COVID-19 Contact Tracing apps: India’s Aarogya Setu goes open source, while Sweden and Italy test Google/Apple’s Exposure Notification API - XDA Developers | Canada News Media
Connect with us

Tech

COVID-19 Contact Tracing apps: India’s Aarogya Setu goes open source, while Sweden and Italy test Google/Apple’s Exposure Notification API – XDA Developers

Published

 on


The novel coronavirus, also known as SARS-CoV-2, has wreaked havoc across the world. A few nations have managed to control the spread of the virus, but many others have struggled and are still trying their best to contain it. One of the strategies being tested for its containment is contact tracing, ie. tracing all the people who have recently come into contact with a person who has tested positive for COVID-19 and then undertaking steps to isolate these individuals. Contact tracing is a crucial task to get right as it impacts an individual’s privacy and liberty in the greater interest of public health. The threat to personal privacy was big enough for Google and Apple to come together and collaborate on a contact tracing API and Bluetooth spec, one that is designed to have minimal impact on user privacy and security. While these efforts are commendable and some countries have adopted these, a fair few nations have also undertaken work on their own similar solutions. In this piece, we attempt to list some of these contact tracing solutions, with a focus on those that have their source code open and available to the public for inspection and feedback.

Independent Solutions

Austria — Stopp Corona

The Austrian government adopted the Stopp Corona app developed in conjunction with the Austrian Red Cross. This app does not rely on Google and Apple’s Exposure Notification APIs. There is no location tracking in place, as the app uses Bluetooth. The app monitors the phones that have come near the user. If a user suspects COVID-19 infection or has been positively diagnosed with it, the proximity information is uploaded to what is claimed to be a decentralized database. Alerts are sent out to all users who have had proximity history. Reportedly, there is no personal information collected, and if a user wants to opt-out of tracking, they can simply delete the app and the data. For further peace of mind, the app is open source too.

Stopp Corona Source Code on GitHub

Price:
To be announced

Australia — COVIDSafe

Australia has adopted the COVIDSafe app. This app does not rely on Google and Apple’s Exposure Notification APIs. Upon installation, users need to register their name/pseudonym, age range, postcode, and phone number, all of which are stored encrypted on a government server. The app relies on Bluetooth for proximity tracking, exchanging anonymized IDs that are changed every two hours. These IDs are stored encrypted on phones and deleted after 21 days. When someone tests positive for COVID-19, they receive a unique code from health officials that then uploads the list of anonymized IDs for the past 21 days. The app is open-source too, so transparency is maintained.

COVIDSafe Source Code on GitHub

Price:
To be announced

Czech Republic — eRouska

Czech Republic has adopted the eRouska app. This app does not rely on Google and Apple’s Exposure Notification APIs. Similar to other implementations that are Bluetooth-only, eRouska scans the area for other eRouska app users in proximity and saves encounter data locally on the device. When a user tests positive, the user is contacted by health officials to upload the encounter data consensually. The broadcasted Device ID changes every hour, and scanning can also be manually toggled on and off. Users can opt to remove all of their collected data, including the phone number. The app is open-source, too.

eRouska Source Code on GitHub

Price:
Free

India — Aarogya Setu

The Government of India decided to not adopt Google and Apple’s solution but instead develop its own solution in the form of the Aarogya Setu app. Once a user sets up their account on the application, the app asks for continued Bluetooth access and location data. Users also need to provide information such as name, age, gender, health status, and more, to build up a user profile. A self-assessment test is put forward where the user is asked whether they are showing any of the symptoms of COVID-19 along with other questions. When two smartphones with the Aarogya Setu app come close to each other, the app collects information. If one of the contacts has tested positive, the app will alert the other person and provide instructions to help in self-isolation.

The use of this Aarogya Setu app was first heavily encouraged by the government and then mandated in several instances. However, India does not have the best attitude towards citizen privacy as the country lacks key laws to regulate such use-cases. Since the app collects location data and shares it with the government—an approach that many have deemed excessive and unnecessary—it came under the spotlight for being too intrusive on user privacy and for having no transparency and accountability in the process. What followed was criticism of these approaches.

In some good news on this end, the Aarogya Setu app for Android has been made open source. The source code for the Android app is now available on GitHub. Concerned authorities promise that the source code for the iOS version and the KaiOS version of the app will also be open-sourced “in due time“. The privacy policy of the app was also updated to allow for reverse-engineering the app and reporting bugs to the government. Further, there is also a bug bounty program in place, inviting developers to identify vulnerabilities, bugs, and code improvements.

Aarogya Setu Source Code on GitHub

All of this is definitely good news since the lack of transparency was rather alarming. There are still questions on the opaque back-end infrastructure and server-side code, but reports suggest that this, too, will be open-sourced next week.

Price:
Free

Singapore — TraceTogether based on BlueTrace Protocol

Singapore’s implementation takes the form of TraceTogether, which is also not reliant on Google and Apple’s Exposure Notification APIs but is also Bluetooth-only and not location-based. The app only needs a mobile number to initiate, and no other personal information is collected. The number forms part of the user ID, which is then used to generate temporary IDs. Proximity information on these temporary IDs is stored on a 21-day rolling basis on-device. Data is relayed to a server when a user tests positive. Further, TraceTogether’s functionality is promised to be suspended when the pandemic situation subsides.

While TraceTogether is not open source by itself, a generic codebase has been published in the form of OpenTrace. This generic codebase comprises the reference implementation of an Android app, an iOS app, and a central server built around Google Firebase. Also published is the BlueTrace protocol which forms the basis for both TraceTogether and OpenTrace. The BlueTrace protocol attempts to create interoperability across jurisdictions so that other nations can collaborate on these efforts.

OpenTrace Source Code on GitHub

Price:
Free

UK — NHS COVID-19

The United Kingdom’s implementation takes the form of the NHS COVID-19 app, which is currently in “beta testing” and available to residents within the Isle of Wight (and to be expanded to other regions in the future). The app is not reliant on Google and Apple’s Exposure Notification APIs but also relies on Bluetooth. Upon setup, users are asked to enter the first half of their pin code, which is used to identify if there are hotspots breaking out—further details are not asked unless you report symptoms. Bluetooth proximity data is logged for 28 days through anonymous IDs. The app will also be discontinued once the pandemic situation is over. The source code of the app is already open and available for inspection.

NHS COVID-19 Source Code on GitHub

Price:
Free

Solutions using Google and Apple’s Exposure Notification API

These implementations are built on top of Google and Apple’s Exposure Notification API. Google has also rolled out an update to Google Play Services that includes the new API. A reference design for an Android app implementing the Exposure Notifications API is also available. Apps based on this API are prohibited from collecting device location data. Instead, the API utilizes Bluetooth Low Energy to detect if you have been in the vicinity of others who have tested positive. The API will share how many days have passed since an individual “contact event” alongside an estimate of exposure time. Bluetooth metadata will be AES encrypted.

While in the case of Google, Android users will not need to install an application as the Exposure Notification API is being delivered through updates to Google Play Services. So as long as you have an Android device running Android 6.0 Marshmallow or later, you should have access to the service. Still, Google will prompt users to download a relevant public health app if a positive contact event has been detected.

Italy — Immuni

Italy’s solution comes in the form of the Immuni app, which is expected to see a broader public release in the coming days. It relies on Google and Apple’s exposure notification system, leveraging Bluetooth Low Energy, and no geolocation data is collected whatsoever.

Immuni Source Code on GitHub

Switzerland — SwissCovid DP-3T

Switzerland is working on a solution called Decentralised Privacy-Preserving Proximity Tracing (DP-3T). The app and server are both expected to be open-source. The app is not yet complete and released to the public, but the source code for the app is already live, so it should serve as a foundation.

SwissCovid DP-3T Source Code on GitHub


This is not an exhaustive list but meant to highlight the solutions that are available in the form of open-sourced code for interested developers to inspect and build upon.

Want more posts like this delivered to your inbox? Enter your email to be subscribed to our newsletter.

Let’s block ads! (Why?)



Source link

Continue Reading

News

The Internet is Littered in ‘Educated Guesses’ Without the ‘Education’

Published

 on

Although no one likes a know-it-all, they dominate the Internet.

The Internet began as a vast repository of information. It quickly became a breeding ground for self-proclaimed experts seeking what most people desire: recognition and money.

Today, anyone with an Internet connection and some typing skills can position themselves, regardless of their education or experience, as a subject matter expert (SME). From relationship advice, career coaching, and health and nutrition tips to citizen journalists practicing pseudo-journalism, the Internet is awash with individuals—Internet talking heads—sharing their “insights,” which are, in large part, essentially educated guesses without the education or experience.

The Internet has become a 24/7/365 sitcom where armchair experts think they’re the star.

Not long ago, years, sometimes decades, of dedicated work and acquiring education in one’s field was once required to be recognized as an expert. The knowledge and opinions of doctors, scientists, historians, et al. were respected due to their education and experience. Today, a social media account and a knack for hyperbole are all it takes to present oneself as an “expert” to achieve Internet fame that can be monetized.

On the Internet, nearly every piece of content is self-serving in some way.

The line between actual expertise and self-professed knowledge has become blurry as an out-of-focus selfie. Inadvertently, social media platforms have created an informal degree program where likes and shares are equivalent to degrees. After reading selective articles, they’ve found via and watching some TikTok videos, a person can post a video claiming they’re an herbal medicine expert. Their new “knowledge,” which their followers will absorb, claims that Panda dung tea—one of the most expensive teas in the world and isn’t what its name implies—cures everything from hypertension to existential crisis. Meanwhile, registered dietitians are shaking their heads, wondering how to compete against all the misinformation their clients are exposed to.

