The IT Nerd

When Google and Apple released their COVID-19 exposure notification API, it was promised to put privacy first. But that may not be true. At least on the Android of the fence as The New York Times describes:

When Google and Apple announced plans in April for free software to help alert people of their possible exposure to the coronavirus, the companies promoted it as “privacy preserving” and said it would not track users’ locations. Encouraged by those guarantees, Germany, Switzerland and other countries used the code to develop national virus alert apps that have been downloaded more than 20 million times. But for the apps to work on smartphones with Google’s Android operating system — the most popular in the world — users must first turn on the device location setting, which enables GPS and may allow Google to determine their locations. 

And what is interesting is that Apple iPhones don’t require this setting. So this is just a Google thing. That sounds sketchy to say the least. And to the surprise of nobody, this has caused some alarm:

Some government officials seemed surprised that the company could detect Android users’ locations. After learning about it, Cecilie Lumbye Thorup, a spokeswoman for Denmark’s Health Ministry, said her agency intended to “start a dialogue with Google about how they in general use location data.” Switzerland said it had pushed Google for weeks to alter the location setting requirement. “Users should be able to use such proximity tracing apps without any bindings with other services,” said Dr. Sang-Il Kim, the department head for digital transformation at Switzerland’s Federal Office of Public Health, who oversees the country’s virus-alert app. Latvia said it had pressed Google on the issue as it was developing its virus app. “We don’t like that the GPS must be on,” said Elina Dimina, head of the infectious-disease surveillance unit at Latvia’s Center for Disease Prevention and Control. Google’s location requirement adds to the slew of privacy and security concerns with virus-tracing apps, many of which were developed by governments before the new Apple-Google software became available. Now the Android location issue could undermine the privacy promises that governments made to the public.

Google for its part had this to say:

Pete Voss, a Google spokesman, said the virus alert apps that use the company’s software do not use device location. That’s including for people who test positive for the virus and use the apps to notify other users. The apps use Bluetooth scanning signals to detect smartphones that come into close contact with one another — without needing to know the devices’ locations at all.

Well, that’s a lame answer as if it doesn’t use location services, why does it ask for it?

For these apps to work, as many people as possible have to download them and use them. And by as many people as possible, I mean something in the range of 70% or more. This news does not help that adoption rate as this will scare users into not downloading the app. This is one situation where Google’s sketchy behavior threatens to undermine the response to the greatest health crisis this planet has ever seen. Which means that if they truly aspire to “do no evil”, which by now should be clear that they don’t mean that, then they need to respond to this in a much more robust manner so that it encourages people to use these apps to help to get the planet out of this crisis.

Google is facing a massive lawsuit accusing them of tracking users in incognito mode. According to Reuters, the class action argues that Google was collecting information about what people view online and where they browse when they use Chrome’s Incognito mode. In effect, Google has been intentionally deceiving customers into believing that they have control over the information they share with the company.

Now Google says it will defend itself “vigorously’ against the claims. But they served up an interesting response:

“As we clearly state each time you open a new incognito tab, websites might be able to collect information about your browsing activity,”

This is something that I am not sure that most Google Chrome users are aware of. As in Incognito mode doesn’t fully allow you to browse with no repercussions. This Google support document speaks to what Incognito mode does and doesn’t do. If you are a Google Chrome user, I would suggest that you read this document so that you are aware that Incognito mode doesn’t keep you from having your sketchy activities discovered by anyone. And that likely includes Google itself.

You might recall that a Google backed company named Sidewalk Labs was planning to build a smart neighborhood in Toronto called Quayside. Which in turn set off all sorts of privacy related alarm bells. Including from yours truly. Well, news is breaking that this project is now being abandoned:

For the last two-and-a-half years, we have been passionate about making Quayside happen — indeed, we have invested time, people, and resources in Toronto, including opening a 30-person office on the waterfront. But as unprecedented economic uncertainty has set in around the world and in the Toronto real estate market, it has become too difficult to make the 12-acre project financially viable without sacrificing core parts of the plan we had developed together with Waterfront Toronto to build a truly inclusive, sustainable community. And so, after a great deal of deliberation, we concluded that it no longer made sense to proceed with the Quayside project, and let Waterfront Toronto know yesterday.

While we won’t be pursuing this particular project, the current health emergency makes us feel even more strongly about the importance of reimagining cities for the future. I believe that the ideas we have developed over the last two-and-a-half years will represent a meaningful contribution to the work of tackling big urban problems, particularly in the areas of affordability and sustainability. This is a vital societal endeavor, and Sidewalk Labs will continue our work to contribute to it.

Now there’s no mention of any of the privacy related issues that have dogged this project. But you have to think that this factors into the decision to deep six this project. I am sure that all the facts will come out in the hours and days ahead. And when they do, you’ll see it here. But I for one am happy that this project is not proceeding as I simply don’t trust Google to manage the data that this project would generate.

If you used Google Takeout to download an archive of your Google Photos content, there’s a chance that someone else may have ended up with your videos. Details via Betanews:

The company has admitted that for a few days in November last year, “some videos in Google Photos were exported to unrelated users’ archives.” This means that not only could your videos have ended up on a stranger’s computer, but also that you may have received random videos belonging to someone else. Google is not making much of the “technical issue” which it says has now been resolved. But the company apologizes for the “inconvenience” that may have been caused for people downloading their Google Photos archive between November 21 and 25, 2019.

I guess that this is a case study of the following maxim. It is safe to assume that if something is stored via a third party, especially if it is a free service, that there is a considerable risk that it becomes pubic at some point. You might want to bear that in mind if you choose to use one of these services.