The Cat Herder

This week's title taken from graffiti which is apparently popping up in all corners of the world. 😼   April 26 · Issue #79 · View online This week’s title taken from graffiti which is apparently popping up in all corners of the world. 😼 Your dystopian future is here, Coronopticon video edition. MIT Technology Review @techreview This new workplace monitoring tool issues an alert when anyone is less than six feet apart. Amazon is also using similar software to monitor the distances between their warehouse staff. https://t.co/aUiVgUMWg5 https://t.co/ZYKFcyben6 8:17 PM - 25 Apr 2020 The battle between standards for Bluetooth contact tracing apps continued this week. Hans-Christan Boos, the impresario of the PEPP-PT group, told the German press that he saw no point in having any public discussion of how the system he’s championing will work because it’s too complicated for regular people to understand. The PEPP-PT group then declined an invitation to take part in a webinar hosted by Sophie in’t Veld MEP and the Renew Europe grouping. (This webinar is available to watch back here.) Michael Veale of the DP3T did take part and outlined the differences between their decentralised model and the centralised model which PEPP-PT are proposing. Senior executives from Apple and Google indicated on the same panel that the decentralised DP3T model is very close to what they are hoping to achieve with their APIs. EU member states which have committed to the decentralised standard DP3T include Estonia, Austria, Switzerland and Germany. The latter of these coming abruptly late on Saturday night. The HSE’s logo remains on the PEPP-PT group’s website. This is despite numerous academic and research institutions withdrawing from membership of the group, most citing the lack of transparency as their reason. The Dutch government invited submissions for candidate apps. All of the finalists were found wanting. The Belgian government confirmed it will not be developing an app in the short term. “manual contact tracking by healthcare staff is proven to be effective, so let’s get on with it.” A Few Words On Language During the week European Commissioner for the Internal Market Thierry Breton tweeted about a discussion he’d had with Tim Cook about deconfinement apps. The language has modulated, shifted, extended the purpose, aims, goals and possibilities of this piece of technology. To their credit Apple and Google have tried to shift expectations in the opposite direction, back towards what is actually possible to achieve. What was a “Contact Tracing API” has now become an “Exposure Notification API”, removing some of the implied magic bullet-ness of the former. While the words and expectations move underfoot there is still scant evidence of how effective of these solutions may be in achieving their originally-claimed purpose, tracking the spread of Covid-19. The EDPB guidelines published during the week restate that this is important. Furthermore, while data and technology can be important tools, they have intrinsic limitations and can merely leverage the effectiveness of other public health measures. The general principles of effectiveness, necessity, and proportionality must guide any measure adopted by Member States or EU institutions that involve processing of personal data to fight COVID-19 The Irish Times had a slightly unusual article on Thursday which was half puff piece and half news piece about a company called Nearform, who have been “tasked” by the HSE to develop a contact tracing app. Or at least that’s what the article said. Later the same day the Minister for Health was asked questions in the Dáil about the app by Deputies Ossian Smyth and Roderic O'Gorman. Rather than dodging the questions Minister Harris simply opted not to respond to the majority of them. He did say the app “is being developed by a coalition of developers and analysts led by the HSE”. Once again we see language choices abstracting and obfuscating who is doing what and for which purpose. Violet Blue notes in a piece for Engadget that [i]t’s no coincidence that the locations seeing success with contact tracing smartphone apps have at least two things in common: governments behind the apps are tech-savvy, and the places they’re working are those with more collectivist societies — specifically, those in East Asia. Most of those tech-savvy governments emphasize controls on digital privacy (like South Korea and Singapore), easing issues of trust that might create avoidance. The Irish government is not tech-savvy. Despite all the wishful thinking to the contrary. The Irish government is proximate to technology. The Irish government has enjoyed many years of standing next to technology company executives for photo opportunities. This does not translate into awareness or ability. A very large number of multinational technology companies have chosen to locate their EMEA headquarters in this country for reasons which have nothing to do with the level of technical nous in government circles. The Irish state has a poor track record in respecting the fundamental rights to protection of personal data and privacy. A joint letter signed by 300 experts from 26 countries warned during the week that digital contact tracing efforts will fail unless these rights are respected. Genomics Medicine Ireland published the second of two public notices informing people about the research they are conducting with Beaumont Hospital and offering they or their family members the ability to opt out of the study. The first notice was published six weeks ago, just as the global pandemic struck Ireland. This second one has been published when Ireland is in full lockdown as a result of the global pandemic. Newspaper sales