Can't filter anonymous contact set by identity

[cbrettin]

Not sure if you are looking for feedback on this, but there is a rather glaring problem with your mention of missed opportunity to filter contacts before upload - it isn't actually possible to filter contacts according to known identities if they have been properly anonymised, since since by definition you can't tell which contact records belong to which person.

[vteague]

Ah, yes, but that's OK because they haven't been properly anonymised. The app logs the exact time of the encounter down to the milisecond, so you could (if you wanted to) exclude them on that basis. Cheers, Vanessa.

…

On Mon, Apr 27, 2020 at 9:00 PM, Clive Brettingham-Moore ***@***.***> wrote: Not sure if you are looking for feedback on this, but there is a rather glaring problem with your mention of missed opportunity to filter contacts before upload - it isn't actually possible to filter contacts according to known identities if they have been properly anonymised, since since by definition you can't tell which contact records belong to which person. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[Richisfree]

Totally agree with @cbrettin here. @vteague I'm sorry but are you suggesting that the definition of "haven't been properly anonymised" is recording a time stamp and the phone model in plain text? I guess you're right, the process could be "improved" if a user could keep a diary of every time they were with people they didn't want the government to know they were with and then tell the health worker they would like to exclude logs within these times. But, perhaps though it would be easier just to turn the app off as you suggested in the analysis... I really fail to see the missed opportunity here and how that presents a privacy risk that is at all comparable to the daily privacy risks we incur upon ourselves. As I type this on my browser (factory settings) github can record my screen resolution, my operating system, by browser make, model and version, my IP address and associated geolocation and of course associate this with the details I provided it when I created my account and my activity on the GitHub platform. If members of my workplace or family log onto Github they can now associate them to me via (at least) the IP address, particularly if patterns emerge of these device fingerprints and the same IP addresses. Useful info for an advertising company (eg Facebook, Instagram, Twitter, Google) or an online marketplace (ebay, amazon, gumtree) for profiling us. Honestly, the data that is being gathered by COVIDSafe by comparison is extremely innocuous. I can't support the analysis until it's put in perspective. People, if you want to protect your granny and you aren't a terrorist, an organised crime lord or a spy I highly recommend downloading the COVIDSafe app with enthusiasm.