The ugly little truth about the Google/Apple Exposure Notification Framework

Imagine, you are Google/Apple. Also imagine you have invested a metric shitton of effort into building location based services (maps, localized search, device locator,…), so you can weasel location data out of your users, in order to serve them geo targeted and personalized ads. It’s a goldmine as long as you can convince people that you are giving them real value for allegedly worthless pieces of information and no harm comes out of it.

Now there’s this brand new pandemic in town. Clueless and unprepared politicians enter competition mode, searching desperately for (quick&easy^®) solutions, then someone yells: “Hey, I got it, why don’t we just trace contacts by tracking people through their smartphone?”. The suggestion is, of course…

• …an orwellian nightmare.
• …the wet dream of law enforcement / any secret service.
• …already a reality for the average Android / IOS user.

Nevertheless, all heads turn, and a crackpot idea gets promoted to silver bullet.

See the problem here? When the SARS-CoV-2 virus escaped China, there was a serious threat that western lawmakers could have used COVID-19 as a can opener to legally “hack” into Google/Apple datacenters and possibly even mandate implanting governmental code in the mobile OS as well. Needless to say, that would have drawn a lot of unwanted attention, caused people to think twice about frivolously sharing personal data with ad tech companies and maybe stopping them to use smartphones altogether.

So, what is the GAEN API then? I’d say, a distraction. Something that looks like it might work on paper, while it’s actual purpose is to protect a business model from tanking because people suddenly realize that “I have nothing to hide” and “I’m not important enough to be of interest” are both dumbass excuses, carelessly disclosed personal information in the past can result in future imprisonment quarantine, even if innocent healthy.