, the most secure, the most private versions of one of these apps would look like. Like, take me through how this decentralized Bluetooth based version of this works.

Speaker 3: Yeah. Let's take, for example, the case of an app that does contact tracing using Bluetooth. And and that is the case in in most Western countries at this point and and in others as well. So the the basic functioning here is you have the app installed. I have the app installed. It's running in the background continuously, and the app essentially are constantly transmitting messages in the ether, let's say, with with my own identifier in it. It's, let's say, a computed string of some sort that that uniquely identifies my device. Your device does the same, so your app does the same. And when we when we meet or when we, share a space, let's say, I don't know, in the line at the supermarket or because we get a coffee or something, our two phones or the apps are exchanging these identifiers with each other. So, they can mark a record in an internal database of the app who I've seen, which identifiers of other users users have I seen in my proximity. And the proximity with Bluetooth tends to be between, you know, at maximum 10 to 20 meters distance that the the the signal sort of loses out, so you don't see any other people around you. And that's why it's sort of being favored for this particular, tracking because technically, you only want to have records of people that are very close to you. And so in this case, this is sufficient for this for this measurement. And so these records that are stored and and in your app, in your app's internal database, let's say, you will have a record of all of the identifiers that you have seen in your proximity and what day and what time.

Speaker 1: Which brings us to decentralized storage where all that data

Speaker 3: It's not being uploaded to to any central location. It's it's typically kept on the device. So the app does not transmit anything to any central location. The only circumstance where data is uploaded is when someone is being found as positive with COVID nineteen. And even if, you know, you could argue, well, it's it's fine. I trust the health authorities to to use this and and to not abuse access to this data and to not, use it for any other purpose than COVID nineteen. And that obviously is a lot of a lot of, you know, assumptions that you're making because we can't really know in advance is is law enforcement going to request access to these data for other purposes? For instance, for law enforcement users or for immigration control or or for God knows what else. And given the sensitivity of the data that that that this system aggregate, that's why it needs to be we need to pay particular attention and be particularly careful with their management.

Speaker 1: I appreciate that we're really looking at this from, like, a privacy and human rights perspective, but I I guess just from, like, a almost like a personal or utilitarian perspective. Like, what do you think of this, Scott?

Speaker 2: A lot of what I was saying is under the privilege of being a Canadian. No doubt. This has been going on. Like, most of the most people out there who are worried about this are already giving this information away. They're just giving it away for nothing instead of the, you know, a major social and physical benefit to society. So it's like, to me it's to me, if I was building this system, it would be concurrent GPS based all the time, and it would be centralized and queryable. And so the second you had your COVID test or your corona test or any test like, let's assume that, you know, this isn't the first and last pandemic. You know, when you go in for your test, you also scan in your track ID or whatever the the code used in the API will be. And so the second the system knows whether you're positive or negative, it knows whether knows who to alert because it can see in the proximity information from the GPS. Granted GPS is consumer GPS isn't, you know, within six feet. It's, like, within 30, but better safe than sorry, especially if you've been touching services and things like that. If I was looking to do this in the most utilitarian way and trusting that this information will be secured, safe, and kept to the best of people's ability, not only that, but most of this information exists already and is being given out to third parties already, and people have consented to that already, I think that this is to me, this is something that, you know, we should be discussing as a society in a much deeper, stronger way about, you know, collective good.

Speaker 5: Send help is now streaming on Hulu and Hulu on Disney plus.

Speaker 2: We're somewhere in the Gulf Of Thailand. Getting us out of here should be your focus. I'm your boss. You work for me.

Speaker 7: I'm not in

Speaker 2: the office anymore.

Speaker 5: It's bold, relentless, and endlessly rewatchable. Discover why critics give it 93% on Rotten Tomatoes. You're so fired.

Speaker 7: Oh, am I?

Speaker 2: No help is coming.

Speaker 5: Send help. Rated r. Now streaming on Hulu and Hulu on Disney plus.

Speaker 1: I guess I'm curious. Can you sort of tell me a little bit about your findings in regard to this this, you know, handful of countries whose apps really raise privacy and security alarms for you?

Speaker 3: We single out, a few of these countries, specifically Bahrain, Kuwait, Norway, and earlier on Qatar because of kind of the particular implementation that they decided to to adopt that were that we found to be problematic. So in in in the case of Bahrain and Kuwait in Norway, for instance, all of them share a similar design from a from a foundational point of view. So all of them do live GPS tracking, at different frequencies. So in all of these three three cases, we have kind of both that kind of what we believe to be excessive tracking. So real time GPS tracking and centralization in place where the data is automatically collected by by the authorities and they're stored somewhere. The issue that we found with Qatar that made it particularly worrisome was, one, the app was being mandatory at the end of of of Ramadan. And what we noticed is, on top of just doing this Bluetooth contact tracing, this app also, upon registration, and they required a phone number as well as your national Qatari national ID, to register an account with. Then the app would also display in the main view a QR code, a colored QR code that, is then being used by authorities at checkpoints and by police patrols and so on in order to check if you indeed are have the app installed, but also to check your health status and see if you're supposed to be in quarantine or not. And we found an issue with the way that the app were downloading this QR code that would allow anybody with a sufficient technical know how to essentially download a QR code for anybody in the country that had the app installed. So you could essentially crawl out all of these millions of QR codes that would not only tell you the health status of a particular individual, but also their names in English and Arabic. They would tell you their designated confinement location and GPS coordinates. So supposedly their home, the the location of their home addresses, as well as other details such as if they are being treated in isolation, the name of the medical facility, and so on. And so that was kind of particularly worrisome. That's why we disclosed it early on because we we got in contact with the health authorities in Qatar and tried to get it resolved as quickly as possible. And to their credit, they did. They minimized the data exposure pretty quickly and eventually released an update to the app. But it was a perfect example of, you know, this is what can happen if these apps are rolled out too quickly without a proper kind of considerations in place over what happens to this data that it's being suddenly centralized, especially this level of of of, detail and and with this amount of sensitive information about individuals, not just their names, but also their health status and so on and so on. Do you

Speaker 1: think these are mostly mistakes or do you think there are bad faith actors?

Speaker 3: It's hard to tell. I mean, broadly speaking, I start with a presumption that health authorities that are involved in in building these these tools do it in good faith, and under a lot of pressure. I think others have used it as as a mean to, yeah, let's say to to to show a little bit too much to the population they're doing something while neglecting other things that perhaps are a little bit more important. Let's say, you know, we have some some circumstances in countries that are put this issue of these contact tracing apps at the front of the agenda while they were still not investing sufficient efforts in in providing kind of, access to testing to to the people. Right.

Speaker 1: So should I download it? Like, I guess the sort of final ish question, like, is it worth it? Because I think I I sort of get the equation that this is a balance of necessity and proportionality, but, like, I I wanna stay secure, but I wanna help however I can. So do I download one of these apps? How do I make that decision?

Speaker 3: That's a very good question. This is so this is a question that I was asked as well in other occasions, especially in countries that were, for instance, we highlighted issues and where we found concerns. And I've been asked would would you install it or would you tell people to install it or uninstall it and it's not something that I feel really comfortable answering because ultimately it's really a kind of a personal analysis that one needs to make. So the main requirement here, though, is that that analysis and that decision, firstly, has to be has to be free and voluntary. And so the point where it's mandatory already, we're in the wrong because then it is not really a free choice. Then at that point, the second the second problem is, do you actually know well enough about what the app is doing and what is what happens to the data that is being collected? And in many cases, we've seen that that is not necessarily the case.

Speaker 2: So to me, and this is me being, you know, Scott, the infosec guy, who was, you know, freedom of whatever, like, has been around the space forever. This is something where I feel like we're gonna need to flip the switch and give it up.

Speaker 1: Yeah.

Speaker 2: Yeah. This is just one of those situations where it's like, you know, we're talking about real harm. Mhmm. Like, we're talking about physical deaths, like, the value of lives. Mhmm. The value of collective and wholesale lives. Not only that, but then we're also talking about the repercussions it's having as well as the closures. Like, we're like, not only do we have physical harm, we have economic harm, which is gonna cause more social harm, which is gonna cause more, you know, everything, crime, etcetera, etcetera. Like, this is a cascading waterfall that no one wants to be a part of, and collectively, as a society, we're gonna have to just deal with it. Mhmm. And for me, you know, this is just me personally. Like, I would be I would want this solution to be the best that it can. And to me, the best solution best version of this solution is not the one that's the most private. And that's sad to say, but it's true. It's like, you know, we have to make some trade offs between, you know, collective health and personal rights. It's like we make those trade offs every day. And I think society is trying to find a new balance with what's going on. And this is oddly another piece to that balancing act.

Speaker 3: Ultimately, I don't think the answer to the COVID-nineteen is a technological one. But, you know, we have to at least explore this option and see if it can play a role. But it can only play a role insofar as there's a coherent and well executed healthcare plan that takes into account all of the different avenues of response to this pandemic. And takes into account not just building a gadget that people will get behind, but, you know, providing access to health care, providing access to testing facilities, providing all of these different services and response measures that are are more necessary than probably the just app the app itself. But we'll have to see. We'll have to live through and see the end of it, I feel.

Speaker 1: What a nice straightforward, easy, simple, fun story to take your mind off a complicated world we just told. Big thanks to Next for joining me. It is a complicated topic but it was a really fun conversation to get to have and I hope it was, you know, informative or interesting to listen to. If you want to support the show, subscribe, comment, five stars, tell people, and check us out. Patreon.com/hackpodcast. Stay safe out there, and we're gonna catch you on the next one.

Speaker 8: If you've got an insurance question, you could talk to your nana. But she'd probably just tell you how she insured her couch from stains by covering it with plastic. Or you could talk to your local GEICO agent. They'll give you a different kind of warm and fuzzy with personalized assistance for all your insurance needs, like how you could be saving on your policies. So let your nana cover her couch in plastic and let a local GEICO agent help cover you, but not in plastic. To find a GEICO agent near you, visit geico.com/local.

Speaker 7: This episode is brought to you by Nespresso. Being the best version of yourself is an everyday journey, and it begins in the morning by taking a moment to ground yourself. With the new Nespresso Vertuo Up coffee machine, morning routines become rituals. Just one gentle press. And coffee brews, unfolding into whatever you need today. Bold or delicate, iced or hot, familiar or new. Press to explore. Every coffee, a new world. New Vertuo Up. Shop now at nespresso.com.

Speaker 9: The right window treatments change everything. Your sleep, your privacy, the way every room looks and feels. At blinds.com, we've spent thirty years making it surprisingly simple to get exactly what your home needs. We've covered over 25,000,000 windows and have 50,005 star reviews to prove we deliver. Whether you DIY it or want a pro to handle everything from measure to install, we have you covered. Real design professionals, free samples, zero pressure. Right now, get up to 45% off-site wide, plus get a free professional measure at blinds dot com. Rules and restrictions apply.