Norways COVID-19 app Eivind Arvesen, Sep. 3rd 2020 How to Get - - PowerPoint PPT Presentation

Eivind Arvesen, Sep. 3rd 2020 How to Get People to Use Contact Tracing Apps – Amsterdam Smart City

Norway’s COVID-19 app

Who am I?

Eivind Arvesen
 Consultant @ Bouvet (Oslo, Norway)

• Privacy and security
• Senior software developer and architect
• Part of expert group evaluating Smittestopp

: @EivindArvesen EivindArvesen.com

Source code leak

Source code leak

Smittestopp’s basis for processing was not consent – but regulation
 (still voluntary to use)

Basis for processing

Dual purpose

• Contact tracing
• Provide data to evaluate

government interventions + use as input to epidemiological models

Location Data

Centralized storage

Continuously upload all sensor data from all users
 – as opposed to keeping user data on device, only uploading when needed.

User traceability

Identifying users

No Interoperability

• App criticized by professionals from get-go;

reverse-engineered at launch (April 16th)

• Over 300 professionals in security, privacy and

tech launches petition asking the NIPH to change their approach after background-BLE was fixed

• Negative user feedback from battery-drain,

limited notification support

• Expert group concludes neither security nor

privacy is handled responsibly (May 20th)

• Supplier publicly attacks expert group,

questioning motives and claiming that conclusions and recommendations are personal political opinions …

Rough timeline of events

…

• Parliament decides to split app based on

purpose

• Norwegian Data Protection Authority

concludes that the degree of privacy- invasiveness is not justified

• Health authorities chose to stop all data

collection, and to delete existing data

• Amnesty International stated that they

found the Norwegian app to be among the most dangerous tracing apps for privacy.

• International media attention (New York

Times, The Guardian, etc.)

Rough timeline of events

Norwegian population: around 5,432,580 NIPH stated it would need 50-60% market penetration to get good results from contact tracing.

A few numbers

A few numbers

1 577 494 cumulative (20% of pop.) downloads 592 924 active users (10% of pop.) (users that had uploaded GPS or BLE) Source: NIPH (June 2nd - 3rd), pre app shutdown

This is not «privacy by design.»

Summary

👌

(graphics from unsplash.com)

: @EivindArvesen EivindArvesen.com