Senator wants Cook, Pichai held financially responsible if their interface creates privacy issues

It's been nearly two weeks since Apple and Google announced that they were going to work together on a plan to help rid the world of COVID-19. It involves contact tracing, or the ability to track those who interacted with others infected with COVID-19. Knowing this information would allow those potentially exposed to get tested and stay quarantined for a couple of weeks.

The plan that Apple and Google have involves the use of Bluetooth LE, apps from public health authorities, and iOS and Android phones. Here is how this works. Those interested in participating will opt-in to the program and install certain apps from the appropriate app storefront. When Joe sits down near Lisa (maintaining social distancing of course), their phones will exchange identifying beacons. And every five minutes, people who walk near Joe and Lisa will have their identifying beacons stored in their phones as well So let's say that a few days later Joe tests positive for COVID-19. He then opens an app from a public health organization and enters the test result in that app. As long as Bob agrees, the people he was near for the past 14 days receive a notice that someone they were near has contracted the disease. This is all done on an anonymous basis and neither Apple nor Google will have access to the data.

Yesterday, Republican Senator Josh Hawley of Missouri sent a letter (via AppleInsider) to Tim Cook and Sundar Pichai, the CEOs of Apple and Google respectively. In the letter, Hawley said that the announcement of Apple and Google's plan "raises serious concerns." Among them is Google's poor reputation when it comes to privacy. For a senator, many of whom know zippo about technology (although they pretend to), Hawley's missive showed some understanding of what is involved in the two tech giant's plan.

Senator Hawley wrote, "The possible implications this project could have for privacy are alarming. For example, your materials state that the data necessary for this project will be anonymized. But anonymity in data is notoriously unstable. Data typically can be reidentified simply by cross-referencing it with another data set. Pairing the data from this project with the GPS data that both your companies already collect could readily reveal individual identities. Worse, when paired with other data sets, the data from this project could create an extraordinarily precise mechanism for surveillance. Both your companies collect GPS data, but the GPS system has significant limits. It works poorly indoors and cannot pinpoint the floor a person is on. Combining the data from this project with GPS data (or other data, such as Wi-Fi positioning), could greatly erode privacy by making precise surveillance much easier."

He goes on to say that Americans should be concerned that after the pandemic ends and there is no need for further contact tracing, Apple and Google won't change the interface to eliminate all of the privacy protections that both tech firms have included with the system. Hawley also worries that the apps that are developed for the contact tracing plan could also be used to obtain real-time location data. The senator sticks it to Google by stating, "When it comes to sticking to promises, Google’s record is not exactly reassuring. Last year a Google representative had to admit, under oath, that Google still tracks location history even when a person turns location history off." He then quotes an Associated Press report that says, "Google wants to know where you go so badly that it records your movements even when you explicitly tell it not to."

To make the public feel better about the contact tracing plan, Hawley asks both Cook and Pichai to make a commitment to be personally liable if they stop protecting the privacy of those who use the contact tracing system. As an example, the senator writes that they should personally agree to be held responsible if advertising companies are allowed to access the interface once the crisis comes to an end. He closes out his letter by noting that "The public statements you make now can be enforced under federal and state consumer protection laws. Do not hide behind a corporate shield like so many privacy offenders have before. Stake your personal finances on the security of this project."

Senator Hawley obviously seems concerned about Google pulling a fast one after the pandemic ends by turning the interface into a source of real-time location data for advertisers. He says to both Cook and Pichai that he looks forward to hearing how they plan on giving Americans assurance about their project. It should be interesting to see how the two executives reply.