New post-Covid Bluetooth Signals

brianhere

First of all a short recap on what we mean by Bluetooth. In order to replace physical wires, in the late 80s/90s it was thought convenient to communicate between electronic devices using a wireless protocol, and so then such a protocol was developed in the Ericsson company in Sweden and became effectively the world standard for such short range communication. It uses 2.4 GHz radio frequencies and is familiar with most computer users as a short range system for things like headphones, car mobile hands free systems, watches that feed off a main mobile phone, etc, and is now built into many of the chips used in a vast array of electronic devices.

That is classic Bluetooth, as it were, but in December 2009 for Bluetooth version 4.0 they expanded their protocol to encompass a completely different system originally developed by Nokia. In this you have a 'central' computer - say your mobile - reading data transmitted as 'advertisements' from a 'peripheral' beacon, which is a low energy transmitter of data. The 'beacon' could be very small and could last a long time even on a small battery because the protocol only involves transmitting a few bytes of data periodically. In particular it transmits at least its UUID number, possibly the brand and model of the device, and the strength of the signal as received 1 metre from the device (txPower) (this is then used in combination with the strength of the signal as received by the central computer (RSSI) to give an approximate distance from the two devices).

This is called Bluetooth Low Energy (BLE) and could involve much longer distances than regular Bluetooth (750 metres was mentioned as a possibility, but of course it all depends on the power of the transmitter) and was flavour of the month in computer networks for a few years after it came out. Soon big tech rolled in with their own subsets of the general protocol, including Apple who brought out iBeacon in 2013, and Google who developed Eddystone in 2015. And after that it mostly went away, with both companies above closing down or limiting their offerings in this field. Until now, with Covid.

The protocols and stacks developed by Apple and Android to assist contact tracing, and then used by national health authorities in their various apps, is this resurrected Bluetooth Low Energy system. So hence an Apple device say, will now broadcast (possibly constantly, or maybe only when the screen is lit) this low energy beacon which can be picked up by a neighbouring mobile which can then record that UUID and hence if the owner of the Apple mobile was later deemed Covid positive they have a list of other mobiles that he/she was in contact with i.e. the UUID numbers transmitted by the Low Energy system. (Incidentally these UUID numbers are considered unique because they are random numbers generated from a gigantic set of possible numbers, not because they are ticked off in some central database. Also sometimes the numbers have a relationship with MAC addresses - the MAC address being part of the larger UUID number -, which are in a central database, and hence can be unique that way. This Mac concatenation does not seem to be true of these Covid UUIDs though, because Apple etc change the numbers every 10-20 minutes, in order to prevent tracking of the mobiles.)

So ok, what does all that mean and why should we be concerned? Because now virtually every electronic device you have seems to be broadcasting these signals and yes you can be tracked by them. As an experiment try and download the nRF Connect app from Nordic Semiconductor on Android (and the company also have an iPhone app), go to some public place watching people come and go and marvel at the details you can pick up about them. Apple and Garmin watches, dashcams, smart TVs, Windows 10 computers and obviously mobile phones will pop in and out of your screen to an extraordinary degree.

Covid has demolished privacy it seems!

This thread was not welcome in Current Affairs/IMHO so I post here instead, and replying to some comments by banie01:

"Do you have the same concerns regarding your phone's WiFi, GPS and Mobile connection? All over the same degree of traceability, albeit at a higher power drain."

But this isn't like your other examples, in the latter case you can give away your position inadvertently, and generally can only be picked up by specialist equipment. These new BLE beacons are homing signals sent out from your equipment to deliberately show your location to the world, and generally without your knowledge or consent.

"Using it in that manner is a choice, if one wishes to disable the exposure notifications? Just disable it, either in the app or via just switching it off."

I am quite technically minded - programming a GPS app on the android platform myself for example - but I cannot turnoff these bluetooth beacon signals on my mothers mobile iphone for example. (Fiddling with the bluetooth settings makes no difference, and she does not run a Covid tracking app anymore.) You should try that and see how easy it is to track friends/relatives and ask them whether they know it is being broadcast like this, and also ask them if they can stop it.

KildareP

Deleting the app is not enough, you need to go to Settings - Exposure Notifications - Turn off Exposure Notifications on an iPhone.

Blaming Covid for diminishing privacy is really stretching the realms of reason though...

BLE was already extensively in use prior to Covid along with other techniques such as profiling WiFi networks in a given area then your phone cross checking against which of those networks it can see at any given time.

robinph

Far easier to track people just by their mobile phone connection to whichever telecoms mast they are connected to at the time. The infrastructure is already there, and its already being used for that purpose and has a significantly greater range than anything Bluetooth.

Bluetooth is only going to be picked up over a few meters distance. It isn't even strong enough to track you moving around your own house unless you were to setup a tracking device in every room of your house. Why are you concerned about Bluetooth being used for tracking people in public places?

CCTV cameras and mobile phones can already do a way better job to track you. Bluetooth would be a stupid way to try and track people.

brianhere

No robinph, you are mixing up Classic Bluetooth with this newer Bluetooth Low Energy. There is talk of it tracking over 750 metres, as you can read above.

I went for a walk in the woods some time ago and could track people approaching before I could see or hear them, and then could track them as they passed for about 1 or 200 metres as long as they remained in line of sight. Its amazing how easy it is track people, and it is indeed in these devices mostly - not exclusively, there was some use of it before - turned on during these Covid times, not before.

robinph

https://www.boards.ie/discussion/comment/118017979#Comment_118017979

So under very rare circumstances, with the perfect environmental conditions, nobody moving and a great line of sight you can pick up another Bluetooth signal briefly in the middle of a field over 100m plus.

Why would anyone bother when the phone is already being tracked via its network connection? Bluetooth is not a sensible technology to use for tracking anything.

robinph

What exactly is it that you think can be tracked usefully via Bluetooth?

You would just have a list of random devices who happened to pass you within a few meters. Potentially useful for detection of crowds through an enclosed environment like a shopping centre, if you were to setup thousands of devices to pick up the Bluetooth signals around the centre.

Outside your not gaining anything useful though, certainly not learning anything about who it was who passed by your Bluetooth monitor. You'll pick up that someone wearing a Garmin or Fitbit went passed, but not who. If you want that information then just go look on Strava and far more information about who they are and where they came from and were going to is already available.

Far more information about people's movements is available via Google already, and there was a lot of information based on that data which was shown during the UK government covid briefings when they still happened. Not anything gained via any Bluetooth tracking though.

You'll learn nothing new or interesting about people from Bluetooth and its a massive effort to even get that as the range is so short that you'd need massive investment in new infrastructure to monitor people's movements when it can already be done in far more detail and far easier with existing technologies.

ybcby

People who post stuff like this alomst always get their information from Facebook, which is known so well for its privacy. Also, unironically saying "Big tech"? wow.

brianhere

I got none of this information from facebook, its my own observation.