are down, the numbers of physical papers being printed is reduced, and people have their minds on other things. It is highly questionable whether this constitutes sufficient notification, or a good faith attempt to contact people in order to allow them to opt out of this study. This Twitter thread from Andrew Hines sums up more of the problems with the process which got us here. Andrew Hines @andrewhines While our focus is on #COVID tracking privacy, a worrying advert in today’s @irishtimes advert today requesting consent from families of deceased brain tumour patients. Plan to share #DNA with Chinese WuXi NextCODE owned company GMI. https://t.co/fHfJZqAxpu 6:49 PM - 25 Apr 2020 It's heading in this direction Glenn F. Henriksen @henriksen So, in Norway the gov made a Covid tracker app. Wouldn't open the source code, saying open source was a security risk, especially given the short dev time. In less than a week, ppl have decompiled it, published how it works, found sec faults and made GH repos. That went well... 5:57 PM - 19 Apr 2020 The press release from the office of the UN’s High Commissioner for Human Rights led with Ireland’s attempt to improve access to welfare benefits and digital government services through its Public Services Card (PSC) is being implemented in ways that gravely prejudice the least well-off, said a UN expert today. The accompanying letter ran to over 40 pages. What happened next was perhaps initially surprising. A belligerent response signed by the Tánaiste and Minister for Foreign Affairs issued from the Irish permanent mission in Geneva. It was not an especially diplomatic letter, and it seemed surprising that the staff in a diplomatic mission would have penned it. Subsequent reporting has indicated that officials from the Department of Employment Affairs and Social Affairs drafted this response. Which makes it all much less surprising. Professor Alston did some media interviews, including one with Pat Kenny on Newstalk, noting that the Irish government had “made a ‘very big push’ to delay the publication of his letter raising concerns about the implementation of the Public Services Card.” The Department of Social Protection, meanwhile, claimed Prof Alston “issued his letter without notice, in the final weeks of his tenure as Special Rapporteur, and without any fact checking or engagement with the Department”. In a statement, the Department noted: “If offered the opportunity the Department would have been pleased to correct the numerous inaccuracies in the allegations that he reports.” Prof Alston - the UN Special Rapporteur on extreme poverty and human rights - says that the Government hasn’t indicated what mistakes have been made. The similarities between the approach taken to Alston’s letter and that taken by DEASP to the DPC’s report last year are striking. Delay, ask for inappropriate meetings, when these meeting requests are quite properly rebuffed then cry foul. Pretend to be shocked that a third party would consider evidence which came from any other source than the Irish state. Ignore the substance of the criticism in favour of loudly complaining about process. Professor Alston has extended an invitation to Simon Coveney to identify the alleged factual errors in his letter. The Tánaiste does not appear to have responded yet. Cianan Brennan sums up another week in the life of the Public Services Card well for the Irish Examiner. As mentioned above, the EDPB published two pieces of guidance. ‘Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak’ | Direct link to PDF ‘Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak’ | Direct link to PDF “The problem with magic bullets is that they sometimes miss their target. The biggest issue of all with smartphone contact-tracing, though, is that it would mark a step-change in state surveillance capabilities. Such a momentous decision cannot be left to Matt Hancock and his colleagues in their Downing Street bunker. This is a central point in a landmark review of the issue conducted by UK research group the Ada Lovelace Institute. A decision to deploy mandatory proximity-sensing technology, says the institute, is too important to be left to technocrats. There has to be proper parliamentary scrutiny and primary legislation with real sunset clauses.” John Naughton in the Guardian writes that ‘Contact apps won’t end lockdown. But they might kill off democracy’. Next up is the landmark review Naughton mentions, from the Ada Lovelace Institute: ‘Exit Through The App Store’. Rob Kitchin‘s comprehensive review 'Using digital technologies to tackle the spread of the coronavirus: Panacea or folly?’ is also excellent. Broad in scope with the right amount of depth and extremely accessible at the same time. Endnotes & Credits The elegant Latin bon mot “Futuendi Gratia” is courtesy of Effin’ Birds. As always, a huge thank you to Regina Doherty for giving the world the phrase “mandatory but not compulsory”. The image used in the header is by Krystian Tambur on Unsplash. Any quotes from the Oireachtas we use are sourced from KildareStreet.com. They’re good people providing a great service. If you can afford to then donate to keep the site running. Digital Rights Ireland have a storied history of successfully fighting for individuals’ data privacy rights. You should support them if you can. Find us on the web at myprivacykit.com and on Twitter at @PrivacyKit. Of course we’re not on Facebook or LinkedIn. If you know someone who might enjoy this newsletter do please forward it on to them. Did you enjoy this issue? In order to unsubscribe, click here. If you were forwarded this newsletter and you like it, you can subscribe here. Powered by Revue Privacy Kit, Made with 💚 in Dublin, Ireland

