Despite guarantees, a senator wants Apple and Google CEOs to be ‘personally responsible’ for the privacy of contact tracing

Senator Josh Hawley has written to CEOs of Apple and Google, demanding that they be “personally responsible” if their respective companies fail to protect user privacy within their COVID-19 contact tracking technology.

In the letter, dated April 21, 2020, he writes:

His recently announced project to respond to COVID – 19 by tracking when and where Americans interact with each other raises serious concerns. Especially due to Google’s poor privacy record, I’m afraid your project could pave the way for something much more serious. The possible implications that this project could have for privacy are alarming. For example, its materials indicate that the data necessary for this project will be anonymised. But the anonymity in the data is notoriously unstable. Data can generally be re-identified simply by cross-referencing with another data set. Pairing the data from this project with the GPS data that both companies already collect could easily reveal individual identities.

Senator Hawley is a true fan of big tech companies, and has been very happy to attack TikTok, Apple, and Apple a little more in recent months.

The concerns raised by Hawley appear to revolve around the possibility that Apple and Google will combine the project data with GPS data “that both companies already collect”, which he said could reveal identities. He further notes:

Even if this project proved useful for the current crisis, how can Americans be sure that they will not change the interface after the pandemic subsides? Once downloaded to millions of phones, the interface could be easily edited to remove previous privacy protections. And any privacy protection built into the interface won’t do much good if applications developed to access the interface also choose to collect other information, such as real-time geolocation data.

Hawley cited Google’s privacy record as “not exactly reassuring,” saying an unprecedented project requires “an unprecedented guarantee on your part.” As such, he wants Cook and Pichai to commit to being “personally responsible if you fail to protect privacy.”

This is, of course, absurd, as no CEO would / could be held personally responsible for the actions / failures of a company. In addition, the joint statement and technical documents published by Apple and Google have already given these guarantees. They list the following privacy security measures:

• Explicit consent of the user is required
• Does not collect personally identifiable information or user location data
• The list of people you’ve been in contact with never leaves your phone
• People who test positive do not identify with other users, Google or Apple
• It will only be used for contact tracing by public health authorities for COVID-19
  pandemic management
• It doesn’t matter if you have an Android phone or an iPhone, it works on both

Senator Hawley is just another man, yelling at another cloud.