Government in Austria gets Cell Phone Movement Data without asking

notimp · Apr 7, 2020

Maybe it is utter stupidity.

Just watched five minutes of the Austrian state press conference on corona (chancelor, vice chancelor and health minister), and I had to turn off, because I couldnt bare the accumulated stupidity.

(When you have a health minister telling you, that not only is growth rate important, but also the case doubling rate - and you want to hit your monitor, because those are the exact same.)

Alexander1970 · Apr 7, 2020

notimp said:
Maybe it is utter stupidity.

Just watched five minutes of the Austrian state press conference on corona (chancelor, vice chancelor and health minister), and I had to turn off, because I couldnt bare the accumulated stupidity.

(When you have a health minister telling you, that not only is growth rate important, but also the case doubling rate - and you want to hit your monitor, because those are the exact same.)

I wish,the whole Austrian People (ok,that is not correct.....barely 20 Percent are NOT Austrian....) could read here.....
And it would not change anything. :rofl2:

There is this "Parable" about Austrian "Mentality":

- To see if it HURTS,some shoot itself into their LEFT knee -> "Ouch,that hurts....."
- To see if it ALSO hurts,some shoots itself into their RIGHT Knee -> "Ouch,that ALSO hurts....."

notimp · Apr 7, 2020

Uh, btw - better not get a Corona test, if you dont have to - because data will be shared with local town mayors. Bistdudeppat! (What?)

https://www.derstandard.at/story/20...zeiten-wenn-daten-an-big-buergermeister-gehen (german)

It - hurts - it hurts... Stupidity hurts so much.

Effing green party in the government playacting liberal values...
-

Oh and in case you'd want to use the voluntary Red Cross app - data will be shared with:

Accenture, Google and Microsoft, can be stored and processed outside the EU (USA is specifically mentioned) - and funding was provided by a UNIQUA endowment fund (owned by Raiffeisen).

See AGB: https://www.roteskreuz.at/fileadmin…0_V1.1.pdf

For stuff like this, the derstandard comments section is still invaluable..

edit: Read it: Server infrastructure is hosted in the Azure cloud, transmitted data is 'encrypted' (ssl?

), google services are used to be able to send push notifications, data processing for that stuff can also happen in the US.

Now reading the rest.

Apps that were discussed for germany just stored contact data locally, I've not read up on how the Austrian app handles this.
-

Personal data stored serverside: Unique identifier (ok), has covid 19 diagnosis flag (ok), since when (ok) telephone number (WHAT!!!??!!??!). As soon as you download the app, the app store provider also gets your email address (you know, with your name in it), but thats ok - because thats just automated, on part of the app stores... They say they have no direct access to email addresses, app store provider would act as an intermediary.

Handshake data only is stored locally on your phone at first. (good)

Telephone number is first queried, if you have corona and want to transmit that fact to the world. (ok+)

In that case people in your movement history (locally stored) are read out for the past three days, and transmitted serverside (?????), because they have to contact them - which will not happen trough SMS - but through an internal messaging tool, so the individual users never see your phone number.

Aehem???

Lets say 70% of people in Austria get Covid 19. When they hit button 'i have it' - contact logs for tree days will be sent serverside (based on unique IDs), so personal networks are mappable (data quality isnt the best), linked to unique ids - that then is also linked to a phone number each - which can be used to deanonymize people.

Just so you know.

At least it doesnt automatically jump ('seven degrees of Kevin Bacon') degrees, only when people hit the button 'I want to report that I have Covid 19'.

So its the same issue as within our 3 days google maps example - just that you cant map movement patterns based on geolocation, but only based on 'other telephone numbers that were within a meter in proximity to you'. (More potential deniability I guess..)

Anyone that gets their hands on that dataset, and has an extensive set of phonenumbers to name records (= phonebook), can start deanonymizing.

Dataset will be more valuable at the end of the pandemic (when many people have hit the button 'I want to share my 3 day proximity history and phone number'). Microsoft has access to it - for sure, but apparently its 'encrypted'.