This week’s title taken from graffiti which is apparently popping up in all corners of the world.

😼

Your dystopian future is here, Coronopticon video edition.

The battle between standards for Bluetooth contact tracing apps continued this week. Hans-Christan Boos, the impresario of the PEPP-PT group, told the German press that he saw no point in having any public discussion of how the system he’s championing will work because it’s too complicated for regular people to understand.

The PEPP-PT group then declined an invitation to take part in a webinar hosted by Sophie in’t Veld MEP and the Renew Europe grouping. (This webinar is available to watch back here.) Michael Veale of the DP3T did take part and outlined the differences between their decentralised model and the centralised model which PEPP-PT are proposing. Senior executives from Apple and Google indicated on the same panel that the decentralised DP3T model is very close to what they are hoping to achieve with their APIs.

EU member states which have committed to the decentralised standard DP3T include Estonia, Austria, Switzerland and Germany. The latter of these coming abruptly late on Saturday night.

The HSE’s logo remains on the PEPP-PT group’s website. This is despite numerous academic and research institutions withdrawing from membership of the group, most citing the lack of transparency as their reason.

The Dutch government invited submissions for candidate apps. All of the finalists were found wanting.

The Belgian government confirmed it will not be developing an app in the short term. “manual contact tracking by healthcare staff is proven to be effective, so let’s get on with it.”

A Few Words On Language

During the week European Commissioner for the Internal Market Thierry Breton tweeted about a discussion he’d had with Tim Cook about deconfinement apps. The language has modulated, shifted, extended the purpose, aims, goals and possibilities of this piece of technology.

To their credit Apple and Google have tried to shift expectations in the opposite direction, back towards what is actually possible to achieve. What was a “Contact Tracing API” has now become an “Exposure Notification API”, removing some of the implied magic bullet-ness of the former.

While the words and expectations move underfoot there is still scant evidence of how effective of these solutions may be in achieving their originally-claimed purpose, tracking the spread of Covid-19.

The EDPB guidelines published during the week restate that this is important.

The Irish Times had a slightly unusual article on Thursday which was half puff piece and half news piece about a company called Nearform, who have been “tasked” by the HSE to develop a contact tracing app. Or at least that’s what the article said.

Later the same day the Minister for Health was asked questions in the Dáil about the app by Deputies Ossian Smyth and Roderic O'Gorman. Rather than dodging the questions Minister Harris simply opted not to respond to the majority of them. He did say the app “is being developed by a coalition of developers and analysts led by the HSE”. Once again we see language choices abstracting and obfuscating who is doing what and for which purpose.

Violet Blue notes in a piece for Engadget that

The Irish government is not tech-savvy. Despite all the wishful thinking to the contrary. The Irish government is proximate to technology. The Irish government has enjoyed many years of standing next to technology company executives for photo opportunities. This does not translate into awareness or ability. A very large number of multinational technology companies have chosen to locate their EMEA headquarters in this country for reasons which have nothing to do with the level of technical nous in government circles.

The Irish state has a poor track record in respecting the fundamental rights to protection of personal data and privacy. A joint letter signed by 300 experts from 26 countries warned during the week that digital contact tracing efforts will fail unless these rights are respected.

Genomics Medicine Ireland published the second of two public notices informing people about the research they are conducting with Beaumont Hospital and offering they or their family members the ability to opt out of the study.

The first notice was published six weeks ago, just as the global pandemic struck Ireland. This second one has been published when Ireland is in full lockdown as a result of the global pandemic. Newspaper sales are down, the numbers of physical papers being printed is reduced, and people have their minds on other things.

It is highly questionable whether this constitutes sufficient notification, or a good faith attempt to contact people in order to allow them to opt out of this study.

This Twitter thread from Andrew Hines sums up more of the problems with the process which got us here.

The press release from the office of the UN’s High Commissioner for Human Rights led with

The accompanying letter ran to over 40 pages.

What happened next was perhaps initially surprising. A belligerent response signed by the Tánaiste and Minister for Foreign Affairs issued from the Irish permanent mission in Geneva. It was not an especially diplomatic letter, and it seemed surprising that the staff in a diplomatic mission would have penned it.

Subsequent reporting has indicated that officials from the Department of Employment Affairs and Social Affairs drafted this response. Which makes it all much less surprising.

Professor Alston did some media interviews, including one with Pat Kenny on Newstalk, noting that the Irish government had “made a ‘very big push’ to delay the publication of his letter raising concerns about the implementation of the Public Services Card.”

The similarities between the approach taken to Alston’s letter and that taken by DEASP to the DPC’s report last year are striking. Delay, ask for inappropriate meetings, when these meeting requests are quite properly rebuffed then cry foul. Pretend to be shocked that a third party would consider evidence which came from any other source than the Irish state. Ignore the substance of the criticism in favour of loudly complaining about process.

Professor Alston has extended an invitation to Simon Coveney to identify the alleged factual errors in his letter. The Tánaiste does not appear to have responded yet.

Cianan Brennan sums up another week in the life of the Public Services Card well for the Irish Examiner.

As mentioned above, the EDPB published two pieces of guidance.

‘Guidelines 03/2020 on the processing of data concerning health for the purpose of scientific research in the context of the COVID-19 outbreak’ | Direct link to PDF

‘Guidelines 04/2020 on the use of location data and contact tracing tools in the context of the COVID-19 outbreak’ | Direct link to PDF

• “The problem with magic bullets is that they sometimes miss their target. The biggest issue of all with smartphone contact-tracing, though, is that it would mark a step-change in state surveillance capabilities. Such a momentous decision cannot be left to Matt Hancock and his colleagues in their Downing Street bunker. This is a central point in a landmark review of the issue conducted by UK research group the Ada Lovelace Institute. A decision to deploy mandatory proximity-sensing technology, says the institute, is too important to be left to technocrats. There has to be proper parliamentary scrutiny and primary legislation with real sunset clauses.” John Naughton in the Guardian writes that ‘Contact apps won’t end lockdown. But they might kill off democracy’.
• Next up is the landmark review Naughton mentions, from the Ada Lovelace Institute: ‘Exit Through The App Store’.
• Rob Kitchin‘s comprehensive review 'Using digital technologies to tackle the spread of the coronavirus: Panacea or folly?’ is also excellent. Broad in scope with the right amount of depth and extremely accessible at the same time.

Endnotes & Credits

• The elegant Latin bon mot “Futuendi Gratia” is courtesy of Effin’ Birds.
• As always, a huge thank you to Regina Doherty for giving the world the phrase “mandatory but not compulsory”.
• The image used in the header is by Krystian Tambur on Unsplash.
• Any quotes from the Oireachtas we use are sourced from KildareStreet.com. They’re good people providing a great service. If you can afford to then donate to keep the site running.
• Digital Rights Ireland have a storied history of successfully fighting for individuals’ data privacy rights. You should support them if you can.

Find us on the web at myprivacykit.com and on Twitter at @PrivacyKit. Of course we’re not on Facebook or LinkedIn.

If you know someone who might enjoy this newsletter do please forward it on to them.