Re: <nettime> CfP: Critical reflections on pandemic politics:, left-wing, feminist and anti-racist critiques

[carlo von lynX <lynX@time.to.get.psyced.org>]

Thanks folks for the kind words, also the ones I received in private.
Luca, I hope you will find your way back to actual science.  <3

On Sat, Feb 05, 2022 at 02:19:34PM +0000, Geoffrey Goodell wrote:
> The problem, which in my view is the elephant in the room, is about the extent
> to which governments and other actors can use the 'vaccine passport' systems to
> track the habits, movements, and circumstances of individual persons as they
> engage in routine activities.

To my knowledge, this is not possible. The source codes would show.
The network analysts would have observed network traffic.

> (1) Many 'vaccine passport' schemes encourage, or even require, individuals to
> carry with them mobile devices with a range of identification information
> on-board, such as mobile phone numbers, IMEI, secure enclave keys, and so on,
> and to install certain software on those devices.  Even if we were to assume
> that the software would strictly conform to free software guidelines and be
> subject to rigorous security auditing, a plethora of metadata (think location,
> IP address, and so on) would nonetheless be available to such applications and
> the network services that they use.  To assume that such metadata would not be
> accessible to the platform operators, or to the police, or to criminal
> organisations would be a profound miscalculation.  Although many governments
> provide a way for people to use their 'vaccine passport' schemes without mobile
> devices, such paths are often cumbersome and de facto discouraged.

Politicians and even the technicians and cryptographers involved in developing
this technology are assuming the proprietary operating systems provided with
our devices will not spy on such data. Snowden has shown us, that this is not
a realistic assumption, but we failed to take the drastic measures that need
to be taken since 2013, so now we are walking this slippery line by which some
entities on the planet have a totalitarian knowledge about us - but it's the
same entities that also digest all of our emails and automatically transcribe
all of our phone calls, so a vaccination document is not going to enhance that
database all that much. Also, recent attacks on democracy have not originated
from the powers in place, but from players who learned to aggregate gullible
human beings. Still, I chose not to scan that QR code into my phone so that
there's a ghost of a chance left that my identifying data isn't aggregated
with the communications I do over the phone.

> (2) It is still possible to avoid mobile devices (thankfully), but even the
> paper forms have are problematic, following from the dubious but
> widely-accepted assertion that the preponderance of counterfeit documentation
> justifies online verification.  Specifically, they often include barcodes or QR
> codes that reference a specific database entry that the issuer had associated

I'm not precisely familiar with the way the 'green pass' works, but I would
presume all of the personal data is *contained* in the QR code and digitally
signed by a chain of authorities, ideally letting each pharmacy or doctor have
their own signature - thus, if a pharmacy has been handing out rogue passes,
the validity of their signature can be revoked. A list of all revoked signatures
would be retrieved by the CoronaCheck Scanner app, thus enabling it to detect
falsified vaccination documents without further consultation of any server,
happily operating offline. Since the app is open-source, I guess you could go
and check. If nobody has complained so far, there probably is no reason for
complaining.

> with the documented person.  This means that the online verification service
> knows who is using the 'vaccine passport' scheme, both the data subject and the
> venue performing the check (the relying party).  As a result, the online

That precisely I would expect not to be happening, at least not the way the
European or at least German way the 'green pass' is set-up. In fact it is an
ongoing discussion in parliament now that it was so easy for Austria to
implement the mandatory vaccination because they already have a central
database of citizen vaccination, whereas Germany doesn't have any of that -
so they either have to introduce it, or seek a different way of spotting
the irrational and confused vaccine deniers.

> verification service has access to time and location information about every
> check that is performed, and that information can be used to track the movement
> and behaviour of the data subject from venue to venue over time.  By and large,

If that were the case, the CCC or other privacy groups that have a very
strong media presence would have brought this aspect to public attention.
I also doubt such an approach is legal within the EU privacy framework.

> the online verification services are not issuing barcodes or QR codes via blind
> signature schemes or zero-knowledge proofs to allow data subjects to isolate
> their identities from the verification step, nor are they circulating databases
> of hash values to relying parties so that the checking could be done without

But, why should they do these things, if the digital signature can be
checked offline?

> phoning home.  (Also, the argument about counterfeit documentation has often
> been combined with distrust of human document verifiers to promote the use of
> digital identity proofing, e.g. via biometrics, thus raising even more human
> rights concerns along with the question of whose security we are protecting.)

I only see such kind of promotion on covid anti-science channels. By
my understanding the revocation of authorities is the only online
transaction that should periodically be done, and I think it is
currently being done by upgrade of the entire app version.
Nothing further is needed to fulfil the purpose of prooving
vaccination. That's why it isn't considered a privacy issue, that
the QR code contains all of your identification data, because within
the architecture of the solution, that data never leaves the phone
neither of the citizen nor of the venue.

> (3) Even if we assume that the governments issuing 'vaccine passports' are
> truly benign, the data subject is expected to present the same barcode every
> time, meaning that the venues doing the scanning can pool their knowledge of
> the barcodes they have seen to build profiles of data subjects.  We could

If they make a custom modified version of the app, they could potentially abuse
the data. It would be a felony, like any other illegal collection of data, too.

> imagine working around this by issuing a series of cryptographically unrelated
> one-time keys to scan, although by and large, this has not been done.

Smart cryptographers could probably come up with improvements to the system,
yes.

> So we're in a tough spot.  Too many people use apps that leak metadata that
> compromise their privacy, and even with the paper system, electronic
> verification exposes individuals to privacy risks.

It's nothing compared to having Facebook or Whatsapp installed, which I 
also don't have. But most users do - it isn't even illegal to ship phones
with such spyware preinstalled in many parts of the world. We have much
bigger issues in technological madness than CoViD-19 measures.

> For the sake of argument, suppose that we are agnostic about:
> 
> (a) whether vaccinations should be a condition of entry to popular venues,
> 
> (b) whether the management of popular private venues can demand documents from
> their patrons and deny admission to individuals on the basis of their
> vaccination status, and
> 
> (c) whether the management of popular private venues can be held liable for
> failing to enforce rules of behaviour or entry on the basis of their
> vaccination status.

For the purpose of public health it can be absolutely constitutional
to implement such measures if constitutional courts confirm the need.
In some cases, courts have invalidated government measures.
Checks & balances are still in place.

The world is in a mess, but it is important to see where the problems 
really are. Governmental CoViD measures are not a serious issue. We
still have technology, economy and globalisation which are all much
bigger problems for humanity. 30 years ago "war" would have been in
this list, but nowadays even war is a minor problem compared to the
others.

#  distributed via <nettime>: no commercial use without permission
#  <nettime>  is a moderated mailing list for net criticism,
#  collaborative text filtering and cultural politics of the nets
#  more info: http://mx.kein.org/mailman/listinfo/nettime-l
#  archive: http://www.nettime.org contact: nettime@kein.org
#  @nettime_bot tweets mail w/ sender unless #ANON is in Subject: