Government in Austria gets Cell Phone Movement Data without asking

[Alexander1970]

If this would have happened while the FPÖ was still in government, the response of Der Standard would have been very different, I have to imagine.

For Sure.

 

[notimp]

Why you need it is explained in here (thoroughly).
h**ps://www.youtube.com/watch?v=WZqcTTTVkXY (german)

You basically have to know if - if you close down schools and universities and are instilling curfews, people really stay at home. If they don't - you have to adjust measures.

Different models, methods and outcomes are all characterized and played through in the podcast linked (german).

 

[notimp]

And I've seemingly skipped the most important part, data is submitted in clusters of 20, so indeed aggregated - which should actually vastly limit most privacy concerns.

So all the hyperbole I've provided in here could have been prevented by me reading more thoroughly the first time around.

Your postings were contageous. (emotion) (Actually, it was all my fault. )

 

[Alexander1970]

Your postings were contageous.

Nice to see you enjoyed it.

 

[notimp]

Let derstandard tell you, what I posted, a day after (just the thing that clustering datapoints does the trick):
https://www.derstandard.at/story/2000115904000/warum-die-datenweitergabe-durch-a1-zulaessig-ist (german)



They have more detail though.

Article now is at the top of the frontpage ("above the fold"), now that law (legality assessment) is involved. *Ts* Societal weighing of abstract concepts..

At that point 'normal' journalists care enough, when they are potentially personally affected. (Seemingly ) I previously mentioned legal scholars, did I?

edit: Already vanished from the front page. But it was in a prominent position for a while.

 

[Alexander1970]

Au contraire,mon frère.

Of course, it cannot be assessed at this point whether this is actually the case. In particular, there is the question of the level of detail of the data preparation. As part of a movement analysis of a cell phone, the course of the location can (technically) be analyzed down to the last detail.

 

[notimp]

Issue is datapreparation. So someone, or some system gets the fulltake on all location data, then has to assign random ids, and then has to create clusters of as far as we've heard groups of 20. That system could have the full information for a while, depending on how its set up - so questions arise around 'how is it aggregated (legally) (transformed from logs before they get deleted), and in the process of preparing is that covered (legally) in any way, and who has access to what.

A1 told the public, that they are doing it in cooperation with the TU Graz (Invenium), so someone ought to find the guy responsible for data preparation there, and ask them to step through the process.

If A1 is handing over the entire data as a blob to the datapreparation team at the TU, this means, that A1 could have that blob. That invenium could have that blob. And that the blob is only pseudo-anonymised. (Example of home address to work idenifying an individual, I've ranted about.) So knowing the process becomes paramount.

It would be possible to read log, copy, pseudononymize, delete from log, wait until you have a cluster of 20, then move that -- and create the blob that way through one process. So aggregation only ever covers 20 individual movement histories, at a time. That way every dataset derived from original logs should be less problematic.

If you take your fulltake movement history copy pseudo-anonymized, drop it off at Invenium, and let them create the 20 person clusters after the fact - ehm... yeah, you have a problem.

All of that stuff is easy as can be to understand, but to get a journalist to ask those questions to the right person seems to be close to impossible.

I'm relieved that the government only gets the clusters of 20 dataset (hopefully), and that many eyes will be looking at and demanding, that the process stops exactly with the end of the curfews. (And then starts again, when the next wave of curfews rolls in in fall. ).

Also lets pray, that Invenium doesnt get the full blob of pseudononymized data, and start selling them to the highest bidder. Just because they might be able to.. Someone check the usual darknet marketplaces for a while.. (Bad Joke)

 

[EmanueleBGN]

Same in Italy.
Security cannot costs freedom. After 9/11 we have the Army in our cities and now this - Governments want to control us, the people, such as we are terrorists. They will not be satisfied until we will be like in 1984

 

[notimp]

Point to freak, imho is, when those measures get extended.

People coordinating the corona measures have to know if people stay at home during the curfew, or not to be able to estimate efficiency and coordinate further measures. The reasoning given is actually somewhat propper (proportianate), it just can not, can not, become the default for other stuff, after curfews are over. It can not even become the default for other (non pandemic related) curfews, one might want to enroll..

And it can not consist of individual movement data without making individual ID tracking impossible.(Randomized ID generation every 24 hours is too little on it sown.)

 

[Alexander1970]

And here we are,again,on the Point,were

- no further Infos will be revealed - this short Note 2 Days ago will be enough for the "Mob" (the superficial News about the Government gets the "Data",seemingly....)
- no Infos about HOW LONG this will be......ok,they have enough to do with "hold together" the actual Status..so no Info....
- no Infos about the Amout of Data really will "processed / edited"..

and

For Sure NO Information and Confirmation that this will not be the "standard" Procedure in the Future...for the "safety of the Country and his Population"....with "maybe" the Reason "Something like the Virus can happen everytime again.....".

 

[notimp]

And here we are,again,on the Point,were

- no further Infos will be revealed - this short Note 2 Days ago will be enough for the "Mob" (the superficial News about the Government gets the "Data",seemingly....)
- no Infos about HOW LONG this will be......ok,they have enough to do with "hold together" the actual Status..so no Info....
- no Infos about the Amout of Data really will "processed / edited"..

and

For Sure NO Information and Confirmation that this will not be the "standard" Procedure in the Future...for the "safety of the Country and his Population"....with "maybe" the Reason "Something like the Virus can happen everytime again.....".

Thats not correct. I get the slippery slope argument.

But according to the legal opinion, 'a practice like this' (in case data is DSGVO (data protection law) relevant) is legal only in case of 'grave danger for health or life, in the interest of public health', so if people like the head of the austrian data protection office (Andrea Jelinek) want to argue, that this is legal, they need that. From an operational logic it would only make sense (in its current form (cluster of 20)) for monitoring the effectiveness of the curfew.

So you have limited purpose, you have a legal exception, and you have people that ought to make sure that it is proportionate (verhältnismäßig), by first pseudeo-anonymizing and then (cluster of 20) sufficiently anonymizing the data, so highly problematic versions of it stay away from 'power centers'. Abuse is limited to the cell provider, and that TU Graz Joint, if the process is set up incorrectly, which the data protection office says its not (we can believe that or not). If the process is set up correctly (technically), abuse potential would become zero (not DSGVO relevant) pretty quickly (Without many people having the potential to abuse this data aside from the usual admins at A1 that always could, if there would be a way to aggregate those movement sets over time, which is illegal.).

This is the average mans implementation of something because of due cause, because of the health interest of the many, and it has a 'safty' protocoll attached that should (do we believe in what is said) make it close to unproblematic for whoever gets the 'finished' (clustered) dataset.

If this stays time limited to the periods of the curfew, I'm not freaking. I'm close, but not freaking yet. The moment this gets extended for even slightly different purposes, someone has to proverbially hit someone over the head with a blunt object.

There are two burning questions.

1. Is there a version of the dataset that leaves premises (/only A1 special admin oversight) that is only pseudonomized and not clustered. (highly problematic), then those datasets can not be allowed to accumulate over lets say a month. (Individual profiles extractable).

2. Will a practice like this be extended past corona curfews. In which case "alarm bells".
--

As the legal opinion understands it, as soon as the data is Clustered it isnt DSGVO relevant anymore (sufficiently 'blurred') - and this (cluster of 20) practice could go on for as long as someone likes.

But to get to that cluster, depending on how you do it, you could have a dataset thats only pseudo-anonymized, that would fall under 'only in extreme cases, for public health and safety' excemption clauses.

Journalists have not worked out if this is the case sufficiently yet. Imho.
--

If you do what they are proposing. Namely that you look at different cell sites (towers), take the ids logged in there, replace their unique identifiers with randomized ones, and then cluster them in groups of 20 then and there. That data is not DSGVO relevant anymore - and can be shared freely. Is the current argument.

And as per gut feeling, I tend to agree.

Now, same information could be used for governments pre country takeover of revolutions to find out "when to send in the tanks" and where. But there are other technical means that would allow you to find out as well.

So its hard to argue what we give up (in terms of personal freedoms) at that stage. That said, slippery slope, as f.

 

[Plstic]

They are also doing this in Israel. The government is overstepping their bounds.

 

[Alexander1970]

But maybe now WE have to take the next Move.

Turn off any Smartphone/Cell Phone/Internet Device,remove Sim Cards and deposit together with all other on the
Main Squares in our Hometowns / Villages.

I wonder what impression they will have on their Faces at this wonderful Moment.

And maybe it is time we get finally rid of this "self-imposed scourge of humanity" called Handy/Cell Phone/Smartphone....
(I know I am a Dreamer......).

 

[notimp]

Turn off any Smartphone/Cell Phone/Internet Device,remove Sim Cards and deposit together with all other on the
Main Squares in our Hometowns / Villages.

"Whats a simcard?" signed the average citizen.

Also throw in you smartphone with it as well, because of IMEI.

And then recognize, that enough people give GPS permissions to 'great app they downloaded', that ad networks can do this:
https://mashable.com/article/foursquare-launches-hypertrending-sxsw/?europe=true

Goverment or any company could buy that on the free market.

 

[Alexander1970]

As I said - I am a Dreamer.

SIM Card - that Thing you need for your Smartphone

 

[notimp]

Law (which was rejected) draft started with "well, we would want individual movment data..:" - I mean, one could at least try... *grr*

src: https://www.derstandard.at/story/20...r-oesterreich-standortueberwachung-einfuehren (german)

Late summary:
https://www.derstandard.at/story/2000116136360/ist-das-handy-tracking-a1-vertretbar

 

[Alexander1970]

Law (which was rejected) draft started with "well, we would want individual movment data..:" - I mean, one could at least try... *grr*

src: https://www.derstandard.at/story/20...r-oesterreich-standortueberwachung-einfuehren (german)

Late summary:
https://www.derstandard.at/story/2000116136360/ist-das-handy-tracking-a1-vertretbar

Thank you.

As I see,it leaves "someone" no untouched.

And as always,someone tried to downplayed and played down.
And with the first Article,we can see that not all "Law Designs" are for the Mob´s Eyes and Ears.

I really hate it to say but - another One Step closer to the Times around 1935....
Really bad that a "Virus" should justify that.......

 

[notimp]

not all "Law Designs" are for the Mob´s Eyes and Ears.

Normal law making process.

(Lobbyists.) Draft. Rewrites. Expert opinions. Party lines. Law. (Something like a) Congretional courts ruling on it (If someone wants to dispute it).

 

[Deleted User]

T

More problematic. derstandard has an option to preselect "useful" comment posts and pin them to the top of the comments section, to drive narratives.

They are telling people, that this is totally ok. In this situation, via - opinion of one journalist from the tech section. Or editorial staffs consensus.

What assholes.

The Standard („newspaper“) is just a bullshit leftist tabloid paper claiming to be a quality newspaper (which nobody believes anyways).

 

[notimp]

Oh dear.

What noun does bullshit go with, btw?

(As it stands currently, they do all the reporting and platforming of comments on the matter. No other medium in Austria does so.)

If you are stuck in the "I hate medium if medium ideologically isnt on my side of the fence" phase, I'm not talking to you.

Even reading this forum, by now you ought to have realized, that voices that can offer nothing but hate on the other side of the political devide, reminding everyone how poor they are doing - can offer nothing. Bring nothing to the table. That form of trying to win arguments is so - 'first five years after facebook started'.

Its the equivalent of defecating on the stage. Everyone shares it. You get all the attention. Then someone has to clean up your mess afterwards. With the exception, that social media offered a 'clean new stage' every three hours for the process to repeat. (Everscrolling newsfeed/Comments feed)