On April 10, 2020 a partnership was announced between the two dominant smartphone OS makers, Apple and Google. They would introduce a new contact tracing system for the purpose of alerting users if they had been exposed to SARS-CoV-2.
While this announcement was largely cheered by uninformed members of the public, technology experts were concerned about the privacy implications for such a system. Would this system be used by law enforcement in the future, long after the pandemic had passed? The system could be disabled at a software level, but could we really trust that it was disabled?
The threat in this system is not the protocol for contract tracing itself, which actually is private, but rather the third-party applications developed by governments and private organizations to store and manage this data.
In Western Australia, the government implemented mandatory contact registers with a custom app called “SafeWA.” Citizens of Western Australia must use the app when entering businesses and public places.
Exactly as predicted by privacy advocates, including myself, the police have been using SafeWA’s data for criminal investigations. This is despite the app’s claim that the data was to be encrypted, held for only 28 days, and use “solely for the purposes of [SARS-CoV-2] contact tracing.” The privacy of Western Australia citizens has been compromised. Furthermore, these violations of privacy undermine trust in local governments and law-enforcement, so that it will be even more difficult to manage future crises.
How To Protect Yourself
If it can happen with SafeWA, it can happen anywhere. The underlying technology used by SafeWA to collect proximity data over Bluetooth is still active in smartphones today. Since this risk exists, how can we protect ourselves from being unknowingly tracked?
This guide assumes that you are not exposed to SARS-CoV-2, do not wish to receive Covid-19 notifications, and that laws in your region do not prohibit the disabling of contact tracing.
First, disable the “Covid notifications” feature in your smartphone OS. This is an option in the settings, but will depend on your OS. At this point, you have “opted-out” of the contact tracing system, but if you’re concerned that Apple or Google may still be stealthily collecting that data against your wishes, continue with the next two steps.
Second, disable Bluetooth whenever you are in public. In iOS, this can only be done by navigating all the way from Settings > Bluetooth and flipping the switch to its ‘off’ position. Using the shortcuts on iOS from the ‘swipe up’ menu don’t disable Bluetooth system-wide, they only disconnect devices. We want to turn Bluetooth off entirely.
Thirdly, I like to carry my phone in a faraday bag when I am not actively using it. The faraday bag prevents radio signal from entering or leaving the phone at a physical level, so this offers an additional, final layer of protection. Even if the OS software on my phone is lying and Bluetooth with contact tracing is still enabled, my device will be unable to receive a “signal” from other Bluetooth-enabled devices. It is a bit like putting your phone in a black hole, where all communication is lost in the void.
In cases like this, the common rebuttal is some form of “but if you have nothing to hide, why are you worried?”
First, I dispute the notion that governments have earned my trust enough that I should consign this right to contact tracing to them. As demonstrated by the Western Australia example, the contact tracing system is rife for abuse.
However, even if it were true that governments can be trusted with contact tracing data, as a law abiding person, I have no need to participate in such a system. I know that I’m not committing crimes, so if my data were collected in a subpoena, it would only waste law enforcement’s time to bring me in for questioning. Therefore, opting out of this system entirely — and all forms of tracking, wherever possible — will only make the investigation of crimes more efficient.
Mistakes can be made in law enforcement. There are many cases of persons brought in for questioning in a case whose details were leaked to the media. The media then proceeded to run stories defaming this person. They may lose their livelihood and respect among friends and colleagues. And all because they were brought in for questioning on a crime that they had no involvement with whatsoever.
In more Orwellian terms, with this technology enabled it will be possible for police to identify political dissidents based on their physical contact with others. Contact tracing is therefore a dangerous technology, and those who are able to should choose to opt-out of this system using technology, and speak out against this technology with our words. I take contact tracing as an implicit threat to freedom of assembly.