By Gabriel Nicholas

加布里埃尔·尼古拉斯(Gabriel Nicholas)

Contact tracing via smartphones has reached a crucial moment. In early September, Apple and Google announced the release of an app-free COVID-19-tracing program that will alert users when they come into contact with someone infected with the virus. Until now, state public health authorities have released their own contact tracing apps using Apple and Google’s privacy-friendly “exposure notification” technology. Now, the bespoke apps are no longer needed, and this month, millions of iPhones and Androids around the country will ask their owners whether they want to enable exposure notifications. What will Americans answer?

通过智能手机进行联系人跟踪已经到了关键时刻。 9月初，Apple和Google宣布发布了一个无应用程序的COVID-19跟踪程序，该程序将在用户与感染病毒的人接触时向用户发出警报。 到目前为止，各州公共卫生当局已经使用Apple和Google的隐私友好型“曝光通知”技术发布了自己的联系人跟踪应用程序。 现在，不再需要定制的应用程序，本月，全国各地数百万的iPhone和Android设备将询问其所有者是否要启用曝光通知。 美国人会回答什么？

Probably a resounding “no.” Despite the huge potential health benefits of smartphone contact tracing — especially if at least 60% of the population participates — many Americans will opt out of exposure notifications because Apple, Google, and the tech industry as a whole have lost our trust. And the only way to rebuild that trust is with new laws.

可能是响亮的“不”。 尽管智能手机联系跟踪具有巨大的潜在健康益处(尤其是如果至少60％的人口参与其中)，但许多美国人仍会选择退出暴露通知，因为苹果，谷歌以及整个科技行业都失去了我们的信任。 重建信任的唯一方法是制定新法律。

When did we become so suspicious of the tech industry? Facebook’s Cambridge Analytica scandal marked a turning point for the sector’s general image, but Apple and Google have done little to improve their own standings. Google has faced countless privacy controversies over the years, from scanning emails, to tracking children through education products, to a whole litany of shady dealings within their digital advertising empire. While Apple has long made lofty claims about privacy (with CEO Tim Cook going so far as to call privacy “a fundamental human right”) and has built many privacy and security protections into the iPhone, Apple has still permitted and profited from letting some of the biggest privacy offenders run rampant on the App Store. The broader sector faces similar levels of public distrust — according to the 2020 Edelman Trust Barometer, trust in tech sunk to new lows this year, and it experienced a sharper drop than any other industry.

我们什么时候对科技行业如此怀疑？ Facebook的Cambridge Analytica丑闻标志着该行业整体形象的转折点，但是Apple和Google并没有采取任何措施来提高自己的地位。 多年来，Google面临着无数的隐私权争议，从扫描电子邮件到通过教育产品跟踪儿童，再到其数字广告帝国中的一系列阴暗交易。 尽管苹果长期以来一直对隐私提出崇高的主张(首席执行官蒂姆·库克甚至称隐私为“一项基本人权”)，并且在iPhone中内置了许多隐私和安全保护措施，但苹果仍然允许并从中获利。最大的隐私犯在App Store上猖ramp。 更广泛的行业面临着类似的公众不信任感-根据2020年Edelman信任晴雨表，对技术的信任度今年跌至新低，并且比任何其他行业的下降幅度都更大。

Nevertheless, exposure notifications are an impressively privacy-friendly and trustworthy technology. The system uses Bluetooth to approximate the distance between users, meaning health authorities cannot collect, let alone track, a user’s actual location as they can with GPS. The exposure notification system also doesn’t collect or transmit personally identifiable information and uses cryptographically secured temporary identifiers to make sure it can’t be taken advantage of by hackers or data thirsty advertisers.

但是，曝光通知是一种令人印象深刻的隐私友好和可信赖的技术。 该系统使用蓝牙估算用户之间的距离，这意味着卫生当局无法像使用GPS一样收集用户的实际位置，更不用说跟踪用户的实际位置了。 暴露通知系统也不会收集或传输个人身份信息，而是使用受密码保护的临时标识符来确保不会被黑客或渴求数据的广告商利用。

Despite these precautions, the weak adoption of existing American contact tracing apps — many of which do not yet use exposure notifications — are a sign of the trouble to come. Open up Care19, North Dakota’s official COVID-19 tracking app, and you will see only a few dozen North Dakotans using it at any given time. Rhode Island’s CRUSH COVID RI app is faring only a little better, with around 82,000 downloads (8% of the population). Utah’s Happy Together app, which has so far cost the state over $4 million, has been downloaded by just 2% of Utahns. If usual app adoption trends hold, only a fraction of people who download these apps will ever open them, not to mention keep them running in the background.

尽管采取了这些预防措施，但现有的美国联系人跟踪应用程序的采用率不高(其中许多尚未使用暴露通知)，这预示着麻烦将会来临。 打开北达科他州官方的COVID-19跟踪应用程序Care19，在任何给定时间，您只会看到几十个北达科他州人使用它。 罗德岛(Rhode Island)的CRUSH COVID RI应用程序的运行情况稍好一点，下载量约为82,000(占总人口的8％)。 犹他州的Happy Together应用程序迄今已使该州花费了超过400万美元，但仅有2％的犹他州人下载了该应用程序。 如果保持通常的应用采用趋势，那么只有很少一部分下载这些应用的人会打开它们，更不用说让它们在后台运行。

Apple and Google, with their unparalleled reach and technical expertise, had a chance to build something far more effective, but they were hamstrung in their engineering efforts by a shadow of public distrust. Their greatest hindrance was being limited to using only privacy-friendly Bluetooth signals. Bluetooth is not designed to measure the distance between two people — it is designed to keep devices connected, like speakers to a phone. Google admits in its developer documentation that a Bluetooth signal can be “misleading” for measuring proximity since the signal can be blocked by clothes, bodies, and walls. Exposure notifications would be much more effective if it could use other signals, such as GPS and Wi-Fi, but the public does not trust Apple and Google to collect that information — even though both companies already have access to a colossal amount of data through their ubiquitous apps and mobile operating systems.

苹果和谷歌凭借其无与伦比的影响力和技术专长，有机会打造出更为有效的产品，但由于公众的不信任，他们的工程工作受到了阻碍。 他们的最大障碍是只能使用对隐私友好的蓝牙信号。 蓝牙并非旨在衡量两个人之间的距离，而是旨在保持设备(例如扬声器与手机)的连接。 Google在其开发人员文档中承认，蓝牙信号可能会“误导”测量距离，因为该信号可能会被衣服，身体和墙壁阻挡。 如果曝光通知可以使用GPS和Wi-Fi等其他信号，则通知会更加有效，但是公众并不信任Apple和Google收集这些信息-即使两家公司已经可以通过这些方式访问大量数据他们无所不在的应用程序和移动操作系统。

We may never be able to fully trust tech companies, or for that matter any company, to have our best interests at heart. But the right federal privacy regulation could go a long way to ease our concerns. The Senate already has made a weak attempt at this with a recently announced Exposure Notification Privacy Act, but the bipartisan bill is far too specific to the case of contact tracing to meaningfully change how Americans see tech companies. Even laws such as the California Consumer Protection Act and Europe’s General Data Protection Regulation are more focused on giving people rights over their data than building trust.

我们可能永远无法完全信任科技公司，或者就此而言，任何公司都不能将我们的最大利益放在心上。 但是，正确的联邦隐私法规可以大大缓解我们的担忧。 参议院已经通过最近宣布的《暴露通知隐私法》对此做出了微弱的尝试，但是两党法案对于接触者追踪的案头过于具体，以至于无法有效改变美国人对科技公司的看法。 甚至诸如《加州消费者保护法》和《欧洲通用数据保护条例》之类的法律也更着重于赋予人们对其数据的权利，而不是建立信任。

Trust is inherently about vulnerability, and to make ourselves vulnerable to tech companies, we need to know that they will act in our best interests. To this end, legal scholar Jack Balkin recommends the law treat tech companies as “information fiduciaries.” A fiduciary is an entity that is legally required to put a client’s interests before its own. A doctor has a fiduciary duty to her patient to provide the best possible care; a stockbroker has a fiduciary duty to her investor to accurately portray how risky an asset might be. For the American public to trust tech companies with something as sensitive as contact tracing, we need not just technical protections, but also new legal guarantees that they will not use their unique power to do us unique harm.

信任本质上与脆弱性有关，为了使自己容易受到科技公司的攻击，我们需要知道它们会为我们的最大利益而行动。 为此，法律学者杰克·巴尔金(Jack Balkin)建议法律将高科技公司视为“信息信托人”。 受托人是法律上要求将客户的利益置于其自身之上的实体。 医生对她的病人负有信托责任，以提供尽可能最好的护理。 证券经纪人对她的投资者负有信托责任，以准确地描述资产可能有多高的风险。 为了使美国公众信任技术公司，例如联系跟踪，我们不仅需要技术保护，还需要新的法律保证，即他们不会利用自己的独特能力来给我们带来独特的伤害。

As we head into an uncertain political and ecological future, we will likely face new once-in-a-generation crises, and once again, the tech sector may have an important role to play in our response. But these companies’ technical skills and vast infrastructure will not be enough if the public doesn’t trust them. A fiduciary duty won’t solve all of tech’s problems, just as the tech sector won’t solve all of the world’s problems. But the sooner we can enact laws to make them worthy of our trust, the better.

当我们进入不确定的政治和生态未来时，我们很可能将面临新的世代相传的危机，而科技行业可能再次在我们的应对中发挥重要作用。 但是，如果公众不信任它们，这些公司的技术技能和庞大的基础设施将是不够的。 信托责任不能解决所有技术问题，就像科技行业不能解决世界所有问题一样。 但是，我们越早制定法律使它们值得我们信任就越好。

Gabriel Nicholas (@GabeNicholas) is a tech policy researcher at the NYU School of Law’s Information Law Institute and the NYU Center for Cybersecurity. He is also a fellow at the Engelberg Center on Innovation Law & Policy.

加布里埃尔·尼古拉斯(@GabeNicholas)是纽约大学法学院信息法研究所和纽约大学网络安全中心的技术政策研究人员。 他还是英格堡创新法律与政策中心的研究员。