92 comments

[ 4.6 ms ] story [ 155 ms ] thread
After a certain point is it just better for everyone to keep an old burner smartphone for these ‘required’ apps
In this case, I disagree.

This is a private school, and its students are customers. Their school is forcing an app on them that violates their privacy far more than is necessary for contact tracing, and it was developed by a non-software firm with no understanding of security.

The solution here is to petition and protest the school, not just work around the app.

I think you are both correct, but since there is no guarantee about the timeline and success of the "petition and protest" approach, I'm all for the burner phone strategy in the meantime.
I can't read the article (no js = blocked) but why not, when asked, hand over an ancient no-internet dumbphone and say "this is my only phone"[0] - what are they going to do, ban you, buy you a smartphone with their money?

[0] in my case that would be true

They will just tell you to buy a compatible phone or you will not be allowed on site. Its a private school so if you are too poor for a $50 android phone then you wouldn't be able to go to the school anyway.
I bet you could make the school buy the phone, these kind of places desperately need the money.

I attended a very small liberal arts school right after the great recession. If you were paying your way (50k/yr), they were desperate to have you. The number of scholarship students who got expelled for drugs or alcohol were many, the number of full tuition students, zero.

>If a student leaves campus without permission, the app will alert the school, and the student’s ID card will be locked and access to campus buildings will be revoked

This seems so flawed and easy to bypass. Leave your phone in your dorm and sneak off campus, it's as easy as that.

> Leave your phone in your dorm and sneak off campus, it's as easy as that.

To do... what? Without a phone, many will have no means of transportation. They won't be able to sync up with friends or use GPS.

It's absolutely unimaginable that a large number of college students will leave campus without a phone. They're much more likely to have a separate phone to put the app on.

Don't you have old phones laying around? Install the app on one of those and keep using your main phone.
(comment deleted)
Read the fifth sentence of my comment, where I proposed exactly that.

I was responding to someone who proposed leaving campus without a phone.

If you’re not going to use it as a phone, it neither needs to be good nor have a data plan. Literally the cheapest phone available would do the trick.
You can get a refurb Android phone for literally $5 from Tracfone right now, for example.
I agree. I was responding to someone suggesting students leave campus without a phone. It makes much more sense to have a decoy device than to leave your phone at home.
I rarely if ever go out of the house without my phone on me, but I reckon it wouldn't be that difficult to get a small group into a car and just drive out, maybe writing down the way beforehand. It would be annoying, but they'd manage just fine.
> maybe writing down the way beforehand

Google maps street view (satellite if not available) is far preferable. You just need to remember landmarks to turn at.

Amazingly enough, people managed to get by before smartphones were the norm.
I remember reading about a curious unintended consequence for drivers licenses issued to california drivers under 18 -- they may not drive the car with other passengers under 20 years old.

So... Trunking.

That's what you do when you don't want to get caught with an underage passenger... you put them in the trunk.

Police don’t check if it’s a relatively short trip and you don’t break any laws. Source: Don’t ask...
I believe police cannot pull someone over just because they look to be a certain age.
But police can pull you over for a dozen other fairly mundane, unverifiable reasons so it's really a moot point.
Or if you want to sneak them in for free to the drive in theater! See there's nothing new under the sun ;<)
Couldn't you simply revoke data access to the app when you plan on leaving campus?
Not necessarily. IIRC GPS functions in airplane mode, and they _could_ have coded the app to record infractions and only notify your prison guard when you later re-enable data access.
The T&C most likely require students to grant data access all the time.

If the app detects permissions are revoked, the student might face some consequences.

On android, you can easily spoof gps data with apps, no root needed. You don't even need to get another phone or leave it behind.
>If a student leaves campus without permission

I know the system in US is different from those I have experience with, but do a student at a college really require permission to go off campus? Isn't college students consider adults who can make own decisions?

No, they don’t require permission normally. This is just covid panic.
I don't know why US schools and the government are trying so desperately to get people back on site. Its clear this isn't going to work and the only solution is remote education.
It's probably a combination of hopeful optimism and financial desperation. It's too early to know for sure, but I bet a lot of small, private colleges are hurting and need to do everything they can to have students on campus. Students not paying for housing, meal plans, etc. is a big deal.
Sure it could work. The virus is fairly harmless for college-age people. But it can’t work because people are irrationally afraid.
College age healthy people are prone to unintentionally spreading it to people with weakened immune systems or older people, directly or indirectly. The more it spreads among the healthy population, the higher the risk that the more vulnerable will be infected. That's hardly irrational.
Unless you had the young people on some kind of campus, away from their family for months.
It's because no one wants to pay 50k for a online only liberal arts education. Without in person attendance, these schools are totally screwed.
Dr. Michael Munger of Duke was on EconTalk recently and talked about his 'Four Buildings' view of the university. I think that this lens is an incredibly useful way to look at the problem.