More disturbing are individuals obsessed with evangelizing their beliefs or conspiracy theories. These people write in-depth blog posts, such as Elvis Is Alive and the Moon Landings Were Staged, with links to obscure YouTube videos, websites, social media accounts, and blogs. Regardless of your beliefs, someone or a group on the Internet shares them, thus confirming your beliefs.

Misinformation is the Internet’s currency used to get likes, shares, and engagement; thus, it often spreads like a cosmic joke. Consider the prevalence of clickbait headlines:

  • You Won’t Believe What Taylor Swift Says About Climate Change!
  • This Bedtime Drink Melts Belly Fat While You Sleep!
  • In One Week, I Turned $10 Into $1 Million!

Titles that make outrageous claims are how the content creator gets reads and views, which generates revenue via affiliate marketing, product placement, and pay-per-click (PPC) ads. Clickbait headlines are how you end up watching a TikTok video by a purported nutrition expert adamantly asserting you can lose belly fat while you sleep by drinking, for 14 consecutive days, a concoction of raw eggs, cinnamon, and apple cider vinegar 15 minutes before going to bed.

Our constant search for answers that’ll explain our convoluted world and our desire for shortcuts to success is how Internet talking heads achieve influencer status. Because we tend to seek low-hanging fruits, we listen to those with little experience or knowledge of the topics they discuss yet are astute enough to know what most people want to hear.

There’s a trend, more disturbing than spreading misinformation, that needs to be called out: individuals who’ve never achieved significant wealth or traded stocks giving how-to-make-easy-money advice, the appeal of which is undeniable. Several people I know have lost substantial money by following the “advice” of Internet talking heads.

Anyone on social media claiming to have a foolproof money-making strategy is lying. They wouldn’t be peddling their money-making strategy if they could make easy money.

Successful people tend to be secretive.

Social media companies design their respective algorithms to serve their advertisers—their source of revenue—interest; hence, content from Internet talking heads appears most prominent in your feeds. When a video of a self-professed expert goes viral, likely because it pressed an emotional button, the more people see it, the more engagement it receives, such as likes, shares and comments, creating a cycle akin to a tornado.

Imagine scrolling through your TikTok feed and stumbling upon a “scientist” who claims they can predict the weather using only aluminum foil, copper wire, sea salt and baking soda. You chuckle, but you notice his video got over 7,000 likes, has been shared over 600 times and received over 400 comments. You think to yourself, “Maybe this guy is onto something.” What started as a quest to achieve Internet fame evolved into an Internet-wide belief that weather forecasting can be as easy as DIY crafts.

Since anyone can call themselves “an expert,” you must cultivate critical thinking skills to distinguish genuine expertise from self-professed experts’ self-promoting nonsense. While the absurdity of the Internet can be entertaining, misinformation has serious consequences. The next time you read a headline that sounds too good to be true, it’s probably an Internet talking head making an educated guess; without the education seeking Internet fame, they can monetize.

______________________________________________________________

 

Nick Kossovan, a self-described connoisseur of human psychology, writes about what’s

on his mind from Toronto. You can follow Nick on Twitter and Instagram @NKossovan.

 

Continue Reading

Tech

Tight deadlines on software projects can put safety at risk: survey

Published

 on

 

TORONTO – A new survey says a majority of software engineers and developers feel tight project deadlines can put safety at risk.

Seventy-five per cent of the 1,000 global workers who responded to the survey released Tuesday say pressure to deliver projects on time and on budget could be compromising critical aspects like safety.

The concern is even higher among engineers and developers in North America, with 77 per cent of those surveyed on the continent reporting the urgency of projects could be straining safety.

The study was conducted between July and September by research agency Coleman Parkes and commissioned by BlackBerry Ltd.’s QNX division, which builds connected-car technology.

The results reflect a timeless tug of war engineers and developers grapple with as they balance the need to meet project deadlines with regulations and safety checks that can slow down the process.

Finding that balance is an issue that developers of even the simplest appliances face because of advancements in technology, said John Wall, a senior vice-president at BlackBerry and head of QNX.

“The software is getting more complicated and there is more software whether it’s in a vehicle, robotics, a toaster, you name it… so being able to patch vulnerabilities, to prevent bad actors from doing malicious acts is becoming more and more important,” he said.

The medical, industrial and automotive industries have standardized safety measures and anything they produce undergoes rigorous testing, but that work doesn’t happen overnight. It has to be carried out from the start and then at every step of the development process.