Problem: No words on weither just transport encrypted or not. No words on how swarm notification is done once that information reaches servers and 'I want to tell everyone I have it' intent is declared. (Via google messaging services? So now google gets 3 days worth of your proximity contact data? And they can identify everyone of the contacted users using their accounts email addresses and names? And credit card info, and...)

Data should be deleted (from Azure) 30 days after you hit the 'i have it' button.

edit: HAHA! The app doesnt automatically exchange handshakes, that has to be an active act. On part of both parties. Haha. Very funny. Which means data set is now VERY HIGH QUALITY in terms of connection quality. Value and abuse risk just increased manyfold.

HAHAHAH! Prank potential!

I've mistakenly sent out that I've been infected with Covid-19 - how can I change that?

Currently you cant deactivate that message. Please uninstall and reinstall the app again. If you already had stored contacts within your contact logs, please inform them personally, that the alert is not valid.

src: https://www.roteskreuz.at/site/faq-app-stopp-corona/ (german)

Also - what happens if the same phone number registers I'm now infected at a later point?

edit: It gets better and better....

Automatic handshake will be added as an update on thursday, as an opt in.
Developed by Accenture (what?). (One of the worlds biggest consulting agencies.)

Our chancelor also thinks of people without smartphones - they should be able to be tracked with keychains!
https://futurezone.at/netzpolitik/s...acking-auch-per-schluesselanhaenger/400803626 (german)
(No joke.)

But sadly someone saved him making sure - none of it will become compulsory...

How technologically illiterate can a millennial college dropout/chancellor be? How fiscally illiterate. (What does a used smarphone cost?) Now 'we'll order a bunch of luggage trackers in bulk on aliexpress, and then people should use them on themselves and then hrow them away, once the battery runs out?'.

India ships smartphones to africa, the Austrian chancelor ships tracking keychains from china to austria. What an absolute...

notimp · Apr 7, 2020

The CCC just published a guideline on how to conceptually design corona tracing apps:

https://www.ccc.de/de/updates/2020/contact-tracing-requirements

Lets see on how many points the red cross app produced by Accenture fails:

- Only used for this purpose and only for a limited time: Partial fail. No end dates specified.
- Open source in its entirety: Partial fail - 200.000 people have already installed it and open sourced code 'should follow in the future'
- No central entity that has to be trusted - failed
- Data minimization - failed (telephone number)
- Any option for epidemiological purposes (contact users using telephone number), has to be a separate opt in, that has to be revokable at any time - failed and failed
- Usage can not be tied to that opt in - partially (almost fully) failed, you have to give out your phone number - but I guess you could lie? (edit: Oh you cant. Phone number will be auto read out to prevent prank abuse. haha. failed.)
- Users shall not be enticed to give away additional personal information - failed
- Change unique IDs often, prevent unique ids from being used as unique ids over the entirety of the project (prevents re-identification) - failed
- Those Ids can't be tied to unique push message tokens (Google messaging) - failed
- No erection of centralized Contact profiles - failed (but should be deleted after 30 days according to Accentures terms and conditions).
- Non chainability of Ids - (probably) failed (because they used singular unique IDs in the first place)
- Non id-ability (log ability) of communication sent out through third parties (google and Azure in our case) - so push messages have to be encrypted - probably failed (dont know for sure)

But our government is very proud to let everyone know - that our app is the first one that went live in europe!

You cant make this stuff up.

And we have a party in government that is 'very concerned' about our data privacy - at least when they were in the opposition. But not when it counted.

Journalism? Entirely oblivious.

City · Apr 7, 2020

Get an iPhone/Linux phone and a vpn.

notimp · Apr 7, 2020

City said:
Get an iPhone/Linux phone and a vpn.

Is the wrong attitute to have.

This is literally an issue of - we know how to do it corretly.

A freaking consultant agency does not.

Licenses the Red Cross brand in my country for PR.

Gets featured by media and politics for 'being first' (so proud...)

And people like you wanting to attach themselves to something, to feel better.

The thing is, this time around you are in a minority. The main university in my country does representative polls on corona virus issues on 1500 people every week, since the crisis started. 70% of them are against tracking cases via cellphone apps.

Presumably this also made our chancellor reconsider.

This is the answer in case you were troll'oling.

Answer in the case you were not:
Android is linux (kernel), which VPN?

(also, this app handshakes via bluetooth and inaudible tones/microphone, and asks you to put in your phone number - so VPN doesnt help.

), and - since this is a network effect issue - one guy in the know buying a linux phone does nothing.

Conceptually though the irony isn't missed. People gave away location data to ad providers for free for years, and now all of a sudden have a problem with it - when the state starts saying its good for you..

So in the case of the voluntary tracing app (and in austria it is voluntary) - I'm not entirely against it, even if not all of the CCC best practice rules would be met. Just because I acknowledge that idiotic peer pressure is a thing. And people want it.

What I have an issue with is politics, and journalism in my country having praised this app as "privacy sensitive" for about five days now - and none of them knew what they were talking about.

They freaking fell for a ploy from Accenture - that, as far as most epidemiology experts I listen to are concerned - does almost nothing but act as a behavioral crutch.. If implemented voluntarily.

So my way out of this is - never ever to install that app, and to tell people to f*ck the heck off if they should ever ask me if I want to red cross app handshake with them.

edit: That doesnt change though, that media and politics in my country now advertise something unfit for its purpose (sensitive to data privacy concerns), as something it isnt (sensitive to data privacy concerns).

Alexander1970 · Apr 7, 2020

Formulated beautifully:

"Pull the emergency brake at any time"

The thrust behind the new measures is clear: the new infections should not increase sharply again despite loosened restrictions. And if they do, the government definitely wants to prevent this from happening unnoticed - and take countermeasures as quickly as possible. "With these measures, we will be able to pull the emergency brake at any time if something went wrong," Anschober said.

https://orf.at/stories/3160851/

And I do not think it is meant for the "Nation's health" only.....

And by the Way,not all knows about Tolkiens World:

https://en.wikipedia.org/wiki/Palantir_Technologies

notimp · Apr 7, 2020

Thats a very thorough article.

Doesnt get everything right but looks at many aspects.

What has impacted my thoughtmodel most in the last days was to get to know the conceptual difference in approaches between mitigation and suppression ( h**ps://www.youtube.com/watch?v=-73gTjn-TVM german, but I did an english writeup in the main thread), and when suppression is still viable because of case numbers you can 'follow up on' as a target (same strategy as with f.e. ebola in africa). All of what you read in the article you posted is actually good news - in the sense, that we now still have most measures to chose from (1% case rate).

At the same time, 18 months till vaccine is still a long way..

If everything moves as expected (social distancing works, summer lowers new infection rates, edit: even freaking app tracing helps with targeted social isolation) we are taking a second quarantine period in winter and then maybe another one in the second quarter of next year.

And all in all, low death rates. (in Austria.)

Just for reference. If case rate is 1% max:
(100/88000)*243 (actual covid deaths in austria) = 0.27% death rate. The closer the case rate is to 1% (higher is better) of the population, the better.

notimp · Apr 8, 2020

Btw, when I wrote if this governments response really was to let interns click luggage trackers on aliexpress, I thought I was kidding.

Apple spendet Österreich 50.000 dringend benötigte Masken Der chinesische IT-Konzern Alibaba liefert Testkits und Beatmungsgeräte

(Apple donates 50.000 Masks to Austria and Alibaba sends testkits and ventilators.)
src: https://www.derstandard.at/story/20...-oesterreich-50-000-dringend-benoetigtemasken

something broke and then was put back together again wrongly *scratchhead*

notimp · Apr 8, 2020

https://www.derstandard.at/story/20...leben-retten-nicht-gegen-datenschutz-tauschen (german)

When media is too dumb to read what the app actually does.