Briefly, the Four Buildings of the University are 1) The Clock Tower - It coordinates times for shared experiences, 2) The Stadium - It gives a shared tribal identity to a group of people, 3) The Student Union - A sorting hat for people that are 'in' and further subdivides interests, great for dating and close friendship, 4) The Admissions Office - Very important, tells the rest of the world this person was evaluated and found exceptional.

Note that The Classroom is not on the list.

Some of these buildings can be done remotely-ish (Admissions, the Clock Tower - maybe), but the others absolutely need to be in person (Stadium, Student Union, Clock Tower - mostly).

Justifying these Four Buildings, remotely, at $50k/yr, is a very hard sell, but a great idea for a social-Startup.

https://www.aier.org/article/after-the-virus-universities-wi...

https://www.econtalk.org/michael-munger-on-the-future-of-hig...

I'm curious about the interplay of (a) this app/policy vs. (b) other measures the college will take. E.g., mandatory social distancing, masks, dorm occupancy, etc.

I could see how implementing (a+b) might yield lower infection rates than just (a) or just (b).

But if having (a) in effect lulls the college into relaxing (b), and some students subvert (a), then I could see how it's a recipe for an outbreak.

The rate of infection may be lower, but that doesn't necessarily mean fewer people will be in infected -- it means the spread takes more time.
Yeah, I’d just buy a $100 android phone and use it as my keypass whilst at uni. Don’t take it off-site with you - you’d have virtually unlimited freedom if you leave it in your room, or turn it completely off before leaving campus.

It is a straightforward response to a ridiculous request on user privacy: you can’t force me to use my personal phone how you’d like unless you provide it. You can force me to buy into an app that tracks the location of my device in order to enter buildings and such, but you can’t control which device I choose to use, nor force me to carry it in my personal life. The flaw in the underlying assertion (one-to-one phone/person relationship, location of a phone = location of a person) is not my problem.

> $100

You don't need to go nearly that high. Right now, Tracfone has a sale for a SIM-locked refurb Android 8.1 phone for literally $5, and even outside of sales the low end is only about $20.

I bought one as a balloon tracker the other year (I didn’t realize this was illegal).

As soon as you connect it to a network (including WiFi) it will automatically download gigabytes of malware from the play store which will keep launching in the background and crashing things by using up all the ram. It was pretty eye opening to realize what people actually deal with if they can’t afford nicer phones and don’t know how to (or can’t) replace the firmware. Cheap android phones make cheap PCs look nice.

Also an emulator or container is $0.

You can even use an android emulator for this - some of them come with location spoofing too.
If you don't want to participate in contact tracing, just stay home.

The people who get sick and die because of your untraceable contacts are your problem.

This has never been the approach we've taken for any other virus. This sets a precedent that anyone who values privacy should be very, very against.
(comment deleted)
Contact tracing is how every outbreak until this one got contained. If people took this attitude with human contact tracers, pandemics like this would be routine.
(comment deleted)
This comparison isn't reasonable. Yeah, contact tracing can be an effective tool, but there's something very different between that and homespun apps to track who has run into who.

If you don't think these apps will be used

  1) during wartime

  2) to track political dissidents

  3) to gather data on interactions between people in a country for things like 'urban planning'

  4) as a monetized version of each of these

Then I don't think you're treating distributed, scalable contact tracing like other technology.
Oh, they certainly will - as will the routine tracking from everything else, including Google Play Services, Facebook etc. At least the pandemic contact tracing has a clear public benefit.
You can add stalkers
Almost no outbreaks are ever successfully contained though.
(comment deleted)
the patriot act was passed because people were scared and wanted to stop terrorism
I agree that contact tracing is important, but there are ways to do it without tracking each student's location all the time. The contact tracing app we have in Germany simply communicates with phones nearby, remembers who it has met, and if any of them test positive it sends you an alert.

There was a long and heated discussion about making this app as privacy focused as possible while still being useful, and it seems to have struck a reasonable compromise. Why can't the college's contact tracing app do something similar?

Also the Austrian App (with the same basic idea behind it, albeit slightly differently done) was open sourced I believe so that others could "just" use pen tested and privacy focused code to develop their app for contact tracing.

And while I am a user of the German app, because i value the upsides of contact tracing, I would do everything possible to not be monitored 24/7 by such a campus spyware.

It might be easier to force people to stay at home than to let them come out but force them each to carry a specific phone.

To be clear, I'm not advocating for teenagers to all sneak off and mingle at this time. But they are going to do it anyway, regardless of what I think, and this app isn't going to stop them.

The college, however, can pat themselves on the back and call it a victory.

I'm all for contact tracing, but that doesn't appear to be the core purpose of this app. It's about enforcing a social bubble through what is essentially house arrest. That's why the app is creating alerts about when a student goes off-campus:

> In addition to having to install the app, students were told they are not allowed to leave campus for the duration of the semester without permission over fears that contact with the wider community might bring the virus back to campus.

Tracking location isn't necessary to conduct contact tracing, as demonstrated by Canada's "COVID Alert" app:

> The app is designed to notify users when they’ve been in close contact with someone who has tested positive for COVID-19.

> However, it does not track a user’s location itself, or use GPS.

> Instead, the app produces random codes, and uses Bluetooth to ping other users’ phones and exchange these codes whenever two people who have the app are physically near one another.

> https://www.ctvnews.ca/health/coronavirus/canadian-privacy-w...

So let's not conflate the issues here. This app doesn't exist primarily for "contact tracing"; if it were, they would not need to collect location data. This is about geofencing students.

>It's about enforcing a social bubble through what is essentially house arrest

It's also premised on the idea that the interior of the campus perimeter represents a safe "sterile zone". This is obviously false. A student could show up on day one infected but with a negative test result. Professors and other staff members are free to leave the campus. Presumably vendors (food, cleaning, maintenance, supplies) will come and go. Solely restricting the movement of students is not going to prevent an outbreak.

Exactly! This is pure COVID theater. I presume to convince parents their child will be safe so they will pay their $45,000 annual tuition bills.
The virus spread from a single point in China and now exists in millions if not billions of hosts. If it could spread from a single point if will definitely spread now. As long as the virus exists it will continue to spread regardless of measures such as contact tracing.

That means there is no such option as "follow the rules or death". It's a false narrartive pushed by people who want to shame those who don't follow the rules. We may feel a need to "do something" and that may make us feel better, but that doesn't eman that it works.

Luckily the death rates aren't that different from a regular flu. Of course people die from that too. That's tragic, but everybody dies so there is no option of death or not death. The only question is how we die. For examples, the measures taken against the virus have killed people. How many? No government that I know of is tracking this.

I agree that we should be tracking more of everything, including people who died because of the lockdown measures. However, your statement that the death rates aren't that different from the flu are demonstrably wrong. One, the data does not show that. Two, your confidence in such a statement is not warranted, given that we do not have very good data for what is still an active Wave 1 of a pandemic. Third, we have no idea what the longterm effects will look like across a population - just because people don't die from it right now does not mean there aren't risks of shortened lifespan and lowered quality of life.

I respect your right to have a differing opinion, but as far as they go, yours is a very strong opinion that you are too confident in without sufficient evidence.

> If it could spread from a single point if will definitely spread now. As long as the virus exists it will continue to spread regardless of measures such as contact tracing.

Respectfully, this is dangerous bullshit, and doesn't even make sense. The virus spread initially in a world without countermeasures. With countermeasures that reduce Re... if every infected person spreads it to less than one person on average, the spread on a population level stops. That's sort of the point. I'd highly suggest playing around with a cellular automaton or something to get a sense for super- v.s. subcriticality.

> That's tragic, but everybody dies so there is no option of death or not death. The only question is how we die.

Sure, I'm going to die someday with exceedingly high probability, but even though I know that, I haven't shot myself. And I wear a helmet when I ride my bicycle. I don't have any hard data to back this up, but I suspect the majority of people would prefer to die later rather than sooner. If you'd like to fund a poll to investigate this question, please feel free.

The government never has a right to track my whereabouts at all times, nor do I have an obligation to inform them of such.
I remember being a uni student, and an extra $100 outlay (plus a sim presumably to keep it connected to a network) for privacy was definitely not something I would have had the budget for. I was a fairly typical student, but I don't think at any point in my 5 years of uni I would have been free to drop $100 on something like that. I was very cash flow restricted the entire time.
If you were cost conscious, you probably didn't pay for a $50K/yr tier-3 liberal arts degree then.

And as a US student (the sort who think Albion is a good investment) you'd have loans to cover your cash flow.

> you can’t force me to use my personal phone how you’d like unless you provide it. You can force me to buy into an app that tracks the location of my device in order to enter buildings and such, but you can’t control which device I choose to use, nor force me to carry it in my personal life.

While I appreciate what you're trying to say, and agree that it's draconian. The assertion that they can't force you isn't quite true. The collage is private property, they can absolutely make entry conditional on using this app on your personal device.

If you don't agree with their measures, then you simply aren't allowed on the colleges private property. Just as equally they can make compliance a condition of providing your education (it's a private contract after-all). Again, don't like it, don't get educated.

Ultimately college education is a contract between private individuals, none of the protection you have against government overreach apply.

Contracts are only enforceable (a) if they are conscionable, and (b) if they exist.

Is there a contract saying the user must carry the tracking app everywhere they go?

Probably not but there almost certainly is the standard set of "industry standard" clauses that inevitably end up in any sort of consumer contract, basically saying "we can kick you out for any reason we want, what are you going to do, all our competitors have the same language".
I eagerly await legal challenges for this.
> students are expected to use the app or face suspension

How does this work in the contract the college has with the student? Is there a term in the contract that allows the college to unilaterally add additional terms — terms which can then lead to unilateral termination of the contract by the college with or without some kind of notice period?

Presumably “suspension”, while framed as a punitive measure against students, is legally just the college withdrawing from the contract under previously agreed terms?

I ask because I’m increasingly encouraging young people to recognize that they are legal adults when they go off to higher education, and they should politely resist any trend for colleges to infantalise them by reframing terms of contracts as silly rules.

As a university student (not attending the university mentioned however), I can chime in here. If we chose to come on-campus, we were given an addendum to our housing agreement to sign before we moved in. Simply put, no addendum signed = no housing (since they reserve the right to terminate one's housing for any reason). I imagine it's a similar situation for many universities nationwide.

Regarding your second point:

> Presumably “suspension”, while framed as a punitive measure against students, is legally just the college withdrawing from the contract under previously agreed terms?

The article addresses this: private universities have a lot more leeway on how they conduct business.

If you already signed a lease, you don’t have to agree to new terms for that lease. It’s already a valid lease that can’t easily be terminated, and Michigan has pretty good renter protection laws (I used to live there). Not a lawyer though, but a lease is a binding agreement that they can’t just arbitrarily change and force you to accept
Students don’t lease dorm rooms in the traditional sense of a lease
> they can’t just arbitrarily change and force you to accept

They can if "they" are the state.

"suspension" is was one of many terms schools use to intimidate students and create an illusion of power.

A tier-3 private liberal arts college has no power except what they trick students to giving them along with the $50K/yr (!!!) tuition.

Covid apps using Bluetooth are useless.

If you want a chance for it to work, this might.

This is what a lockdown is. Taking huge risks, be it loose APIs or destroying parts of the economy, all to stop a huger risk.

If you want to understand why Republicans protest the lockdown, look here, this is the beginning of the creep. Republicans mightn't understand what they are protesting but they at least can see the fear, which Democtatz can't.

Given what the media, politicians and the public in general say, everyone just doesn't seem to understand either risk or it's magnitude.

I'll admit I'm not an expert in this area, but why are apps using Bluetooth useless? Because people turn Bluetooth off?
On the iPhone it just goes to sleep.

This is a killer.

But it's not the end of it. Bluetooth can't measure distance well, it's totally not in it's design. Every phone model is different, I think including software version.

So there are databases of phone models to try and fix this. But it's still far from perfect since it's still not in the Bluetooth design.

Measuring time of exposure is hard with Bluetooth.

Now Apple and Android released frameworks to try and fix these issues. But governments had already invested in the old solution and it's not clear if the new framework will fix much.

To do what they want to do with Bluetooth would be pretty amazing. It's basically Geo Location using beacons using existing phone tech. That's fucking cool, yet for some reason it's never been done before this, Covid solves all technological issues it seems?

GPS tracking works really well. You will also know where. So you can see if it was inside, outside, walls between them, all things vague Bluetooth apps can't do. Lot's of context with GPS.

So, what do we think governments will do when Bluetooth has been shown not to work, but this privacy invading app works really well, which it should.

Measurement-Based Evaluation Of Google/Apple Exposure Notification API For Proximity Detection In A Commuter Bus https://arxiv.org/pdf/2006.08543.pdf

"We find that the attenuation level reported by the GAEN API need not increase with distance between handsets, consistent with there being a complex radio environment inside a bus caused by the metal-rich environment... Applying the rule used by the Swiss Covid-19 contact tracing app to trigger an exposure notification to our bus measurements we find that no exposure notifications would have been triggered despite the fact that all pairs of handsets were within 2m of one another for at least 15 mins"

I wish they would've tested more distances. If the threshold is 1.5 meters or even 1.0 meters that's still better than nothing at all. No one is touting these apps (or masks, or social distancing) as the ultimate solution to the spread of SARS-CoV-2, it's all just things we can do to reduce the risk.
> I wish they would've tested more distances.

Bluetooth is 31 years old. What is there to test?

> No one is touting these apps <snip> it's all just things we can do to reduce the risk.

The app does not reduce risk, even if it worked. It's for contact tracing. This is importantly different.

You seem confused, which I might guess is because the app was touted incorrectly in many countries. Masks and social distancing do reduce risk. Although most Western countries told you otherwise to begin with on masks. And told you incorrectly how to wash hands, and also incorrectly said it reduces risk (considered unlikely). I'll add being outdoors also probably reduces risk, not sure this is commonly touted yet.

I mean risk at the societal level, not individual. Maybe there's a better word. Anyway what I mean is that the risk of the virus/disease spreading faster than our healthcare systems can handle is lowered by effective contact tracing. Not that I personally am less at risk of being infected if I install the app.
Ok, some politicians etc were calling the apps a condom or sunscreen.

All evidence since March has been boots on the ground for contact tracing is what's important. Not tech.

But the Bluetooth apps, which we know can't work well also don't try for behaviour change, they might even increase risk. This app at this college is trying for positive behaviour change.

IMHO: Don't bother with college. All information anyone could possibly need is available from libraries and the internet. If you learn what you need to know and prove that you know it, people will hire you.
If only colleges' sole purpose was to impart knowledge.

I think they're a great place to meet like-minded people, form friendships, find potential co-founders, grow your network, get inspired by people some of whom are likely to be world's best at what they do.

Another thing is colleges force you through a rigid system of semesters, courses, and exams that takes most of guess work out of the learning. Besides, I'd wager one needs a disproportionate amount of patience to be disciplined enough to follow their own curriculum of learning regardless of accessibility and availability of content.

I am not saying the current system is the best humanity can do, but: https://en.wikipedia.org/wiki/Wikipedia:Chesterton%27s_fence

I like my surgeons like I like my women: with a formal education.
Yeah well unfortunately the HR department that screens resumes doesn't agree.
In my experience, people who are self taught can be quite competent in a very narrow area (like frontend web development), but have vast, gaping holes in their knowledge when it comes to the big picture. I'm talking about really fundamental stuff like what an algorithm is, what memory is and why it's useful etc.

University is such an important part of development overall that it really shouldn't be skipped. It's a shame that they've become overrun with stupid SJW/feminist nonsense these days, but I think it's still overall extremely valuable. You can't replicate the university environment at home.

Not only that, you'll be looked over for many opportunities when compared with people with degrees. This isn't entirely unfair, given the justifications for university above, but it is a little. Unfortunately that's just the way it is, though. If you can't beat 'em, join 'em.

This is insidious. What kind of college dean or president would think that this is OK?

With such a low level of regard towards young people and with only potential for gross abuse, if the staff's leadership refuse to apologise and withdraw the app's obligatoriness then they should be sacked without delay.

I know this is a strong opinion but I'm really on board with that petition.

If you're not sure the answer, it's almost always money. The school wants their $45,000 tuition bills paid
It is very disturbing that Nucleus ignored and stiffed the security researcher who pointed out their obvious issue with AWS keys. They should not expect cooperation from the security community in the future and I hope this will have a severe impact on their ability to attract and retain customers.