Norway’s COVID-19 app Eivind Arvesen, Sep. 3rd 2020 How to Get People to Use Contact Tracing Apps – Amsterdam Smart City
Who am I? Eivind Arvesen Consultant @ Bouvet (Oslo, Norway) • Privacy and security • Senior software developer and architect • Part of expert group evaluating Smittestopp EivindArvesen.com : @EivindArvesen
Source code leak
Source code leak
Basis for processing Smittestopp’s basis for processing was not consent – but regulation (still voluntary to use)
Dual purpose • Contact tracing • Provide data to evaluate government interventions + use as input to epidemiological models
Location Data
Centralized storage Continuously upload all sensor data from all users – as opposed to keeping user data on device, only uploading when needed.
User traceability
Identifying users
No Interoperability
Rough timeline of events • App criticized by professionals from get-go; reverse-engineered at launch (April 16th) • Over 300 professionals in security, privacy and tech launches petition asking the NIPH to change their approach after background-BLE was fixed • Negative user feedback from battery-drain, limited notification support • Expert group concludes neither security nor privacy is handled responsibly (May 20th) • Supplier publicly attacks expert group, questioning motives and claiming that conclusions and recommendations are personal political opinions …
Rough timeline of events … • Parliament decides to split app based on purpose • Norwegian Data Protection Authority concludes that the degree of privacy- invasiveness is not justified • Health authorities chose to stop all data collection, and to delete existing data • Amnesty International stated that they found the Norwegian app to be among the most dangerous tracing apps for privacy. • International media attention (New York Times, The Guardian, etc.)
A few numbers Norwegian population: around 5,432,580 NIPH stated it would need 50-60% market penetration to get good results from contact tracing.
A few numbers 1 577 494 cumulative ( 20% of pop.) downloads 592 924 active users ( 10% of pop.) (users that had uploaded GPS or BLE) Source: NIPH (June 2nd - 3rd), pre app shutdown
Summary This is not «privacy by design.»
👌 (graphics from unsplash.com) EivindArvesen.com : @EivindArvesen
Recommend
More recommend