“What makes safety and security difficult is it’s an ongoing thing,” Wall said. “It’s not something where you’ve done it, and you are finished.”

The Waterloo, Ont.-based business found 90 per cent of its survey respondents reported that organizations are prioritizing safety.

However, when asked about why safety may not be a priority for their organization, 46 per cent of those surveyed answered cost pressures and 35 per cent said a lack of resources.

That doesn’t surprise Wall. Delays have become rampant in the development of tech, and in some cases, stand to push back the launch of vehicle lines by two years, he said.

“We have to make sure that people don’t compromise on safety and security to be able to get products out quicker,” he said.

“What we don’t want to see is people cutting corners and creating unsafe situations.”

The survey also took a peek at security breaches, which have hit major companies like London Drugs, Indigo Books & Music, Giant Tiger and Ticketmaster in recent years.

About 40 per cent of the survey’s respondents said they have encountered a security breach in their employer’s operating system. Those breaches resulted in major impacts for 27 per cent of respondents, moderate impacts for 42 per cent and minor impacts for 27 per cent.

“There are vulnerabilities all the time and this is what makes the job very difficult because when you ship the software, presumably the software has no security vulnerabilities, but things get discovered after the fact,” Wall said.

Security issues, he added, have really come to the forefront of the problems developers face, so “really without security, you have no safety.”

This report by The Canadian Press was first published Oct. 8, 2024.

Companies in this story: (TSX:BB)

The Canadian Press. All rights reserved.

Source link

Continue Reading

Tech

Beware of scams during Amazon’s Prime Big Deal Days sales event: cybersecurity firm

Published

 on

 

As online shoppers hunt for bargains offered by Amazon during its annual fall sale this week, cybersecurity researchers are warning Canadians to beware of an influx of scammers posing as the tech giant.

In the 30 days leading up to Amazon’s Prime Big Deal Days, taking place Tuesday and Wednesday, there were more than 1,000 newly registered Amazon-related web domains, according to Check Point Software Technologies, a company that offers cybersecurity solutions.

The company said it deemed 88 per cent of those domains malicious or suspicious, suggesting they could have been set up by scammers to prey on vulnerable consumers. One in every 54 newly created Amazon-related domain included the phrase “Amazon Prime.”

“They’re almost indiscernible from the real Amazon domain,” said Robert Falzon, head of engineering at Check Point in Canada.

“With all these domains registered that look so similar, it’s tricking a lot of people. And that’s the whole intent here.”

Falzon said Check Point Research sees an uptick in attempted scams around big online shopping days throughout the year, including Prime Days.

Scams often come in the form of phishing emails, which are deceptive messages that appear to be from a reputable source in attempt to steal sensitive information.

In this case, he said scammers posing as Amazon commonly offer “outrageous” deals that appear to be associated with Prime Days, in order to trick recipients into clicking on a malicious link.

The cybersecurity firm said it has identified and blocked 100 unique Amazon Prime-themed scam emails targeting organizations and consumers over the past two weeks.

Scammers also target Prime members with unsolicited calls, claiming urgent account issues and requesting payment information.

“It’s like Christmas for them,” said Falzon.

“People expect there to be significant savings on Prime Day, so they’re not shocked that they see something of significant value. Usually, the old adage applies: If it seems too good to be true, it probably is.”

Amazon’s website lists a number of red flags that it recommends customers watch for to identify a potential impersonation scam.

Those include false urgency, requests for personal information, or indications that the sender prefers to complete the purchase outside of the Amazon website or mobile app.

Scammers may also request that customers exclusively pay with gift cards, a claim code or PIN. Any notifications about an order or delivery for an unexpected item should also raise alarm bells, the company says.

“During busy shopping moments, we tend to see a rise in impersonation scams reported by customers,” said Amazon spokeswoman Octavia Roufogalis in a statement.

“We will continue to invest in protecting consumers and educating the public on scam avoidance. We encourage consumers to report suspected scams to us so that we can protect their accounts and refer bad actors to law enforcement to help keep consumers safe.”

Falzon added that these scams are more successful than people might think.

As of June 30, the Canadian Anti-Fraud Centre said there had been $284 million lost to fraud so far this year, affecting 15,941 victims.

But Falzon said many incidents go unreported, as some Canadians who are targeted do not know how or where to flag a scam, or may choose not to out of embarrassment.

Check Point recommends Amazon customers take precautions while shopping on Prime Days, including by checking URLs carefully, creating strong passwords on their accounts, and avoiding personal information being shared such as their birthday or social security number.

The cybersecurity company said consumers should also look for “https” at the beginning of a website URL, which indicates a secure connection, and use credit cards rather than debit cards for online shopping, which offer better protection and less liability if stolen.

This report by The Canadian Press was first published Oct. 8, 2024.

Source link

Continue Reading

Trending

Exit mobile version