 Sorry, because I was just trying to get my kit away. What order did we agree on, Max? We agree, Magdalene agrees on what you proposed. So you will be the third and last speaker. So you both speak around 10 minutes. And then you can, if you want to react to each other. And meanwhile, I collect questions from the audience and then we'll pause them to you. We mute our mics if we don't speak. Is that also a good idea? We mute our mics if we don't speak. Yeah, yeah, that's a great idea. So, I see we are live. So, welcome everybody to the seventh session of the Green Post-Corner Talks, organized by the Green Grouping Foundation. I'm Duke Hollermanns, co-president of the foundation and your host today. And as we learned during the previous sessions, a lot of people are following us all over Europe, so this is great. You can follow this live stream on Facebook without having an account. And you can also ask questions using Twitter. And having said this, we are aware of the paradox of using the Facebook live stream precisely to discuss data protection and privacy issues. So as foundation, we are exploring to using other and better platforms for this. And in this already seventh edition, we will discuss the different dimensions of COVID-19 contact tracing apps. As you know, something that these apps will allow us to end the fastest way the corona crisis, so we can regain our freedom to move and meet other people. For instance, according to researchers of the Oxford University, we can stop the epidemic if around 60% of the whole population uses the app and adheres to the app's week-moment date. On the other hand, there are quite some worries on how these apps can bring the surveillance state closer and strengthen surveillance capitalism. And in this slide, for instance, wouldn't it be necessary to impose privacy by design? So you see a whole bunch of issues and we have three inspiring speakers today with us. First, I will give the floor to Ceda Gurses. She is a privacy researcher at Delft University of Technology and affiliated with the Ka'u-Leuven University of Belgium. Second, we have Maglène Stieker, managing director and founder of WAG, Technology and Society, a Dutch foundation operating at the intersection of science, technology and the arts. Third, we have Laugasofi Dogenheim. She is an information management specialist, member of the Greensberlin and speaker of the state-working group of the Berlin Greens for Internet Policy. The all three will speak around 10 minutes. Meanwhile, please already put your questions in the chatroom and it will also be very nice if you just write down from which country or city you are and then we get a glimpse of how big this European audience is. Having said this, I'm happy now to first give the floor to Ceda. Thank you, Dirk. And thanks to all of you and your colleagues who have made this meeting possible, even if it's on Facebook. And it's a great pleasure to be here together with Marlene and Laura. And I'm going to speak as not just as a member of the DP3T project, but also as somebody who has been working on whether we can do privacy by design or engineer privacy protections into technology. And my research over the last 10 years has shown that this is very, very difficult due to what I would like to coin as developments in computational infrastructures. And before I go into setting the scene that way, what are these computational infrastructures? I just want to say two things that are I think really important in this debate. One is that I think we're being the suggestion is that the only possibility is to have full on lockdown or surveillance. And I think we should be very careful, both as academics and also civil society to break that dichotomy because I think there are many possibilities in between that we maybe are not exploring enough. And second, I think any conversation around contact tracing has to go hand in hand with testing. And I'm hearing very little about testing. And what we've also seen in some other countries like South Korea, there is a great importance also historically what we know from other epidemics like HIV AIDS for having anonymous testing and I see no conversation about this. So I just want to use my privilege as being the first speaker to say, let's push back on false dichotomies of either lockdown or surveillance and also let's make sure that whatever contact tracing efforts are out there that they're together with is a kind of comprehensive health effort that includes clear numbers and guarantees on testing and if possible anonymous testing. So coming back to computational infrastructures I just want to set up the scene so that we're not just talking about a project but clarifying what is the setting in which this project came to be. So with computational infrastructures I refer to three things. First of all is the computational facilities that are predominantly made up of cloud services. This is an architecture that has come into being especially in the last 12 to 20 years and that is in the hands of a few players like Amazon, Microsoft, Google and then some smaller players like IBM and Salesforce. The second part of a computational infrastructures are the billions of mobile phones, smartphones and sensor networks that are predominantly controlled by Google and Apple and that are running on internet and telecommunications networks that are now being expanded into 5G. And the third is that computational infrastructures are not just physical or material networks and things but they're also made possible through culture and practices and financial structures around the development and maintenance of these infrastructures. So I'm referring to anything from development methodologies like agile and scrum, start-up models based on disruption and unbundling of institutions and all of that held together with practices and open source and open standards and financed through different forms of investment structures, often global investment structures. So these infrastructures have not only concentrated computation power in the sense of clouds and computation but they also have what I would like to call pocket power and that's going to be very relevant for the contact tracing apps which means that even if governments and institutions may want to limit how we use computational infrastructures or intervene in how they're produced or used they may not be able to do so as long as these companies can push their own agendas or technical designs, for example, through our phones and into our pockets. And even if, for example, governments and institutions shy away from computational infrastructures, for example, in the case of Uber and Airbnb and maybe even Zoom, these companies can still enter the stage by virtue of people buying phones, installing apps or simply using basic computational structures like email. So the reason I'm expanding on this very academic sounding thing is because we now live in a society, we live in societies which are affected by the sort of political and economic power which is, I think, evident in the contact tracing apps story. So when the governments said they would like to have contact tracing apps what they did is, in a sense, summon this computational infrastructure as part of how they govern the situation with COVID-19. So by saying apps they did not commit themselves to any digital solution because apps run on phones and phones are predominantly run by Google and Apple they committed themselves exactly to this computational infrastructure which means the many phones in our pockets so they committed themselves not to the computation only but to the pocket power that I was talking about earlier. I hope that I do not have to explain that next to many advantages that our phones in this computation brings to us, these infrastructures also rely heavily on surveillance, manipulation and these companies have amassed great powers in the hands of a few big tech companies over the last years. So when governments said apps for contact tracing civil society and advocates questioned this and I think rightfully so but what we saw is that the drive for technical solutions trumped the need for democratic reflection under the pressure to get things done and to come out of lockdowns and to control the economic to manage the economic concerns around the lockdowns also and maybe less so the political concerns. So I would like to suggest that DP3T is a project that responds to this condition. So it's not just a technical proposal let's make an app but it's a project that feels like it had to respond to this problematic exercise of infrastructural power under the leadership of governments. So in this sense if I would list like what are the aims and these are the intended aims and I hope we discuss whether these aims are reached or not of the DP3T project first is to respond to the data grab that has been happening since the beginning of COVID-19 where governments introduced not only apps but also committed to introducing new databases or connecting existing databases that they have for example connecting location data with health data and financial data and subjecting this messy and often unreliable data to use of machine learning and AI for the management of health populations and economics. DP3T as a project and for those who don't know that's the decentralized privacy preserving proximity tracing system that is being developed by a bunch of scholars most of them in Switzerland but more internationally than that. So it was a kind of response to say we don't need to do this data grab right we don't need all this data this data is messy it's not reliable for anything scientific and we can minimize it to give to governments the ability to make their contact tracing more effective without enabling this data grab that is going on. So in that sense it was a response to show that a privacy preserving alternative is possible data grab is unnecessary unlikely to be successful undesirable if not unethical okay so that's number one. Number two is the focus of DP3T on privacy preservation. The privacy preservation insists that data minimization and purpose limitation which are two main principles of the GDPR can be instantiated using privacy engineering methods so in a sense I mean I guess like one thing that's happening is because we now have this computational infrastructural power it becomes like it becomes more difficult to be pushed away as just making a scare I'm scared of surveillance argument by making a prototype that is privacy preserving yeah so basically it's another way of doing politics where engineered artifacts and infrastructure start to rule politically so this we can discuss if it's the right way or not but I think this is partially what happened so when contact tracings apps were proposed what basically governments proposed was to take a health measure and turn it into a social engineering problem that can be optimized right so what they said is we can measure how close we are in social situations and in physical spaces using Bluetooth and then use this data to see if somebody has been exposed to COVID-19 however this data has a lot of consequences it's not just interesting for COVID-19 and if you put it on a computational infrastructure that usually makes money off of this kind of data so what are some of the concerns well obviously you can reveal your social graph which means anybody who you are close in close proximity with which allows governments to track forms of organizing socializing and working in addition to classical you know being able to track people you can now see what kind of social constellations they find themselves in but in addition to these surveillance classical surveillance concerns having that can be used to produce new forms of population and behavioral management for example you can now rank the population not based on something like reputation scores which we saw in Uber or Amazon where you can give stars to the service you created you maybe have just used but you can now create a ranking of risks around people based on which kind of social situations they find themselves in whether they keep the right distance and you can you know subject populations to as a result of this discrimination stigmatization which I think might come with the pandemic and just kind of legitimizing forms of metricized control that are probably very undesirable in our societies so the focus on privacy was to show that it is not desirable and not necessary to build us up in a way that would allow a market of social graphs and to be used for population control but it's also in that sense a pushback against companies like Google and Apple who have every incentive to jump on this opportunity to measure manage optimize the way we socialize and the way we move so we can discuss whether this can be done only technically or otherwise but I would say VP3T is also a pushback against this new expansion of surveillance possibilities based on social risk and finally actually two more so one of the things that VP3T did it was originally part of a consortium which was behind closed doors is it took its design to the public while most other contact tracing app projects at the time were basically being contracted and designed behind closed doors to know what kind of agreements were made and what kind of designs were being developed the same holds still for most of the back end proposals run by McKinsey or Palantir VP3T decided against this and went online and to GitHub to make their design and aims visible so this way all of a sudden we could all see of course you know what GitHub is and can read PDFs with lots of technicalities but it opened to public discussion the design of contact tracing apps therefore VP3T was an invitation to a broader public to engage in the debate around contact tracing apps and consider where such an app is needed desirable how it should be designed etc finally VP3T is interfacing with parties who are developing the app so in some countries it's a green line given to the development of the apps so this is the case already in Switzerland, Estonia and Austria there are efforts also in the Netherlands whether it's a green light or not we can discuss but what is important to note is that VP3T itself does not develop the app it's a project mainly made of developers who came up with the designs and opened it for discussion looking to show the feasibility of a privacy preserving app etc and then reiterating on that design but it does also interface with efforts to develop the app in different countries and it also participates in efforts to create interoperability between countries so here the vision is that we can do contact tracing across borders so that if they introduce privacy preserving contact tracing apps that even if you cross a border you don't have to now give your data to another party but that some interoperability is possible and so in doing so what VP3T does is ensure that if there are contact tracing apps that these are apps and I know this is going to sound a little technical and not pushed into the operating system as Google and Apple said they would like to do in Phase 2 of their proposal of an API the difference is that do you have to install an app that does most of the contact tracing functionality with the Bluetooth capabilities and APIs as produced by Google or Apple or does every phone that you buy that has iOS or Android on it come automatically with contact tracing potentially just a little possibility to turn it on and off which means that not countries deciding whether they want to have the app but Google and Apple disseminate this functionality and you might just need an app after you receive a notification that you're at risk and then get the results and exchange data so the interoperability efforts of VP3T I would say is not only there to make sure that you can cross borders and still do contact tracing but to make sure that the apps are in the hands of health authorities and to ensure that people can organize oversight mechanisms rather than being completely dependent on the whims of Google and Apple and their computational infrastructures so I will stop there, thank you this very informative introduction also putting the context there within apps can, should be used and how they can be developed I now give the floor to my main sticker for persons who don't know her I think she was one of the first of people in Europe working on questions like how to make the new technology fair, emancipatory and open for everybody so Arlene, I'm very happy you are with us and I give you the floor thank you so much and very interesting also to listen to the former speaker about all the things that are already happening in Europe to counter some of the effects of this disparate idea that Apple save us from Corona I think this is where it all started also in the Netherlands a minister telling us that there will be an app and that we need this app to go from an intelligent lockdown to a more open society and I think this is already very interesting that it starts as that technology will save us it's being brought to us as we can't trust this technology we can't trust each other, we can't trust ourselves so we have to have autonomous technology that will inform us and how you don't have to know this will just happen so in the Netherlands within a day or so we got a coalition of privacy organizations civil rights organizations organizations like the WAG, individual people and we set up 10 criteria which we called Veilig tegen Corona save against Corona, I can put a link in the chat of Twitter later on and interesting enough the ministry reached out to us and asked can we use this criteria because they didn't have any of themselves so it was quite interesting that civil society came with the criteria for these technologies but the first very important criteria was where are we optimizing for so can anybody explain us for which scenario this technology's app will have to work and I think until a week or so ago there was no real answer, something like we have to support contact tracing but there was no real scenario, there was not a scenario in which you would have the consequences for testing for which groups, there was no idea about how this process of contact tracing actually is and the people that are doing contact tracing were not involved in the project until very recently so it definitely was an idea and I think it was sort of like a push for politicians to show us that they know what to do, that we have a way out so like big muscles, technology muscles and a lot of people start to believe that because everybody wants to to have a, to get out of it there was an interesting moment when we were asked to ask the coalition to participate in a selection of the market consultation that they already started which was quite interesting that the Netherlands chose for an open consultation and the days after was quite exceptional that they were openly questioned in video conferencing, the epitome as it was called and that they had to reveal their source code and it was a group for an L they had a channel where around people were checking the code of the eight proposals that were selected that part of the process was quite exceptional and I would really love to see that we keep to this kind of open challenging the companies and the startups that come up with sort of their bright ideas because it revealed a lot about that they were not ready, that they had no clue where they were actually working for what kind of scenario they were working for and definitely were not the right answers on privacy by design, data manualization centralized or decentralized data storage so around that time the difficult decision for us was are we going to join this process or are we going to stay out and so as a coalition we said we are not going to join but on individual terms people can join this process to understand better what is happening in this process and I think that has been a good decision so that we were able to keep our cards on closed for how we would judge the process but also had a lot of inside information and I want to step into I think it starts with the idea that we don't know where we are optimizing for and I think we still don't have the answer to that for what kind of process, what kind of behavior are we want to foster is it that you just go out and you don't take any responsibility for your actions anymore because that will trace and track or do we want to have intelligent behavior so that we are conscious about our behavior and I think at the same time that everybody was talking about the apps the Prime Minister of New Zealand asked people maybe you should write a little diary what you did that day which is quite interesting because that would be a reflection on your own actions a reflection on your own behavior so when you ask people to write either in a digital or on paper to reflect on who did they meet you have a learning you have a societal intelligence that you are developing whereas if you put this technology in place you don't develop any social intelligence you just let the technology work on it so these kind of questions are really basically always denied and ignored before you start to think how to resolve the issue to have more freedom of action more social interaction in a situation where are we in a really difficult problem we always face is that it's always either or either you go out of the lockdown and you will be healthy or you keep your privacy so it's always been presented as an autonomy as something as oppositions and I'm really happy that the consortium said it just talks about the DP3T took up the challenge to show that you can do privacy decentralization, decentralize data storage in the protocol and that you can preserve privacy even if you use Bluetooth so I think there was this beautiful I thought really funny but maybe for the people that were involved also funny dispute between two protocols the PEPPT and the DP3T which in a way was also two different visions on technology, two different ideologies what kind of protocol, what kind of law what kind of if then you would put into the technology so it really also revealed that technology is not neutral so there's not one way to implement technology it depends what your mission is and also if you want to have a centralized data storage you have an interest in that you will choose for a protocol which enables that but when you want to preserve privacy you will go for a distributed or decentralized data storage these are really essential choices and I think these are political choices so it also revealed that if you want to make if you want to put politics in technology you have something to choose for this is not just neutral discussion so I'm really happy that in the end also I think the Netherlands and most of the PEPPT basically I'm not sure in all the details how it works out but I'm really happy that we are away from this centralized data storage version but now I think we come to the real question is Bluetooth going to be precise enough is it a technology that's really going to work and as far as we know now it won't be precise enough and I think it will have a lot of false positives it will give us false idea about being safe and from whatever angle you look at it these apps are not going to work and that doesn't mean that people will pursue these apps so this is the difficult situation that we're in because it's being seen as something innovative it will save us, it will help us it will be an easy way out for politicians so they can say well they will help us we don't have to think more in more complex social structures than just install the app and we will be ok and then we also have to touch of course on the position of Google and Apple they know that Bluetooth won't work because at the moment you will have it's not good for the safety of your battery on different parts of your body it will give different signals you don't know what the context is, if you're outside or inside so the false positive that will occur from the app will be an overload for the people that have to do the follow up for contact tracing or people that want to be tested so I think it's also a liability that will be very difficult to handle and Google and Apple tell us now well we can be more precise because we will build it into the hardware, into the operating system and I think I'm really happy that I think five countries now jointly said we don't want you to do that we don't want you to make this a standard option build in all our phones and all our devices this is something that we want to choose for ourselves well and I think this is really re-feeling how dependent we are in Europe on this kind of Silicon Valley big tech guys and we have no real position towards them to negotiate and we're working on this whole concept of public stack the stack of technologies that we need to have democratic values and public values inside of the technology not just in applications and not just in our data strategy but also in the hardware and Europe at the moment doesn't have a real hardware industry anymore so if we want to if we think the internet and the technologies and we want to have public values inside we have to be as precise as the DP3T consortium is in bringing this kind of values inside of the technology itself but also we have to rethink our dependencies and have to build up the next generation internet from a European perspective on our own terms this will open up a lot of new possibilities actually for a lot of intelligent actors in Europe but it's also a big challenge but I think we can't just continue being dependent on the big tech industry that we have now and I think also the Corona app reveals that in a very good way okay, thank you very much for explaining us the not only the situation in the Netherlands but all different questions really we have to discuss in the public debate and I think the baseline is of course also is for other technologies, technology is never neutral so what kind of values do you build in it I'm very happy now to give the floor to the third speaker Lagersofie Dornheim Thank you Dirk I want to hopefully quickly cover the themes, first of all of course I want to acknowledge and maybe already reply a little bit to what Seda and Malin said and I think both of their statements were absolutely excellent then I want to look a little bit at the requirements and the context such an app should exist because at least in Germany it will be coming for sure or many other European countries too and then lastly I want to step a little back on the meta level which we already also touched on like how this process came along and what happened on the political stage because I really think this is an extremely interesting example and we have to learn a lot about that or from that for future discussions in terms of technology public and politically so yeah first of all of course I'm also extremely happy that DP3T sort of like one in that discussion or in that discourse when PPT started first and Malin is absolutely right there were very different mindsets behind that who were driving that I'm also really glad that we now settled on a decentralized data storage approach on that they really took the matters of privacy very very seriously in Germany our Minister of Health had fantasies what else you could do with that app and like to scram it with functionality that reminding a lot of us on state surveillance so that's at least from now off the table so I think the app that we will be getting the tracing app in Germany will be as safe and as privacy-protecting as we can which still doesn't say that it actually works but that's not a question Malin you brought up the I'm not sure if I'm going to talk or in the announcement the term of techno-solutionism and I think that's a really interesting term and train of thought because I absolutely agree with you initially there was a lot of like actionism driving this thing I loved your picture of the digital muscles because of course all of our politicians initially were overwhelmed I think as all of us were and there is no quick fix no easy solution for global pandemic so jumping to like let's build an app for that was very appealing to them because also people don't like politicians that do nothing so by like showing this like master plan for an app at least they could do something I still wouldn't say that the idea of an app is all bad not at all I'm still very much looking forward and I will install the app myself and I explained it to my mother in great detail why she should but whenever I talk about the app I always it's kind of like became my mantra saying like an app is not a vaccination it will not heal anyone it will at best prevent new infections a few of them also not all of them but a few so I think the really big challenge here is to find that middle ground to not like over promise I think that was also a little bit too yeah too much marketing maybe a little bit propaganda by PPT when they said like yeah when we have this app we can get out of lockdown that's irresponsible I think but also the app is a tracing app based on DP3T is not an evil surveillance tool and in the public debate people are it's relatively hard to like that middle ground just one maybe one little side note to the technological side I would be super interested in what Cedas is about that but because Marlene mentioned that Bluetooth won't be precise enough so from what I know how they've been working on calibration I mean we had this little bit ridiculously looking in Germany where they put a lot of soldiers with different Bluetooth devices different phones and they had to position themselves in different instances and had their phones in different angles to try to calibrate that so I would at least be cautiously optimistic that the data is or the matches that are created through a tracing app are robust enough and also from what I know it won't be a like you're infected or you're safe but there is like some graduate grades in between telling people or like urging them to like really get tested as soon as you can or to ask them like okay there's like a low risk so please make extra sure that you're wearing your mask and maybe like think about how many social contacts you're having in the next days and watch yourself closely for any sort of system so it won't be just like either positive or negative the matches but also with some sort of like context to it so like I said at least in Germany we're expecting an app to be available mid of June so in roughly three weeks and I've been thinking a lot about what needs to happen to give this app the chance of success because if it really works like right now everything is theory right so if it really can help us to prevent new infections we can only see in if it's in practice so if we have this app like one of the really really important requirements is that it's voluntary that nobody is forced to use the app like we all notice for us dystopian examples of China where you have to show your status in the app to enter a bus or a restaurant or something like that I don't think anyone wants that for Europe so that's also part of the conversation why we don't want that to be built into the hardware or to like the operating system but to make it an app that you can voluntarily download there cannot be any privileges or any punishment for having or not having the app privacy I think right now is for now I would put a check on that because with the protocol that is used by most European countries I think France is still the biggest country who didn't come to terms and still following that other approach but yeah for most countries we have a decentralized approach and also a centralized approach does not necessarily mean that there are abusing data there's just a bigger risk and it's harder to really have transparency of who has who can access the data but of course if we launch this it has to be embedded in a lot of social practices laws regulation said already mentioned testing of course that's a really big one luckily right now we have sufficient testing capacities we have in Germany even more that we are currently using but it needs to be very clear and very easy for people if they get a notification from their tracing app where they can get tested, how they can get tested I know especially in the early weeks probably everywhere it was pretty chaotic and it was sometimes hard for people with symptoms to get tested so there needs to be a very clear path how you get tested and that's covered by insurance and all these things and of course this app shouldn't and I think it won't just give you a message like you're infected that is really bad technology so it needs to be very very cautiously designed so people take it serious because of course a notification from an app is anonymous that's how it's supposed to be but people have a different reaction to an app telling you like you've been in contact with another person who has an app who now is infected then if I get a message from a friend saying like we had coffee yesterday unfortunately now I'm really sick so please get tested that has a very different sense of urgency so an app needs to do the extra work of creating the same sense of urgency but also not completely disturbing people and that means that there also needs to be enough support so that there is either a hotline or it's very obvious for you who is your next person of contact if you have any questions or any notifications then what happens if you get a notification that you have been at risk and might be infected so does that mean then that you get paid leave that you can get an official sick note because if that app urges you to maybe self-quarantine and get tested especially for people in precarious jobs they might just ignore that because they are fearing more their fear of losing a job is bigger than their fear of being infected so we need to have very clear policies on that what absolutely cannot happen is that the status of if you have been tested that the status is visible in your app or that's somehow shareable because then you create that sort of like immunity that can only be used to privilege or punish or discriminate against people and that's for me really dark scenario like sorting people into like you're clear and you're not I absolutely do not want that so that's how you should be supported when you use the app by policies and by society which also shows that this app is not a standalone solution it can only ever be one tool in an overall strategy to fight spread of this pandemic then of course this question what do you do with people who don't have a smartphone I know I actually talked to Christian Bo for a short time the hero of he and I think now he is somehow disappeared but from him I learned that there's already talks or word talks I'm not sure if that's still up to date that the word talks with manufacturers of like Bluetooth bracelets or like key fobs so that you can give like older people that don't own a smartphone or people that can't afford new technology that you allow them to participate in this Bluetooth based tracing by giving them like such tokens at least in Germany I don't know as of now that there is a plan to distribute such tokens but I think this would be an important offer at least to really be inclusive and then of course the most important factor to make such an app work is that people trust in it we heard now and I think the numbers everywhere that we need about 60% of adoption rate for such a tracing app to have an effect probably all of you know I'm just saying it again that's about the adoption rate of what's the number one used app in Germany and I guess also in most other European countries so that is a really really high number of course that doesn't mean that we have to have the 60% adoption rate all over Europe like if in places like Paris or Berlin a huge share of the population have the app that can already help and a little side note but I think especially in big cities a tracing app can be extremely beneficial because if you take the subway again you just simply even if you have a diary you don't know who these people are that are sitting in the same wagon with you so an app can be way more efficient there and can probably help when you are in places with more people again coming back to the trust factor can you wrap up so we need transparency I think that we have now and I think this was also really interesting to see how activist groups like Lely mentioned really made a big push here we have an open source app now what I also would like to see is a sunset clause so that at one point this app stops working or will be automatically deleted you should always be able to delete it yourself just like one sentence on how it happened politically I said that initially there was a lot of actionism very obviously then I think for me really the strangest moment was when I realized okay these internet corporations that from a political perspective we always see very critical now are making smarter choices than our own government so that I was puzzled but eventually I think what we saw here is that civil society organizations really made a lot of governments rethink their initial choices which I think is a great is a great win for society and also really strengthens these organizations and yeah like I said initially I think we can learn a lot from how this went down okay thank you very much it's clear that there are so many issues involved in the whole introduction and development of these tracing apps Lara you mentioned a few very important points people should be able to deactivate the app after the pandemic this is voluntary and this of course raises the question on a legal framework so maybe also a question for Marlene and Ceda do you know there is a development in the Netherlands or European level to have a legislation that really makes sure that these apps stay voluntary and you can deactivate them so maybe Marlene you can start on the Netherlands well there is no new framework and there are I think it's now part of it what they call it the hole of an ice so the hole sorry sorry go ahead please but I think this is I'm also very worried a lot of people that are now having entrepreneurs who want to start their business again like restaurants and bars and they also have things they would like to use the app to say yes or no to enter a club for example nightclub that is an actor in this it's also societal actors that can push for the use of the app like this to identify yourself and I don't think there is any legal structure at the moment in place that they can't ask you to show it because I'm not a legal expert so maybe somebody else should answer this question but what a lot of people the term function creep is being used a lot in this context which means that at the moment that this kind of function is inside of our phones other use will be enabled of things that we really didn't meant nobody wants there was no intention to do that so another thing which I just have to think if you don't want to go to your school or to your work just go close to somebody with corona and you have a free right for another 2-3 weeks to not have to attend your work or your school we always tend to think about the positive scenarios what we would like it to happen but there are all kinds of ways that people are going to misuse in different ways for their own reasons because they're entrepreneur because they think it's a good way to do it so I'm really very cautious but because of this function creep okay thanks so maybe this maybe I can quickly say something about because there's a coronavirus safeguards bill that was proposed by among others Lillian Edwards and a bunch of other legal and policy scholars in the UK and in Germany there was a similar effort to come up with a gazettesis and that would basically provide a legal framework specifically for the introduction and the sunsetting of the apps and would also address some of the discriminatory issues but I agree with Marlene let me just stop I believe in Switzerland the parliament is also thinking about what are the basic rules under which these apps can exist how do we evaluate whether they're successful or not I think there are some legal efforts that are going on but that doesn't address some of the normative questions like do we kind of set in these laws and these technologies not being infected as the good norm and how do we maybe push individuals into proving that they are or not infected and what kind of like loss of human rights but also social conditions we experience as a result of that there's certain things that laws cannot really address easily and so I think the legal stuff is not going to be sufficient now the other thing is I think we will probably have to after the wrong word if Google and Apple do push this tracing functionality into the operating system a lot of these legal frameworks which are geared towards an app are going to basically become unfunctional I'm not a legal expert either but it's going to be it's going to require another sort of legal effort from governments be it the EU or member states or other governments to regulate these companies and I don't know given the handshake that's going on between governments and these two companies right now who will have the courage to do that kind of thing and how they will basically manage around market freedoms and the ability of Google and Apple to decide what's in their operating system and a law that would basically say you can't just introduce surveillance infrastructure regardless of whether it's for good or bad globally which would basically break possibilities to have national oversight or legal frameworks Okay, thanks I also want to quickly add to that we see that we do have the power if you look at the GPR we can regulate what digital services you can offer within the European Union so I very much hope that they will be stopped from just putting that on operating system level just quickly to Malin because he just mentioned the possibilities of like using the app to troll like to not go to school or so that is very hard coded within the infrastructure now that you cannot just maliciously report yourself as positive it needs to be verified by a government authority so luckily at least a few people have thought about the ways to abuse such an app and then one one that to me is precisely why I am so against this because this kind of protocols are for who are they optimizing we have normally a society where we can cheat this is our freedom this is I mean we can do wrong stuff we can do we can act asocial and of course we can then be judged that we can be maybe we have to be prosecuted but this is how our democracy functions and when we already in the protocol make it impossible for certain people to act in certain ways then the technology becomes a democracy or a non-democracy but there's a lot of happy that they are all putting this into the protocol but there's a lot of examples where we as a society decide that we want to prevent like easy cheating like just as you can't easily buy a handgun in Europe and there's lots like I just want to give you one anecdote so I'm currently in Bavaria with my parents and Bavaria introduced a law visit like an open space restaurant but you have to give your personal information like phone number or email address even the whole address and sign and at that point and it's all standardized because it's a coronavirus infectious disease you have to report it that's a legal requirement and at that point I would have been much calmer to have the option to have a tracing app instead of like writing my personal information on a piece of paper that already in that moment was visible to like five strange looking security people then I would definitely prefer the app because it does not directly have personal information like I said before there should be an option and of course you can also write false information on that piece of paper but yeah I think I'm already describing how restaurants are going to use the app in a way that it should not be used so you're describing just what is going to happen no I'm describing the middle way I don't want anyone to be forced to use the app I want people to have the option but here right now if I want to go to a restaurant I have to write down my personal information I'm pretty sure if they catch me I will get fined which is very unrealistic so what I say I want people to have the option and then I have three options I can like okay I'll write my personal information on a piece of paper because I don't trust an app or I don't want the app or whatever I can have an app or I could because right now that's not an option or I say like I don't want any of that I'll have my coffee in my own garden okay exceptionally they can say that if you don't want to give this personal information you can't be actively part of society anymore if you have to sit in your own garden it definitely sucks but right now I think this is a dystopia that you're just describing I think it should be I had to write down you don't have to accept it by saying well then we do an app because you're going with the flow towards a dystopian society I can help here a little bit with what the app would do and I think we're seeing some developments here there are different developments that I would like to use the opportunity to refer to this restaurant could install their own app and start collecting information about who's coming in and then they could start using this to kind of demonstrate that a sort of heat map of our restaurant did not have people and things like this so there is no transformation that is really like easily desirable or digestible that will come of this app and or of restaurants writing our phone numbers and maybe also looking at our IDs which would be like terribly intrusive but I think it's really important to remember that there are so to say local intrusions that are possible because you are sharing your Bluetooth with everybody around you even though it's designed to be unlinkable anonymized basically not easily traceable to you but you can imagine that if a restaurant starts checking on their workers or checking on their guests by putting up their own phones they could now start to see oh look some of my workers look like they're around risky they're around people who have been sick so they might have been exposed let me fire them but in some realities we really do not want to have they're really hard to protect technically legally you can make them illegal but really you see how the introduction of this app is likely to completely change the way we socialize to completely change the way we go to work and the relationships that we have there so it's really it's not like oh this is better than that right like I think it's this is something manual contact tracing restaurants asking you for numbers what is acceptable or not what changes that it causes it's a different thing when the app comes in and I think we should not try to argue that one is better than the other I think they both have their problems and we need to think about how we're going to deal with these and how we're going to resist them or how we're going to ask for different solutions I also really want to go back to what Marlene said about optimization one of the most disheartening things that I've seen is officials from governments or related parties asking for example DP3T to be able to optimize the notifications based on how much testing and health capacity they have right and so they're basically saying do not inform contacts of infected people if we do not have enough tests available and I find this bordering on unethical you know the concern is real you don't want to overwhelm your health infrastructure but exactly because you turned contact tracing into an optimization problem now you can have a centralized place from where you control how much notification people get and if you don't have too much testing available or you don't want to invest in that you can basically try to use this app to notify people less so that they don't go testing and then reduce your number so there's a lot of like possibility for abuse in the system and it's going to require us to be very critical regardless of whether it's just the app combined with manual contact tracing or the kind of applications that Laura was talking about okay thank you it's it's a fascinating debate and I'm so happy I have so little work here because the interaction is great we have a question from the audience someone from the Netherlands asking a question about the interoperability of different European tracing apps I think said that you already mentioned France that has for centralized data storage UK could be do the same so how what would this mean for the mobility of people moving between countries I mean I think even for interoperability you're going to have different pushes from different parties exactly as you said there are some governments who are more keen on the centralized solution where you collect basically information that could be relevant to seeing people's social graphs and also identifying these social graphs or being able to track them with some security and privacy assurances but really just in terms of increasing the cost of attacks and then you have decentralized solutions that are often along the lines of DP3T but not only and I think there's a question about which states are going to push which one and are they going to be interoperable and that interoperability has I think two questions one is does it mean that when you cross borders you're going to reveal more information from one side to the other and generally like how are the back ends going to speak with each other and how do you minimize the data collection so that the back ends talking to each other doesn't mean that they all share their information with each other so I think there are lots of questions there which is then also going to bring back this question of what happens if Google and Apple start producing their own back ends and decide how much data is collected and shared and I think we haven't seen that battle yet we're seeing it slowly happen as we speak okay thank you very much we are moving to the end of this webinar it really went very fast this hour so I would invite all three of you if you want to make a closing remark this is the time to do it so Marlene you want to add something yes well I think it's very interesting to have this kind of discussions and what I also think is very interesting I think it's already been mentioned is that people from different backgrounds and different disciplines starting to really have debates and discussions about technology I really think that is marvellous I mean this is what we missed over the last 25 years since the internet that we start to understand that we build a language a shared language that political parties start to understand that they can make a difference in the technology debate so I hope this becomes more important and also in the European context and we have really a lot to learn because if you look at all the discussions in the different countries they all are different and I'm afraid for Poland and Hungary and also in France they have a totally different perspective on how to deal with privacy and sovereignty and so it's I also foresee that it might be difficult to travel through Europe if countries don't respect privacy and if they want you to have specific types of apps before you can enter the country so I think we have not seen the last part of this at the moment and this function creep I really believe we are just at the beginning of it and I'm really afraid we are not very very careful because of all the intentions we go waste this flow and we end up in a dystopian Europe Okay, thanks Laura last reflection In general when talking about policies around technology my aim is always to not just fight dystopia but really develop dystopia which I think there can also be even times of pandemic and I would be at least somewhat optimistic because at least for some states in the European Union the discussion of the tracing app showed that we can push for this dystopian or for at least a human center of technology I absolutely agree with Marlene this was just the beginning and when I hear ideas of blockchain based immunity passes I will fight them to the very last bit of my energy but for now we have a good solution for the tracing apps and I think there is also really let me enter that it's a good solution I'm really looking forward to checking it out when it will be launched in Germany Okay, thank you very much Thank you Seda for you and pushing the decentralized approach Okay, and then Seda you have the last word for reflection Lovely, thank you again thanks for putting this whole thing together and the discussion is really I agree with Marlene that we need to have more of these discussions and it's great that we're having them and I totally agree again that what we're seeing is our political systems our institutions being transformed through the technical infrastructures that we're increasingly dependent on so I think we really need to be very cognizant that this was not just politicians kind of you know, weak moment I want to show that we can do something with tech but there has been an effort from technical companies in order to grow on their return in investment to take over health, to take over education to take over administration and population management, right like these are efforts that we've been seeing happening in the last 20 years and if you look at the it's really crazy to see last quarter's earnings for most of the tech companies who have been going up while we're entering economic slowdown so we're in a very, very peculiar moment where tech companies are benefiting from us being in crisis in a difficult situation and they have immense power over our government so I think this is a great moment to do institutional capacity building to develop tech policy that is not tech centric but to think about the silly like, oh we need to be sovereign so you need to give us everybody's data so we can optimize our populations that is not the goal I think we need to really come up and develop democratic processes for how we're going to engage these computational infrastructures this is not about being for or against technology this is about an infrastructure that already has values that already has financial backing and it already has very much power and brings all of this into our governance systems and I think we need to craft a new politics in that sense it's an exciting, scary an important moment thanks okay thank you very much I think really in one hour we touched on different issues I think it's really not a discussion only about crisis, a pandemic it's also a discussion about the future of our democracy and how we will democratize or the other way around technology will steer our democracy so all three speakers say that Laura, Mayle and many thanks to the people watching if you appreciated this talk you can also make a donation so you can make more of these post-corner talks the coming weeks and months and this was the 7th but not the latest edition so I invite you to watch the website of the Winnipeg Foundation to get more information on the comments sessions and hopefully we see each other next week for the next green post-corner talk have a fine day okay so we are not live anymore updates so I really want to thank