When media is too 'embedded' to be able to critize the app, because they've already booked interview guests.

When 'experts' are too shallow to know hot to actually design something around this approach properly:

https://www.dailymotion.com/video/x7t6axx

See - no conspiracy needed. The media disables itself through its own actions, and ambitions to produce 'interesting news programming'.

When you are too interested in producing a show, instead of finding out why the privacy claim of this app is BS. Media. Read half of someething - act like you understood it, or are the perfect person to act as an intermediate, between experts you sourced poorly.

When media does its darnest to seem as if what they first reported ("very privacy conscious") wasnt a damn lie, and they had done anything else other than eat up an Accenture PR announcement.

See - everything explainable through internal institutional logic.

notimp · Apr 9, 2020

This one is only for german readers of this thread.

And entirely offtopic.

https://player.hader.at/ has videos of Hader (austrian comedian - one of the best ones) online - free to stream - for the duration of the corona crisis.

If someone might be interested in how to download them, for research purposes, they might find the .m3u8 links in the sourcecode of the website, then download them with jDownloader. That might give them the video portion of the file. Then download the .m3u8, open it in a text editor, find out how the audio portion is named (usually audio_0_1.m3u8) rewrite that part of the .m3u8 link picked up in the html sourcecode (the filename, same link basically), then download the audio .m3u8 with jDownloader.

No DRM protection is circumvented.

You can merge the two using:

Code:

ffmpeg -i video_1\ \(720p\).mp4 -i audio_0_1\ \(aac\).m4a -c:v copy -c:a copy output.mp4

ffmpeg (command line tool) has to be installed - code has to be executed in the same folder where the files where downloaded to. Change filenames (f.e. 720p) as necessary.

Have fun.

Oh, and new videos are released every week. So by the end you might have his entire discography.

(So far you only missed 'Der Aufschneider 1+2' - and this week Indien went online, so I had to post this..

)

If you want to donate something, Hader linked a fund for artists (that pays out people during the corona crisis) on his facebook recently - find that and give them your money.

Alexander1970 · Apr 9, 2020

I love Him !!!

"Topfpflanzn" is his very great Hit about a "different" Man.

Thank you for this Video Page from him,very nice.

I have not seen Indien for a long Time.

Thank you,my Friend.

notimp · Apr 14, 2020

Oh btw. - current propagation of the red cross COVID19 tracing app within the Austrian population seems to be 12%, which means likelyhood of a traced contact is at 1% every interaction.

Thursday update rolled out, but isnt working as expected for most people. Issue partly seems to be attributable to vendor code on android phones, that kills backgroud processes to save battery. (haha)

Also on i-devices, the framework doesnt allow for monitoring bluetooth strength which would be needed for contact tracing.

Google and Apple to the rescue, both companies published an open whitepaper, that they would be working on a framework (patched in via google services framework on android (auto delivery on any android smartphone past android 6.0)), that would allow smartphones to get the capability to run those services (on android past manufacturer modifications).

Framework, once activated, will only be granted access to for local state health agencies, and would allow anyone who wants to develop such an app to develop it - with more reliability.

src: https://www.derstandard.at/story/20...id-19-technisch-schwierig-mit-unklarem-nutzen (german)

For Apple+Google whitepaper, see:
https://www.apple.com/newsroom/2020...rtner-on-covid-19-contact-tracing-technology/
and
https://blog.google/inside-google/c...e-partner-covid-19-contact-tracing-technology

Alexander1970 · Apr 14, 2020

It would be really surprising if this "App" would work really smoothly by the end of the Year ...

And then it is offered as a "standard free App" alongside with the Burger King and Ancient Jewels one.

Captain_N · Apr 14, 2020

they never let a good crisis go to waste. Now you could just not take your phone with you, or turn the shit off and take out the battery. Id like to see them track you then.

notimp · Apr 14, 2020

alexander1970 said:
It would be really surprising if this "App" would work really smoothly by the end of the Year ...

And then it is offered as a "standard free App" alongside with the Burger King and Ancient Jewels one.

Well - it could..

(App development so far is rumored to only have cost 2 mio USD on part of UNIQA - and UNIQA also has just released an earnings warning (related to Covid19 measures).)

Long story short is, that there are some entities very interested in getting it to work (the german foreign minister has publicly commented, that he wants to see support for the development of an EU wide version of such an app), and now with both Apple and Google on board, ... Its possible.

Alexander1970 · Apr 15, 2020

https://orf.at/stories/3161820/

Kurz plans no change

When the extent of the coronavirus pandemic in Italy and the hotspot Ischgl became known, things had to go very quickly: the ÖVP Greens government actually reacted quickly and has now brought three comprehensive legislative packages through parliament at a rapid pace. But now there are more and more critical voices. Chancellor Sebastian Kurz (ÖVP) does not want to repair possible errors in the law.

It is essentially about the general question of whether the government's approach was proportionate - or whether it is too restricting citizens' fundamental rights. Kurz made a stir on Tuesday with the statement that the government is not planning to repair the hastily passed Covid 19 laws and regulations, which may not be constitutional.

The Chancellor justified that some legal texts may be deficient, as critics say, by the fact that "we acted quickly". And he justifies the procedure by saying that it "worked well".

"Will no longer be in force"

The laws and regulations “are not permanent”. Until a review by the supreme courts has taken place, "they will no longer be in force," said Kurz. In any case, the lawyers of the Ministry of Health had endeavored to ensure constitutional procedures. "I apologize that it is an exceptional situation."

Lawyers should not over-interpret questions in this area. The point is that the measures are adhered to and "the republic works". "In the end, the day of the Constitutional Court will decide whether everything is right on the dot and comma." At this point, however, the measures would no longer be in force, said the Chancellor.

...........................

Warning of getting used to

With all understanding for the unusual situation, Matzka warned that the use of the tools now used - decrees and regulations - will create a momentum of its own. Such special measures would always be used in times of crisis - and would then often be accepted. It is important to ensure that these will not be used again in further crises in the next few years. Because these instruments should never become normal.

There was not only criticism of the fact that the ÖVP and the Greens primarily use the legal remedy regulation instead of the decision. The numerous decrees are also criticized, all the more because they partially contradicted each other and the "Easter decree", for example, had to be withdrawn.

notimp · Apr 15, 2020

Basically a democracy is not structured to run on emergency legislation for a long time, you now have all kinds of positions (Verantwortungsträger) inside and outside the system voicing alarms because of side effects (and the 'getting accustom to using those means of governing' issue), and a chancelor that doesnt want to fix/rewrite/retract that legislation in the short term, because it would be seen as a weakness/it wouldn't allow for some other stuff, thats not explicitly spelled out. Find out what 'the other stuff' is (bundled legislation.) as a journalist.

In general hearing those warnings in the media is expected and acting as a counterbalance to overreach. More info on the specifics would be neat.

(State can now force individual people to stay at home is mentioned.)

notimp · Apr 15, 2020

Correction, effective likelyhood of a positive match at an interaction so far is at one tenth of a percent.

https://www.derstandard.at/story/2000116869586/corona-app-laut-arge-daten-nicht-praxistauglich (german)

But again, google and apple can fix that.

notimp · Apr 24, 2020

Uh, mandatory tracking is still being discussed as a potential measure:
https://www.derstandard.at/story/2000117083194/opposition-kritisiert-aenderung-des-epidemiegesetzes (german)

(Legislation is in development that suggests that certain groups of people (those without tracking apps, probably), are barred from certain events.)

Government in Austria gets Cell Phone Movement Data without asking

Well-Known Member

XP not matters.

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

XP not matters.

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

XP not matters.

Well-Known Member

XP not matters.

Well-Known Member

Well-Known Member

XP not matters.

Well-Known Member

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum