Google Apple Contact Tracing (GACT): a wolf in sheep's clothes? - <AUTHOR> https://blog.xot.nl/2020/04/19/google-apple-contact-tracing-gact-a-wolf-in-sheeps-clothes/ <comment><USER3> The article is entirely premised on Apple and Google not giving users control over whether tracing is enabled. Indeed, if they don't, that would be bad. If they do, the concerns in this article do not apply.

> GACT creates a dormant functionality for mass surveillance, that can be > turned on with the flip of a virtual switch at Apple or Google HQ.

If you don't trust Google or Apple to do what they say they do then you need to stop using their OS and hardware. It is already the case that Google and Apple can push (more) surveillance into your device anytime. GACT does not change that.

> Which makes the whole GACT platform a smokescreen really, as exactly the > strong oversight would be required if the GACT platform was not there, and > apps requested special access to Bluetooth to implement their own contact > tracing technology.

Not at all. Plausible advantages of GACT: a) Google and Apple don't have to evaluate the properties of each app's Bluetooth protocol; b) standardizing the protocol prevents Balkanization and makes tracing much more effective; c) Google and Apple are likely to implement it better.

Another problem with this article is that the criticism is not constructive. If we believe the conclusions of the article, then what? Is there a better way to leverage smartphones for contact tracing? Or should we abjure smartphone- powered contact tracing? Doing what instead? "This sucks" without comparing it to alternatives is not actionable.

<comment><USER4> Don't let perfect be the enemy of good. Defence is done in layers. Imagine a castle; does it stand on it's own in a plain field? Unlikely. It has walls, moats, hills, guard towers, bars on windows.

Even if Google or Apple are _capable_ of doing something evil, you can stil prevent them from excersing that power by not setting an example that it's okay to do so.

<comment> t-writescode > Even if Google or Apple are _capable_ of doing something evil

Genuinely, it's not Google nor Apple that I fear doing something evil here.

Google will try to give me more targeted ads, without giving that detailed data to their app developers, but instead just making their demographics tools better.

Apple will do what they think will help the circumstance.

I fear the government doing evil with it, especially under the guise of good.

"Hey, we found this terrorist's phone number, turns out he has an Android device. Give me every person that's been physically near him in the last 24 hours"

"Hey, these 37 people were at a protest, where do they spend their off time?"

<comment><USER5> The situation to fear is already possible and is not made worse by GACT.

</comment></comment></comment></comment><comment><USER6> Everything in this article is completely illogical and baseless.

We can't trust Apple/Google to manage the anonymous data behind Contract Tracing but we can for our photos, phone calls, messages, web history, app data and GPS locations.

And we have to be fearful because this anonymous data is somehow going to be linked by Apple/Google to real persons and used for mass surveillance. But yet they could have done this for years without needing GACT as an excuse.

<comment><USER7> This allows to track who was in contact with who. That is something new.

<comment><USER6> Sorry to burst your bubble but governments have had access to this data for decades via their data siphoning agreements with telcos.

I used to work at a telco and we absolutely knew your location based off base station triangulation. And we knew who you called and messaged and who was nearby to you.

<comment><USER8> Why isn't this data used then for contact tracing?

<comment><USER9> The whole point of GACT is to prevent governments from going that route.

i.e. most folks in favor of GACT adoption see the alternative path, of using actual location data without opt in and operated by the government, as a scarier erosion of privacy.

</comment></comment></comment></comment></comment><comment><USER10> While it is important to keep Apple and Google under scrutiny and demand transparency, this blogpost is mostly FUD based on silent assumptions contradicting descriptions of the protocol and implementation.

> ensuring that all users of a modern iPhone or Android smartphone will be > tracked as soon as they accept the OS update. (Again, to be clear: this > happens already even if you decide not to install a contact tracing app!) It > is unclear yet how consent is handled, whether there will be OS settings > allowing one to switch on or off contact tracing, what the default will be.

I don't think that's correct: you can always disable Bluetooth. Moreover broadcasting, if I understand the documentation correctly, Google and Apple will be providing just general framework: no ID broadcasting will happen until a tracking app is installed. But even if it did, if the tracking keys are not published, it doesn't affect privacy more that Bluetooth MAC address.

> In other words, a malicious app could act as if the user is infected (in a > way that is unnoticeable to the user) and extract the daily tracing keys and > upload them to the server surreptitiously.

That's true for decentralized tracking not using Google's framework as well.

> This means the technology is available all the time, for all kinds of > applications.

In Android ecosystem Bluetooth is available for all kinds of applications too. There is a permissions subsystem that can be applied in both cases.

Everything that Google / Apple Contact Tracing allows is already possible in Android. What it provides is a common standard, implementation, and iOS background Bluetooth capabilities.

<comment><USER11> > you can always disable Bluetooth

"To improve device experience, apps and services can still scan for nearby devices at any time, even when Bluetooth is off."

<comment><USER10> It is not COVID tracking specific, is it? So no change here either, I guess. And it seems you can turn it off as well: [https://news.ycombinator.com/item?id=22856030](https://news.ycombinator.com/item?id=22856030) , first comment.

<comment><USER11> Exactly what it says: Disabling Bluetooth does not disable Bluetooth (Low Energy). Same for G, same for A. And I hate it.

<comment><USER12> Citation on iOS not disabling Bluetooth (both classic and LE) when turned off in Settings (not the Control Center)?

</comment></comment></comment></comment></comment><comment><USER13> I find these articles incredibly frustrating. If you go in with such a bias against the core concept then you run at risk of throwing out common sense in the process.

The article can basically be summarized in two points: slippery slope and distrusting the platform holder. The former is best countered by looking over what the platform holders do, the latter has little to do with contact tracing. Apple already broadcasts proximity IDs for "find my". They were in fact heralded for their privacy first approach of that protocol until a few months ago.

If you distrust your platform holder — which is fine — then be aware of what they are doing everywhere. This contact tracing protocol is by far the least worrisome thing these platforms do. In fact it largely just undoes a recent security improvement: MAC address rotation on Bluetooth.

I have a bit problem with blog posts like this: they get circulated widely because they propagate the idea of the big platform holders building a surveillance system. It particularly problematic because it also plays into the hands of PEPP-PT and other efforts which actually do want to build a centralized contact tracing system and they need the platform holders to give more control over the bluetooth stack for that goal.

Right now if apple and google were to go ahead with this implementation it would make it significantly harder to build a surveillance system than if certain other efforts would get their way.

<comment><USER14> You have a point, but 99.9% of consumers cannot follow your reasoning. What _they_ will see is this:

"Apple and Google selflessly implement a new magic technology to save our lives. This involves a tiny little bit of contact analysis. Who would possibly resist!"

For these 99.9% the association "contact tracing good" has now been established. Companies will slowly go further and further in the future, because this event has established a precedence case.

Anchoring bad things to positive events and outcomes works. Advertising works, not for HN readers but for the general population.

<comment><USER15> Eh, seems like the opposite. So many people are both skeptical of surveillance and ignorant of technical implementation that no matter how secure/anonymous it is they will FUD about it and think the advertising is lies. And all the other people who don't care about existing tracking will continue to not care.

</comment></comment></comment><comment><USER16> This is clearly a highly-technical project by teams at both Google and Apple, and presumably those teams have social overlap with the userbase here on Hacker News.

The risks raised by this article appear credible and worthy of consideration.

It'll be interesting to see whether Google and Apple do openly respond to any of the specific concerns raised by the privacy and security community - <USER2> exmaple, whether the functionality will be time-limited to the duration of COVID-19.

Google and Apple would gain huge potential leverage over nations worldwide if they retain the sole ability to offer and withdraw the functionality and to vet the applications that are allowed to use it.

<comment><USER6> > Google and Apple would gain huge potential leverage over nations worldwide

You do understand that Apple/Google are not in charge of the world. They operate within each country based on the laws that each government puts in place. It would be trivial for any country to force this functionality to be on/off and dictate which apps it can be used with.

<comment><USER16> For nations with the technical & legal staff and time required to review, address and negotiate updated legal terms with Google and Apple, that may be true.

Since you sound familiar with the situation, can you provide a link/reference to evidence of a country trivially changing the behaviour of an operating- system level feature like GACT after it has been deployed?

<comment><USER17> There was a special Windows version for the EU.

<comment><USER16> Thank you. Are you referring to the "Microsoft Corp. v Commission of the European Communities" case[1]?

(lodged in 2004, resolved in 2007 - and led to the release of a version of Windows without Windows Media Player installed-by-default)

[1] - [https://eur-lex.europa.eu/legal- content/EN/ALL/?uri=CELEX:62...](https://eur-lex.europa.eu/legal- content/EN/ALL/?uri=CELEX:62004TJ0201)

</comment></comment></comment></comment></comment><comment><USER18> I think this is the guy spreading FUD about this last week. He's back spreading the FUD again this week.

In his analysis he keeps ignoring that the flow of data is user-controlled.

You need to opt-in to start this this, not just take an OS update.

You also need to install an app and opt-in to allow it to use the data.

Looking at the docs, the user also needs to approve at the point where an app receives the day and duration of contacts with an infected person. The only thing an app that you've already downloaded and opted-in to can do without further permission if report some contact with an infected person: not who or even which daily tracking ids, not when within the last 14 days. That won't make a tool of mass surveillance.

In places he acknowledges some of this, but his analysis proceeds as if the user-controlled nature of this doesn't exist.

This is deeply despicable.

To the extent this guy and people like him can sow distrust of this platform, the weaker privacy-preserving covid19 contact tracing will be.

That leads to _more death and deeper economic ruin_.

There are various other problems with the analysis here: For example (just a selection) (1) this platform doesn't require any more trust from Google and Apple than before. They've always been capable of turning your phone into a tool of mass surveillance, one much more effective than what this platform allows. (2) This system _cant't_ be turned into a tool of mass surveillance with the flip of a virtual switch at Apple or Google HQ. The software to expose the data won't exist and so would have to be developed, tested and released. This guy is using a Hollywood movie level understanding of of software systems here.

By the way, this guy is a professor with a specialty in privacy, so we know he knows better.

That means all of this is malicious. I don't know what he has to gain from pushing this FUD, but I do know he doesn't mind getting a bunch of people killed or putting them through economic hardship.

He should be using his expertise to do an honest and competent analysis of this system so that it could be improved.

<comment><USER19> My understanding from the article: if the tracing functionality is in the OS, it can be enabled in the future without user consent. The fact that currently we need to opt-in with an app does not really matter; in the future the government can decide to use it directly for whatever purposes.

<comment><USER18> As the system is described there's no way to flip a switch.

Apple/Google could always push a software update that does all kinds of terrible things, _but that has always been true and remains true_ with or without a contact tracing system. It's a concerning possibility but has nothing at all to do with this system.

</comment></comment></comment><comment><USER20> My high-level understanding of how it works is: Every 20m I generate a key, broadcast it and listen for and record others keys I hear around me. Periodically, I ask a server for a list of "infected" keys and compare those keys with what I've seen. If I get infected, I submit my key to the server.

The "who's seen who" sounded like it was entirely done locally to your devices.

Unless something nefarious is done under the covers, no central server gains access to the information correlation information.

What am I missing here? It seems like this system preserves privacy.

I exclude nefarious action above because if we believe Google or Apple are acting nefarious (which I understand many do), then they already be doing so at so many levels in our hardware and software that this is just a drop in the bucket.

</comment><comment><USER21> Do you really need a mobile phone? I spend enough time with the Internet in the home office. When I go out, I go to a mountain, forest or similar natural scene. A phone + Internet is just bringing what I seek to escape from with me.

Just ditch the phone. Problem solved. Simple solutions are usually the best.

</comment><comment><USER22> The article states

> GACT works much more reliably and extensively than any other system based on > either GPS or mobile phone location data (based on cell towers) would be > able to (under normal conditions). I want to stress this point because some > people have responded to this threat saying that this is something companies > like Google (using their GPS and WiFi names based location history tool) can > already do for years. This is not the case. This type of contact tracing > really brings it to another level.

I don't see an explanation of why this would be so.

Also, I see here as elsewhere a "what if one installs a malicious app that uses this?", but that argument applies even without the contact tracing framework.

Still, there are some valid points which I hope can be considered by the spec authors.

<comment><USER23> I'd guess it's because GPS / cell phone tracking data rely on line of sight to towers / satellites, but GACT works on human-to-human proximity, and therefore data can survive offline locally until some point in the future when you get connection back. Also it seems the distance accuracy between human to human would be more accurate (via BT signal strength) than distance accuracy in a GPS / cell phone tower situation.

<comment><USER24> BT interference is much more common, and BT identifiers are much easier to reset.

Cell phone tracking data does not rely on line of sight to towers, and for most people there is no offline for this to be relevant.

</comment></comment></comment><comment><USER25> We are already under mass surveillance.

The movements of your mobile phone (and everything you look at on it and what you type and who you communicate with and what you say and literally everything else you can think of) is available at the touch of a button to the government.

It amazes me that people know this, but simultaneously don't know it?!

The horse has bolted. It is gone. This urge to close doors to empty stables is really baffling to me. Really confusing. Why are people like this?

<comment><USER26> The complaint isn't about the capability for mass surveillance, but the normalization of it, in the public mind.

The capability has existed for a pretty long time, mostly out of the public eye, with occasional bursts of outrage when something caused it to become public, quickly forgotten afterwards.

The capability is there, that genie is out of the bottle and nobody is going to put it back in. This isn't really about the technology, it's about the legal frameworks and social attitudes surrounding this capability that are worth talking about. Putting your hands up in defeat is not useful, and at this point probably neither is trying to prevent the technology from spreading. I am unsure what the solution is but the conversation needs to happen, and in all likelihood the end result of that conversation will be that corporations can't be trusted, just like they couldn't be trusted with food safety, for example, thus the FDA was created. What actions will be taken after that, I cannot predict.

<comment><USER25> Sorry, I can see where you're coming from, I just think you're seeing a difference that isn't there.

Specifically, these programs are totally normalised. We've had them for decades. They're supported by both parties in the the whole English speaking world. They've grown and expanded since they were revealed. At this point, total surveillance is normal.

If anything, making an app for coronavirus is a good thing. It's easier to ignore this if it's done server side than if your carrier suddenly compels you to install some shitty slow battery draining app. I don't know if that qualifies as normalising it, but if it does and get people up in arms (or encourages even 1% of them to move to tor or signal or something) it's a good thing...

</comment></comment></comment><comment><USER27> Is there a reason why this framework can't be open sourced by Google and Apple?

I'm not suggesting that it be developed by the community, but it seems like visibility into the source could give some assurance of what it is doing and potential weakpoints.

</comment><comment><USER28> I realize governments, Apple, google already have access to my personal information and location. But I get the sense the public gets uncomfortable whenever we feel Governments are openly using our personal data on a large scale. Uncomfortable is the key for me.

What scares me specifically about person proximity tracking is that in the current covid world it seems realistic that some governments will force people to enable it with seeming support from the public. Therefor eroding that uncomfortableness.

</comment><comment><USER29> I feel that Apple and Google are a bit coy when they claim their solution is opt-in only. Given that one super-spreader can infect a whole city, you need very comprehensive coverage to keep infections under control. It's as if these companies are winking at governments and saying: Hey, we've done our part, now it's on you to enact CCP-style policies to make sure that everyone has to opt- in before you're allowed to leave your hose.

</comment><comment><USER30> This isn't how you do privacy analysis. The author assumed stuff about stuff he doesn't know and extrapolated on that. I was expecting some protocol analysis. Not sure who this is and if the individual usually does cryptanalysis or not. So we don't know what their thoughts on the actual protocol are. Unfortunately I am worried this will be listed as a negative on the protocol by aggregators who are not technical.

</comment><comment><USER31> I hope they consider adversarial use cases.

Authoritarian countries may give fake test results to people they don't like in order to find their whereabouts for the past two weeks, for example.

In the end, people should be in control and it should be obviously simple turn it off systemwide (not buried in Settings > Privacy > Location > System Services or whatever).

<comment><USER5> Why would someone evil do something in a comically complicated way instead of a simpler easier way.

</comment></comment><comment><USER32> Simple question: Why doesn't the following work?

Say I work for a repressive regime. To do business in our economy (tag into subways, etc), you need to install an app with GACT enabled.

Now, whenever we arrest a political opponent, we get their GACT device key, and flag all of their associates as political dissidents, and arrest them too.

This seems like an invaluable tool for oppression.

<comment><USER33> That app would have to be approved by Apple, which they wouldn't do

</comment></comment><comment><USER34> The major question I have about smartphone based contact tracing is if it is effective, and if so how much more effective is it then existing techniques.

Bluetooth based contact tracing could be a valuable tool in public health, but as many have opined it is also a significant sacrifice of privacy.

Is there any data on the effectiveness of this sort of technology yet?

<comment><USER35> 3brown1blue had a youtube video a few weeks ago, running simulations. The effect of contact tracing and testing is significant. Granted, it's just a simulation, but the efficacy of contact tracing + testing is quite powerful.

<comment><USER34> Absolutely, the efficacy of contact tracing has been known for a long time.

That being said, we've also been doing interview based contact tracing for a long time. The current IT systems for doing contact tracing leave a lot to be desired (I did a trade study a couple months ago), but public health agencies have procedures for doing contact tracing without invading privacy nearly as much as the proposed platform.

Preemptively using smartphone interactions to capture information world definitely be cheaper than the current manual processes but I want to know how much it improves efficacy before nationwide/global deployment of such an invasive technology.

Until then, hire contact tracer's. There are a lot of unemployed people.

<comment><USER35> Pardon my ignorance, but how does a human do contact tracing? Start calling people to find out if they shopped somewhere recently with a known exposure?

<comment><USER34> You interview the identified case to determine who they've been in close contact with for the last several days, get their contact info, and then test them. Repeat for any new positive contacts.

If they were in any public areas you can pull purchase records for any one who also was in the area at the same time.

<comment><USER35> I've been wondering this -- what is my likelihood of infection based on vector? If I go shopping and there are 5% people actively infected, how does that compare to living with someone?

I've been operating under the assumption that proximity without PPE but within a few hours of existing in the same space is a significant vector. If true, it seems like it'll be very difficult to find people who shopped at the same store within the same day.

</comment></comment></comment></comment></comment></comment><comment><USER36> Do people really think the evil sorcerers at the twin towers of google and Apple rub their hands and laugh maniacally at the chance to build the ultimate evil privacy violation tool made only ever more fabulously evil because it is cloaked in goodness and brought as a gift to do good?

These are not the nine rings for mortal kings.

Do these people think that Larry and Sergei call a meeting of their most evil henchmen/project managers and say "gentlemen we have been given an outstanding chance to build something magnificently privacy violating! The coronavirus has driven people into our hands! We have waited so long for the chance to build such a system and because people think it's for good, we'll never be suspected! Go my minions, fly and build the dark software that will create us a secret and hidden trove of privacy data the likes of no other! Ha ha ha !"

The privacy nuts really think this way.

<comment><USER37> No. I think you're jumping through a number of hoops to paint such a picture and discredit the post.

The larger point for me is: this is great and helpful but in doing this we undermine privacy in other less obvious ways.

These two quotes sum it all up for me:

"Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety."

"The road to hell is paved with good intentions."

<comment><USER38> > "Those who would give up essential Liberty, to purchase a little temporary > Safety, deserve neither Liberty nor Safety."

One of the most misunderstood quotes on the internet

</comment></comment></comment><comment> rising-sky > GACT works much more reliably and extensively than any other system based on > either GPS or mobile phone location data (based on cell towers) would be > able to (under normal conditions). I want to stress this point because some > people have responded to this threat saying that this is something companies > like Google (using their GPS and WiFi names based location history tool) can > already do for years. This is not the case. This type of contact tracing > really brings it to another level

I'm curious about this, the author says they would like to "stress this point", but then provides no analysis or evidence to impress this... anyone have any buttressing points?

</comment><comment><USER39> Contact Tracing is an awesome way to use the technology in theory, however, while a bit conspiracy theory-ish, it can also be used as trojan policy to allow unfettered warrantless access to location data, mass surveillance, and anything else they'd like that could be exfiltrated from user devices.

Anything that has the ability to be exploited will be exploited for purposes.

We have a generally healthy level of distrust for our governments as well as big business, and given the consistent evidence, I feel that's generally warranted. (Government is supposed to serve the people, not the other way around).

I would never opt-in for this nor would I trust it.

<comment><USER40> I don't understand why they'd need to even tell us about it. Call it a security update and install on every phone.

<comment><USER41> Pessimism is an indulgence.

Don't go gentle into that good night.

</comment></comment></comment><comment><USER20> Personal opinion: I'm glad Google and Apple are working on this. Because a very likely possibility if they don't, is that the governments demand further access to devices, backdoors to software, and enhanced power related to data collection and use.

Rationally, this would boil down to whether you trust your government or the tech companies more with this data, and opinions will vary.

My, admittedly high level, review of this proposal is that it seems to have a good privacy design. As I understand it, the contact information never leaves your device.

</comment><comment><USER41> I don't think it's absurd to forego all this fancy crap that triggers through walls, and instead have a cute, local-to-device, privacy respecting app for logging contacts and locations.

Brought your mom some bread today? Log it in the app.

Went to a grocery store after? Log it in the app.

Every Sunday or something maybe check in with some of the people you got within physical proximity of, and try to investigate a bit if there were any known cases at your grocery store or such.

If you were potentially in contact with Covid, maybe update the people you saw after it, or maybe just self isolate, or maybe both.

Definitely do get in contact if you have symptoms, and ideally you could even alert the grocery store and they could post a notice somewhere people could easily find (ideally online) with when you visited and perhaps the likelihood of you having had it at that point.

Sanitize your groceries too~ People pick things up and put them back, I imagine there are hundreds of cans and junk food wrappers sitting in stores across america right now with Covid on them.

I really believe this is all doable with the stock iOS Reminders app and some discipline. But a standalone app would be nice; not-plaintext-in-the-cloud is kind of important at scale. Non-iCloud reminder lists were possible at one point.

(Tangent but Reminders a misnomer imo, I vote renaming it to String Nest)

</comment><comment><USER42> Why they wouldn't say that this will be removed after pandemic is over is beyond my understanding.

</comment><comment><USER43> A couple points that have probably already been made by someone else:

* I suspect Google and Apple probably did a lot of contact tracing/traffic analysis type stuff that they don't want public...

and

* Contact tracing in the US might have been useful on January 15th but right now it's probably pointless.

</comment><comment><USER44> Who do you trust more to build a complex decentralized anonymous tracing system? Which will be subject to the toughest privacy and security audit ever seen. A random tracing app developer, or an alliance of the biggest competing players in this field?

</comment><comment><USER45> We may well really need this kind of tracing, and frankly it would be useful if we had had it since it would have and will save lives.

Do I think it is sensible to raise concerns? Yes Am I disappointed that there aren't specific suggestions to address issues? Yes

It is really easy to criticise and a lot more difficult to come up with solutions. As an expert in privacy, I'd have liked to see specific actionable items. e.g. 'Google/Apple must do X to ensure Y' or something saying 'Yes, this is really difficult and I don't know the answer'. This opens the floor for collaboration and for suggestions which feels a lot more constructive.

What's key is that this is done right. If it isn't done right, there's a risk that no one will install it and we don't get the protection.

<comment><USER46> Get the protection from what?

</comment></comment><comment><USER24> This is a very, very poor article with no real grasp of comparable threat vectors.

It seems to feel having two centralised vendors for this is worse than just having arbitrary third parties, without explaining how this would be facilitated without any controls over this on an OS level, so it would then just be entirely dependent on all of your third party applications. That's a much bigger threat model than the OS vendor, requiring you to trust dozens of different vendors with different motivations to behave.

The fact is really simple, if you don't trust your OS vendor that the APIs are as described then you're screwed and everything else is irrelevant. It is very clear the general public do not give a stuff.

</comment><comment><USER47> Before we do all this, couldn't Facebook just turn over the data that its users have already consented to sharing? I feel like that would get us a significant part of the way there.

</comment><comment><USER48> Silent pocket sales will definitely see an increase from this.

<comment> ezequiel-garzon Thanks for the reference, I didn't know about that [1]. Wouldn't you achieve the same result by turning on airplane mode? I guess it should be straightforward to check whether there are any signals when it is activated.

Once you need to be online you must disable airplane mode, true, but you also must take your phone out of the silent pocket, no? At that point you "lost".

[1] [https://silent-pocket.com/](https://silent-pocket.com/)

<comment><USER6> You "lost" the second your phone obtains a mobile phone signal.

At that point the telco can roughly triangulate your position using the base stations that you're connected to. And determine who is nearby to you.

And better not tell the author of this article but this data has been made available to authorities for decades.

<comment><USER48> My worry is more that there will be an exploit for Android that will collect all those Bluetooth IDs and geolocations and upload them somewhere that somebody could use nefariously.

Not saying that telcos have shown any moral high ground with location data, even Google has this level of location tracking enabled for a considerable amount of people. I'm most worried about an Elasticsearch instance cropping up where somebody's bluetooth ID can be used to see how they get to work, etc. Faraday cage bag for phone seems like a reasonable solution.

</comment></comment></comment></comment><comment><USER49> I am well convinced this is just a cover for them to release the information they already are collecting without admitting they track everyone everywhere.

</comment><comment><USER50> Google and Apple have come up with a somewhat ingenious scheme to mitigate this crisis while preserving privacy to the greatest possible extend.

Self-appointed privacy experts aren't going to do their cause any favors by reflexively finding/imagining fault with it. This article comes surprisingly close to literally "crying wolf".

<comment><USER50> I do, however, fault Google & Apple for using the acronym "GACT" here. This is an RNA virus, so they should be able to come up with something that baxkcronyms to "GACU".

</comment></comment><comment><USER51> The very OS level baking in of GACT tells that intent is not to make this opt- in, in principle.

Even if it is rolled out today as opt-in, the option stays open for a government to centrally enforce mandatory activation of tracking via Apple/Google

<comment><USER38> 5 years ago you could turn off bluetooth and wifi in ios and it would stay off.

Now it turns itself back on every day.

It will roll out as opt in, then as opt-in but enabled-by-default, then the turn off will only be temporary

rfid pocket seems to be the only solution.

</comment></comment><comment><USER11> A very well written article this is.</comment>


Hackers have a problem with Paypal... - <AUTHOR> ... but there are several of us who work there, and are genuinely trying to make it better.
There is an internal conference in a couple of weeks, and part of what they are trying to figure out is why pp is not considered a "destination for technologists".  I'm not 100% positive what that means, but in my mind it means that they recognize the company has moved away from its hacker roots and want to make it better.
I know that if you hate the company, then you have no reason to help us make it better, but if you're willing to tell me why you hate it, maybe I can use that to convince the organization to move in a better direction.   This is your chance to tell me the things that you want the people in power to hear.
Posted from a throwaway acct.  Gotta be secretive. <comment><USER2> My list, in order:

\- end the Wikileaks blockade; support free speech & individual rights not censorship & corporatism

\- be clearer in your API documentation when certain features don't work in certain areas (e.g. recurring payments in Australia, several years ago, wasted nights coding, argh ...)

\- allow me to choose a credit card as my default payment method; I know it's better for _you_ if I use a savings account, but _I'm_ the customer

\- allow PayPal to be used for the purchase of firearms & related equipment

</comment><comment><USER3> I don't hate Paypal, but I'd prefer not to implement anything again against the Paypal API.

I wrote a small e-commerce engine for a friend's site a couple of years ago, utilizing Paypal for the shopping cart & IPN to notify the site when merchandise had been purchased. There is an extreme lack of precision in the documentation for the various APIs, that made the entire process take twice as long as it should have (or was, I haven't checked back since I wrote the implementation). When I implemented the IPN receiver I tried to find out, precisely, what data would be sent, and gave up, instead running through a series of transactions to get a 90% coverage of fields for payment and refund transactions.

Receiving all of the ebay transactions for the account was a surprise, but one I was somewhat prepared for.

Maybe there is a flow chart of what data gets sent with what transactions, but in the time I was doing development I couldn't find one. During that time there was some sort of changeover from the existing Developer portal to x.com for some, but not all documentation. Was extremely frustrating for links to examples to break, even more so to return months later and find them still broken.

But the thing that really killed the utility of Paypal for me, and possibly doomed my friend's site, was the long delay when clicking "Add to Cart", which POSTs the relevant item information to Paypal to create and/or add to an existing cart. The delay was measurable in the multi-second range, and was entirely on the Paypal side. Totally independent of browser, O/S, network (I checked). This lead to a cart abandonment rate of close to 50% (measured via Google Analytics data, amongst other means). Never any indication of errors, no messages to the merchant's paypal account indicating anything was wrong with the data being sent. Just. A. Long. Delay. If you were patient the cart would appear with the item(s) displayed.

My friend ended up shuttering her business at the end of 2011, for multiple reasons, but the abandonment rate was certainly one of them.

Had the business not closed I was going to try shifting to maintaining the cart on the site and doing "upload cart" to Paypal to see if that sped things up, but we never got to try it.

So, lack of precision in documentation, performance, lack of diagnostic information [aside: we didn't see the performance hit using the sandbox, solely in production].

</comment><comment><USER4> It's the way you completely stonewall people who are trying to fix their accounts. If you give each person a clear statement of what the problem with their account is, and show some willingness to work with them to get it back to normal, it would solve 95% of your PR problem.

This article is a very good summary of some high-profile people you've hurt, and specific steps you should take to fix your reputation. <http://techcrunch.com/2011/12/06/paypal-account-freeze/>

Oh and this is just unreasonable: [http://christianowens.com/post/15771850658/my-recent- experie...](http://christianowens.com/post/15771850658/my-recent-experience- with-paypal-customer-service)

</comment><comment><USER5> Well, why might they (PP) be cacking themselves? Didn't Barclaycard open up a rival to Paypal this week? Wouldn't anyone with any sense, or certainly those who don't like being financially raped, use this service? Sure Barclaycard or PP - it's like playing the devil off against himself, but I hate PP so know which I'll be using.

PP - Why can't me and my husband have separate ebay/paypal accounts & use the same bank account to pay through? It's a joint account so stipulating only one of us can use it on one account is ridiculous.

Wikileaks..wikileaks....wikileaks... Don't need to say any more really. Grow some balls PP and stand up to Government. I lost any remote respect I had for you at that point.

</comment><comment><USER6> \- Transparency surrounding freezing of accounts and funds. Mom-and-Pops will go with PayPal anyway, because of their brand power, and the fact that it's so easy to accept money with PayPal. But hackers and people with chops and resources are aware that it happens all the time, know there are alternatives, and are more likely to leverage them.

\- Better customer support in general. It's unacceptable for PayPal to be unresponsive for days and weeks when problems happen and there is big money at stake. PayPal needs to study up on what is making Apple so successful in the retail industry and take a hint from their CS staff.

</comment><comment><USER7> Some thoughts..

1\. If PayPal wants some hacker love, they'll have to start acting more like one and less like a big corporate/bank. Start with a cleaner "developer friendly" redesigned website and API documentation.

2\. Fix subscriptions (see <http://news.ycombinator.com/item?id=3588446>). Most startups (largely SaaS) charge a recurring amount and PayPal subscriptions are not at all easy to integrate (see how Stripe and SaaSy do it).

3\. Consolidate (see Apple and Google). Remove less popular products and focus on the most popular ones.

</comment><comment><USER8> Why isn't it considered a destination for technologists? You blockade Wikileaks. Period. When did Paypal's problems in this domain begin? I'm guessing circa December 2010.

</comment><comment><USER9> Stripe.com-like API, fully documented with curl examples \+ Act like a real partner : One true, full and comprehensive business account verification at account opening and the associated absolute promise that PP will never hold back money without reasons enumerated in a contract.

</comment><comment><USER10> Transparency. Consistency. Respect.

If you can't do these three, forget it.

(And if you don't know what I'm talking about, you haven't been paying attention to your own situation.)

P.S.

> Posted from a throwaway acct. Gotta be secretive.

Understood, but not a good start.

</comment><comment><USER11> Because you block accounts.

There are a number of reasons. Use your favorite search engine and look for reasons. Maybe have a look at what reasons people give when canceling their accounts.

</comment><comment><USER12> I use PayPal every day, numerous times in a day, but I will jump ship in a nanosecond if PayPal gets a real competitor.

Here is my list why PayPal is (a necessary) evil:

\- The Wikileaks blockade

\- The internal staff who deal with refunds and other customer issues. They need to be trained MUCH better, and taught manners and courtesies when interacting with users.

\- A lot of nickle and dime-ing me on every transaction, every which way. PayPal makes a mint off of me.

Actually, I agree with Duncan_bayne's list, except for buying firearms online with the service. I'm in vehement disagreement with that.</comment>


For Her Head Cold, Insurer Coughed Up $25,865 - <AUTHOR> https://www.npr.org/sections/health-shots/2019/12/23/787403509/for-her-head-cold-insurer-coughed-up-25-865?t=1577125419719 <comment><USER3> How is this different than the scam where they charge you $300 for what would usually be a $30 dinner?

We need to socialize the healthcare in the USA and put a stop to this crazy billing practices. (Maybe send a few execs to jail too) Canada really has the right idea here, as even if you are making $bank here, you can be fired for any reason/no reason and health insurance will end. IMO this is by design, as it is much more difficult to leave a job if insurance will end.

<comment><USER4> Why is that a good thing?

That sounds similar to indentured servitude.

EDIT: I misread the "here" as "Canada". The US healthcare system has caused me some personal hardships, so I was surprised Canada had something similar. Luckily it's more sensible.

<comment><USER5> Why is what a good thing?

<comment><USER6> He is asking why is it good for the workers. You're basically advocating for price controls on one field. How would you like if you were only allowed to make $30/hr for writing code?

We already have massive shortages of doctors (and nurses, I think). This will only make it worse.

<comment><USER7> AFAIK _every single other_ OECD state has explicit or de-facto (via monopsony) price controls for much of the healthcare sector. Hell, even non-OECD free- marketer-beloved Singapore does.

I would, no kidding, love to see any example of a successful, modern healthcare system that doesn't employ price controls to keep costs from getting out of hand. Allowing "successful" and "modern" to describe the system in the US, it's the _only_ one I know of that doesn't.

<comment><USER6> You didn't answer the question though. You just went with "well, everyone else does that".

<comment><USER7> ... which means you can go look at them to see how it's working out. Again, I am _legitimately_ interested in learning about any healthcare system in a state with an advanced economy that _doesn 't_ employ price controls in one form or another, but in the meantime, instead of spitballing about what a disaster it might be, we can just look at, AFAIK, literally any other such state to see how it works out. Dozens of examples.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > The third reason for the high bill may be the connection between the lab and > Kasdan's doctor. Kasdan's bill shows that the lab service was provided by > Manhattan Gastroenterology, which has the same phone number and locations as > her doctor's office.

They really buried the lede there. This sounds like fraud. She went to her doctor, who, I'm guessing, is in-network since the article says he was her primary care physician. The doctor operates a lab that is not in same network he operates his practice in? Is that some kind of coincidence? Is there any other reason for that except to bilk money out of the insurance company?

</comment><comment><USER9> It's weird how the argument in America is always socialised healthcare VS private healthcare. Rather than people just demanding non-insane private healthcare. I have private healthcare here in the UK through work and it costs £150 a month to add my wife too, for one of the best plans around.

<comment><USER10> Could it be because it has to compete with the public option, or at least stand up to comparison with it?

<comment><USER9> Exactly! Competition is what makes capitalism work, otherwise you just have a monopoly and then everything turns to crap real quick.

We have a similar problem in a way with our trains. They've all been 'privatised' but if only one train company runs your route there can't be any competition, so our trains suck big time and are really expensive.

<comment><USER11> Not only that, there's also only one Network Rail doing the maintenance. So the local monopoly on passengers relies on another monopoly.

End result is it costs upwards of £4k for an annual pass for a half hour train journey.

Add to that the fact that nobody would ever allow the trains to cease operating, and you have a really big question mark over what the point of privatizing was?

<comment><USER12> Do you understand what they were like when they were public? Costs have fallen dramatically, prices are actually way down, the govt subsidy is down (although will rise again with HS2), and service quality/output is up.

We know this doesn't work because we tried it and it didn't work.

<comment><USER9> This is the usual argument.

But it doesn't hold water. France, Germany, Spain all have cheap, really good government-owned trains - in fact they also operate some of our trains in the UK and use the profit to fund their own trains.

Prices have gone up by the maximum operators are allowed to increase them every year (there's a 1 year exception where I think they were frozen for political reasons) [https://www.bbc.co.uk/news/business-49331238](https://www.bbc.co.uk/news/business-49331238)

Just because we tried something before and did it badly doesn't mean it won't work in future if done well. Execution is everything, right?

<comment><USER12> Left out is the specific reason why you think it will work well in the future.

Define really good? They are less safe, the prices charged to consumers may be lower but what is the overall subsidy (I understand that you want other people to subsidise your commute...other people tend not to be happy about this), and it is fair to say that UK trains are less punctual but the difference is not massive (and we do come ahead of the nations you mention some years too).

The discussion on this in the UK is pathetically weak, and largely a function of trade union lobbying (if you didn't know, the TUC pours money into this cause like nothing else...presumably they just really really care about commuters).

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> This is fraud, they where fleecing the insurance company and the patient just went along for the ride. The whole point of insurance companies is that they are supposed to be motivated by their own financial interest to fight against schemes like this, so it's shocking that they paid up.

<comment><USER14> Did you read the full article by chance? Saying 'the patient just went along for the ride' insinuates that the patient was complicit when in reality the patient reported the whole incident themselves after they received the bills. They did this even though _they_ didn't have to pay anything. And they told the provider they were going to report them.

> "I made it very clear [to the doctor's office] that I was unhappy about it," > Kasdan says. In fact, she told them she would report the doctor to New York > state's Office of Professional Medical Conduct.

> Kasdan says she was not told that the throat swab was being sent out of > network at the time of her appointment, though it's possible one of the many > papers she signed included a broad caveat that some services might not be in > network.

<comment><USER13> By "patient just went along for the ride" I meant to say that her bills where collateral damage.

</comment></comment></comment><comment><USER15> The largest HMO in the US billed medicare $90 for a flu shot. A drug store would have done so for $19 without insurance.

<comment><USER16> The system is broken. I think a fundamental issue is that insurance is not really insurance - it is used to cover routine, expected things such as a flu shot (while increasing cost for these and adding complexity, bureaucracy, middlemen). E.g. car insurance does not cover oil changes and home insurance does not cover getting the gutters cleaned - they're there for major events.

</comment></comment><comment><USER17> NPR has to be responsible journalists but we can call a spade a spade: this is insurance fraud, plain and simple.

All of the noise in this thread about healthcare system in the US is a good discussion but arguably unrelated to the bill in question. Single payer government run plans can be defrauded too.

</comment><comment><USER18> By way of comparison, that exact same throat swab test - which some professor was trying to say was excessive - is available at no charge to the patient in Australia, and there are no 'out of network' labs.

I don't know how this nonsense isn't the number one election issue in the USA. Instead everyone just puts up with it.

<comment><USER19> The comparison is meaningless: the patient did not pay anything in this case, but the cost is astronomical, the problem is with the cost not with who is paying. By the way of comparison, I just paid approximately $25 for a bit simple test (bacteria, not virii, but it included sensibility to antibiotics) in Europe last week. Out of the pocket, waiting weeks for the free public system was too much to be effective.

<comment><USER18> The article tries to make the sub-point that the swab was somehow an excessive test - I was trying to highlight that this is not the case, which makes the overcharging even more egregious.

Also to clarify, in Australia there is no cost to anyone with permanent residency status, whether they are insured or not.

<comment><USER19> I now understand what was your point.

Also to clarify, there is no cost for anyone (EU residents) here too if you use the public health system, but if you cannot wait till you're dead then you can use the (optional) private system and pay for that.

</comment></comment></comment></comment><comment><USER20> Can you imagine if Amazon never let you choose how they deliver your orders and purposely decided to charter a commercial jet to route your package though Antarctica? Because thats basically what happened here.

<comment><USER7> No part of medical billing whatsoever would fly most anywhere else. It's batshit crazy, top to bottom. Go get service at one place, get fifteen damn bills from five people & companies spread out over three months plus a pile of mail that looks like bills but may say it's not a bill, and then several will have errors requiring back & forth to correct, you'll get a refund then have to pay more, pay more then get a refund, all kinds of nonsense, you're acting as a go-between for insurance and the providers because they're all friggin' incompetent and that means hours and hours on hold, finally six months later it's all settled but you're guaranteed to have missed something in all that mess and now you've got a letter from a collection agency for a $48 bill out of thousands paid.

Fuck the whole thing, I hope it all burns to the ground. It makes me so very unhappy every time I have to deal with it.

<comment><USER21> Sir, you are choking and dying would you like the premium $500 intubation tube or the discount $10 one? Oh thats riiiight he cant talk lets just assume he values his life and give him the good one.

Oh, sincere apologies about not trying to save you money.

<comment><USER7> Yes this is exactly what dealing with medical billing is like and why it's awful, and not a non-sequitur.

<comment><USER21> It's awful that you have access to a premium life saving service which gets better every year, beyond the immagination of years prior? Or is it awful that the price for said service is high? What exactly is awful to you?

<comment><USER7> All the stuff I wrote about in the first comment, which is zero of the things you just strawmanned?

</comment></comment></comment></comment></comment></comment><comment><USER22> > _Jim McManus, director of public relations for BCBS of Minnesota, says the > company has a process to flag excessive charges. "Unfortunately, those > necessary reviews did not happen in this case," he wrote in an email._

The reason it wasn't flagged is that both the insurer and the provider are incentivized to make this as expensive as possible. Insurers cannot make more than 10% in profit, so if they want to make an extra $1000, they need to take in $10,000. Next, providers are paid fee-for-service, so they want to bill as many services as possible and charge the highest rate for each one. Ultimately our insurance premiums go up to cover this, but the whole thing is a racket.

And single payer _will not_ solve this. All we do is subsidize demand and decrease supply in a never ending fashion in the medical industry. We need to 1) Make it easier to supply services (allow doctors to be imported from other countries, easier to start facilities, allow people with less credentials than an MD to perform services) and 2) Stop subsidizing demand (Medicare for All = Use as much as you want).

My ideal health insurance model is catastrophic insurance provided by the government for any bills over $50,000, Health Savings Accounts to allow you to save for procedures beneath 50k, and a total free-for-all of insurance companies beneath the 50k mark. This would radically reduce insurance rates while preventing people from becoming bankrupt. Catastrophic insurance covers you from cancer and being hit by a bus, but for 99% of all health issues the bill would not exceed that.

<comment><USER23> > And single payer will not solve this.

If there is only one payer, and they refuse to pay your outrageous prices, you either lower your prices or you go out of business. Since a government-run payer does not have to make a profit, it is very easy to incentivize it to keep costs low.

<comment><USER22> If you don't forcibly ban doctors from opening up private, non-governmental clinics - and that means radically restricting individual freedom through the threat of violent force, which I assume would be unconstitutional - <USER2> doctors (or at least the good doctors) will decamp to the private sector only.

<comment><USER23> Private sector medicine is legal in the UK. Why isn't this a problem there?

</comment></comment></comment></comment><comment><USER24> This is insurance fraud and abuse. Over-billing is very common in the American medical world. As long as there is no oversite, nor competition, it will continue and grow worse over time.

<comment><USER25> Speaking of competition, it would be interesting if the major political parties competed on improving results instead of sabotaging results or preventing the other side from getting a win.

Both parties have symbiotic relationships with profiteers that stifle progress and innovation.

<comment><USER26> Trump signed an exec order* (thx for correction folks!) requiring hospitals to dramatically improve price transparency for patients. A huge win. But of course you'll never hear much about it for obvious reasons.

<comment><USER27> First, no he didn't. He issued an EO directing CMS to implement the rule, which doesn't go into effect until 2021 and is facing pretty significant legal challenges. The fact that it's an EO and _not_ a bill is likely part of the reason why its vulnerable to lawsuits.

Second, health care experts don't seem to think much of the new rules, since there's little evidence anyone price shops for care, especially since, regardless of published prices, they're not the ones paying for them; they pay indirectly, through premiums. I think price transparency is a good thing and the rule is a good thing, but I don't think this is "huge".

Third, the "obvious reasons" snark at the end of your comment poisons what would otherwise have been a valuable contribution to the thread.

</comment></comment></comment></comment><comment><USER28> The US healthcare system is just fundamentally broken. Its not even about private or public. Even if they made it public, it would probably still be far and a away the most expensive system in the world.

People who believe that making it public will massively lower the cost because other socialized systems are cheaper are up for a rude awakening.

No matter in what direction the US system evolved those problems need some amount of addressing and those questions are more practically important then the question about public or not.

<comment><USER21> That's a hypothesis and you have presented zero evidence to back up your very abstract claim.

</comment></comment><comment><USER29> Writing good rules to prevent this stuff is hard.

Insurers have to create networks so they can negotiate fair rates with doctors and hospitals. These rates often end up being more than medicare would have paid, but not _wildly_ more. Sounds pretty fair. But what to do if the patient goes to an out-of-network doctor? Insurance might say "we won't pay unless it was an emergency," but then the patient gets stuck with a $30k bill. He'll get angry, tell the media, write his Congressman, etc. Somehow the blame will always fall on the insurer (who had no way to prevent this from happening) and not the doctor (who was engaged in price gouging.)

Or maybe the insurer can say "we'll only pay the same rate we would have paid an in-network provider." No problem, says the doctor-- we have the patient's signature on this huge contract that says we can bill them for the remainder. Now the patient gets a $29.5k bill instead of a $30k bill. Still no good.

I'd love to say "just socialize medicine and be done with it", but this worries me too. The US already runs two 100% socialized healthcare systems: the VA for veterans, and IHS for Native Americans. Both are absolute nightmares where people sometimes wait years to see a barely-competent doctor. Many IHS doctors only work there because no private hospital would hire them[1].

I'm not sure what a good solution looks like.

[1] [https://www.pbs.org/wgbh/frontline/article/u-s-indian- health...](https://www.pbs.org/wgbh/frontline/article/u-s-indian-health- service-gave-troubled-doctors-second-chance-patients-paid-price/)

<comment><USER8> Is it hard? Just eliminate insurance networks. Healthcare providers can set whatever prices they want for procedures. But, they must offer the same price to all customers. Insurance, medicare, cash, whatever. They must also publish the prices publicly. That would put a swift end to this nonsense.

</comment></comment><comment><USER30> Why isn't the doctor disbarred for this? It's an ethics violation, and likely not the first.

</comment><comment><USER9> But socialised medicine is insane, right?

It says that the bill was 20X more expensive than it shouldn't have been. I can't even imagine having to pay that when I go to the doctor. The NHS isn't perfect, but it's damn good.

<comment><USER31> Why would this be different under socialized medicine? A doctor can lie to a government agency as easily as lying to a private company.

<comment><USER32> Reading the article, the trick here is exploiting a loophole that exists specifically within private healthcare.

The doctor part owns/is associated with an "out-of-network" lab where the tests were sent. Healthcare providers have default listings which are typically outrageously high, and negotiate with insurers for their "actual" rates. But by the in-network doctor quietly sending the tests "out-of- network", the insurer could be charged the outrageous fee.

With single payer, the price is the price. No bullshit, shady multilateral private negotiations in a marketplace where people's health is what is being wagered.

</comment></comment></comment><comment><USER33> It's not always clear to be in these types of stories if the money actually changed hands. Just because it was invoiced, doesn't mean that's actually what was transacted.

</comment><comment><USER34> I've been wondering why coverage costs to employers have been increasing, this could be an example of a cause if it happens frequently.

</comment><comment><USER35> And rates are going up for everyone.

</comment><comment><USER36> Remember folks, physicians are the root of the problem. Don't let anybody fool you into thinking otherwise.

It's easier politically to blame corporations and whatnot. And it's true - there's plenty of leeching downstream by pharmas, PBMs, hospital admins, device makers, insurance companies, vendors, labs, and many others. But at the base of the supply funnel sit the doctors (and numerous associations like AMA, ACR, ABP, AHA, AAMC, etc) who control the entire supply through licensing and state-level regulations, and are entirely responsible for all of the atrocities. It's effectively a cartel.

There's a reason why any time there's a talk about pro-consumer regulation on the Hill like anti-surprise billing, pro-price transparency, and Medicare for All, each of these association is blasting their members with calls to contact their representatives and resist at all cost. Their argument is easy to understand emotionally - doctors will protect you from the harm, and hence there should be more licensing and supply restrictions. But this is the root of all problems in US healthcare.

<comment><USER36> Here's a couple sources

[https://www.usnews.com/news/health- news/articles/2019-07-03/...](https://www.usnews.com/news/health- news/articles/2019-07-03/california-doctors-oppose-expanding-nurse- practitioner-authorities)

Amid Provider Shortage, California Doctors Oppose Expanding Nurse Practitioner Abilities

[https://thedo.osteopathic.org/2018/10/dos-help-defeat- bills-...](https://thedo.osteopathic.org/2018/10/dos-help-defeat-bills-that- seek-to-cut-doctors-out-of-health-care/)

As APRNs and nurse-midwives ramp up their efforts to practice independently, DOs are fighting back.

[https://www.kcur.org/post/nurse-practitioners-try-shake- free...](https://www.kcur.org/post/nurse-practitioners-try-shake-free-doctors- kansas-physicians-resist#stream/0)

As Nurse Practitioners Try To Shake Free Of Doctors, Kansas Physicians Resist

[https://www.wabe.org/bid-to-loosen-rules-on-mid-level- provid...](https://www.wabe.org/bid-to-loosen-rules-on-mid-level-providers- draws-legislative-debate/)

But the vote for recommending the imaging change was 3-2 in favor, with two physicians on the panel, Sens. Ben Watson (R-Savannah) and Kay Kirkpatrick (R-Marietta), voting against.

[https://www.aei.org/carpe-diem/whod-a-thunk-it-a-medical- car...](https://www.aei.org/carpe-diem/whod-a-thunk-it-a-medical-cartel- doesnt-like-competition/)

the American Academy of Pediatrics declared that retail health clinics are "an inappropriate source of primary care for pediatric patients, as they fragment medical care and are detrimental to the medical home concept of longitudinal and coordinated care."

[https://www.politico.com/agenda/story/2017/10/25/doctors- sal...](https://www.politico.com/agenda/story/2017/10/25/doctors-salaries-pay- disparities-000557)

[https://fee.org/articles/the-medical-cartel-is-keeping- healt...](https://fee.org/articles/the-medical-cartel-is-keeping-health-care- costs-high/)

[https://www.modernhealthcare.com/patients/surprise- medical-b...](https://www.modernhealthcare.com/patients/surprise-medical- bills-becoming-more-frequent-and-costly)

Stanford University researchers found that from 2010 through 2016, 39% of 13.6 million trips to the ED at an in-network hospital by privately insured patients resulted in an out-of-network bill. That figure increased during the study period from about a third of ED visits nationwide in 2010 to 42.8% in 2016.

[https://www.npr.org/sections/health- shots/2019/12/23/7874035...](https://www.npr.org/sections/health- shots/2019/12/23/787403509/for-her-head-cold-insurer-coughed-up-25-865)

[https://www.medscape.com/viewarticle/922816](https://www.medscape.com/viewarticle/922816)

More Than Half of Doctors Get Industry Payments/Meals: Poll

[https://revcycleintelligence.com/news/aha-others-to-sue- hhs-...](https://revcycleintelligence.com/news/aha-others-to-sue-hhs-over-new- hospital-price-transparency-rule)

AHA, Others to Sue HHS Over New Hospital Price Transparency Rule

</comment></comment><comment><USER36> All non-emergency medical bills should be legally null.

That is, if you go to a doctor's office, they can try to collect payment upfront, but if they send you a random bill after the fact without your explicit price consent, it doesn't have to be paid. Similarly to how I can send a bill to y'all for the privilege of reading my post (and justify by saying it took me years of expensive training to obtain this knowledge), but you shouldn't be required to actually pay me, of course.

Emergency medicine OTOH should be socialized - everybody is covered in the US by Medicare. For every emergency admission facility can charge Medicare for all up to $X (say $300 in Kansas and $500 in San Francisco) and have to make do with that money. Patient gets between 0% and 30% copay depending on whether they are trying to abuse the system or came with a legit reason. This is the same as Kaiser today, but on a National scale.

<comment><USER37> The problem with emergency care being free and non-emergency being paid is that people will try to make things into emergencies and it discourages preventative care.

But we do need upfront pricing. It should be mandatory in non-emergency situations.

</comment></comment><comment><USER36> [https://www.manhattanspecialtycare.com/doctors/internist/](https://www.manhattanspecialtycare.com/doctors/internist/)

Roya Fathollahi, MD

Report her to the NY Medical Board and Department of Financial Services

[https://www.health.ny.gov/professionals/doctors/conduct/file...](https://www.health.ny.gov/professionals/doctors/conduct/file_a_complaint.htm)

[https://www.dfs.ny.gov/consumers/health_insurance/surprise_m...](https://www.dfs.ny.gov/consumers/health_insurance/surprise_medical_bills)</comment>


How to Eat - <AUTHOR> https://michaelpollan.com/reviews/how-to-eat/ <comment><USER2> I follow this advice, but wonder if it's sustainable when everyone switches. Doesn't packaged and processed food solve food wastage and distribution better?</comment>


FAA allows jetmakers to 'self certify' that planes meet U.S. safety requirements - <AUTHOR> https://www.washingtonpost.com/investigations/how-the-faa-allows-jetmakers-to-self-certify-that-planes-meet-us-safety-requirements/2019/03/15/96d24d4a-46e6-11e9-90f0-0ccfeec87a61_story.html <comment><USER2> That, right there, lines up exactly with what I was afraid had been going on. I'm quite impressed with Brazil for doing their own footwork to ensure their pilots are well informed.

I am abjectly horrified at the self-certification process the FAA has adopted, however.

As someone who has spent a long time doing Quality Assurance, I've learned that Engineering often develops blind spots as a result of diplomatic friction with other areas of a company, and cannot often fend off potentially dangerous technical compromises without an adversarial force capable of stopping the entire show. Even with one, if that department is still answerable to the same overarching business pressures, there is still an elevated level of slippage and inherent risk.

The FAA should never have allowed self-certification. By acting as an external quality control force, the FAA guarantees a decoupling of any financial interest on the part of the inspector, and actually acts as a unifying force against which competing airframe manufacturers can unite. It aligns incentives to keep the FAA getting better at design inspection/approval, and gets airframe manufacturers focused on making information relevant to certification as easily accessible as possible.

Trying to implement that type of mechanism in house, or through delegation aligns incentives in such a way where poor or inaccessible documentation is encouraged to make any inquiries or attempts to prove liability more difficult. It also increases the incentive for the in-house inspector to "give-in" through social forces, and workplace dynamics.

I recognize these types of dynamic everyday in software shops, but I'd never imagined it would happen somewhere that produced something that absolutely must work.</comment>


Recovery.gov has gone live  - <AUTHOR> http://www.recovery.gov/ <comment><USER2> I think the last item on the FAQ is probably the most interesting for hackers:

 _Q: Is the spending data on recovery.gov available in a format (like XML) that developers can use to create mashups and gadgets?_

 _A: Not at this time. But, as new systems are developed to capture the allocations and expenditures under the Act, we plan to make that data available in exportable form._

<comment><USER3> I find it refreshing that they even _recognize_ this question: a stark contrast to past federal "know-nothing" approaches to hacking & tech.

<comment><USER4> I'm glad their words are starting to catch up to the Republican party's deeds:

<http://www.gop.gov/api>

Open, competitive government is probably a good thing; the fact that different parts of the government are competing to see who can be more open is even better.

<comment><USER5> Just a note about that API that I read on a mailing list:

"So far the GOP API is useless, most of the methods do not work and the ones that do are still having issues.

I've spoken to the gop.gov team about this and they informed me they were forced to launch before these features were ready.

Most of the data they offer though seems like it'll be member/bill data that is already widely available"

<comment><USER4> I knew we could live up to our reputation! (Thanks for the update)

</comment></comment></comment></comment></comment><comment><USER6> This is part of the bill^.

 _SEC. 1201. TRANSPARENCY REQUIREMENTS. (b) (1) (A)

Each such agency shall notify the public of funds obligated to particular infrastructure investments by posting the notification on the website Recovery.gov._

[Continues from there... details at SEC. 1226. RECOVERY.GOV.]

This site improves accessibility but not transparency. All congressional bills are already readily available... but it's limited to watchdogs and those few that are motivated enough to find and read them.

^ <http://appropriations.house.gov/pdf/RecoveryBill01-15-09.pdf>

EDIT: Formatting.

<comment><USER7> Coincidentally, the Wiki on TransparentAccounting.org also went "live" today: <http://www.transparentaccounting.org/wiki/us>

The words "accountability" and "transparency" (from Recovery.org) do seem to be used much more frequently by the Obama Administration than its predecessor. This makes me think that the wiki just might work.

I don't know how much work needs to be done on a wiki before blowing the kazoos and writing the press releases. What might be the best way to go about building the site? Starting with abbreviations seems like a good idea, as it seems both techies and government people love the acronyms.

Any and all thoughts / ideas / opinions are welcome.

</comment></comment><comment><USER8> Why do Tax Cuts contain $61B for Protecting the Vulnerable when there is already a Protecting the Vulnerable category with $81B?

Also, if Obama were really interested in transparency, he would direct the Treasury and Federal Reserve to comply with the FOIA requests made by the media regarding the TARP and the liquidity injections.

<comment><USER9> Because that lets politicians talk about $BIGNUM in "tax relief" and also $BIGNUM2 in "protecting the vulnerable"?

Another fun fact, obscured by the headlines, is that "tax relief" includes wealth transfers from taxpayers to non-taxpayers (<http://www.investopedia.com/terms/r/refundablecredit.asp>).

</comment></comment><comment><USER10> Ironic that Obama's approach to tech is open source and decentralized, but his approach to the economy is command and control.

</comment><comment><USER11> Aside: I hear via twitter that it's running Drupal.

<comment><USER12> Looks like it, there's mention of drupal in a javascript call near the bottom of the source. Nice clean html too from a quick glance - wonder if this is the same team as did Obama's election site, similar visual style. Good stuff.

<comment><USER13> It isn't. Blue State would never use Drupal. Blue State uses Expression Engine and their own suite of tools.

<comment><USER11> Hmm. The URLs are pretty tell-tale Drupal:

* <http://www.recovery.gov/modules/pathauto/pathauto.js> * <http://www.recovery.gov/?q=content/impact>

(Though Drupal is fully capable of having pretty URLs that would have made that less visible.)

<comment><USER13> Oh, it is very clearly Drupal. That was not the intent of the comment. The intent of the comment was that it _is_ Drupal, and thus Blue State Digital (the BarackObama.com web vendor) was not behind the construction of the site.

<comment><USER11> Ah. Gotcha. Thanks for the clarification. I've learned a lot about these kinds of web sites from your submissions/posts, keep 'em coming!

</comment></comment></comment></comment></comment></comment><comment><USER14> I don't have much to say about the actual plan, but it's just so nice to see this stuff online.

<comment><USER15> Agreed. If the transparency Obama claims materializes, it could end the grafting and pork.

Also, this website could keep a handful of people employed! Yay!

<comment><USER16> "If the transparency Obama claims materializes, it could end the grafting and pork."

Have you read much about this bill?

<comment><USER17> Even published on the recovery.gov site, it is still difficult to hone in on specific information. The bill is just entirely to big to be easily "accessible." Some type of smart search engine for it would be handy.

<comment><USER16> How confident does this make you that anyone read and understood this bill before voting for it?

<comment><USER18> You guys understand that acts are essentially patches to apply to the US Code, right? Literally, they read "insert, in paragraph 5a, after 'is the domain of', 'Hacker News and'

The GPO, however, only prints the full code once every six (six!) years. They've got a room full of people reading and double-checking that they're writing exactly what's in the bills. Very archaic. Someone should apply a modern versioning system so the code is in black and the effects of bills are in red (and blue and green, like alexa or Google Trends does graphs, but with text), so the public can see not just the bill, but what the changes look like in real time. It's shouldn't be hard at all.

I'll bet someone could do this with GitHub by this weekend and have a site up by the end of the month.

<comment><USER19> Very interesting... I wonder if there's a business here? Free access to the text for the public, with premium features for people/orgs willing to pay?

<comment><USER20> Funny you should mention that. I've been working with a friend on something along this line for the last two weeks. We are looking to announce a beta launch here sometime next week. The site is going to be called Democritique. Stay tuned.

<comment><USER19> Sounds interesting; certainly look forward to hearing more.

<comment><USER17> I'd like to let everyone know that we have launched our Fourth Branch, <http://www.fourthbranch.us>, for use and testing. It took us longer than planned to move to production, but our initial version is considerably better than what we previously intended.

In a nutshell, Fourth Branch will act exactly as that: The fourth branch of government. The emphasis on publicizing legislation and providing government transparency has lead us to develop this. Unlike anything to date, we are going to utilize proven social networking practices and focus it on legislation and issues that require public input.

We are looking for any and all comments, criticism and feedback to help us develop quickly. Thanks!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Read the fine print(!):

* Tax Relief - includes $15 B for Infrastructure and Science, $61 B for Protecting the Vulnerable, $25 B for Education and Training and $22 B for Energy, so total funds are $126 B for Infrastructure and Science, $142 B for Protecting the Vulnerable, $78 B for Education and Training, and $65 B for Energy.

So the largest bubble, tax relief, actually includes the other bubbles? Wouldn't the normal expectation that if there is one large bubble marked tax relief that it actually represent tax relief and not science spending? Or is that just an almost transparent attempt to pander to people who want tax cuts? Help me understand this!

</comment><comment><USER22> transparent government isn't really a solution unless people are willing to act on the data. but we have already shown that this isn't the case. when people hear of corruption are the people involved outed? for the most part no.

<comment><USER23> I don't think that's fair. Exposing government data in general will allow people (citizens, consumers, whatever...) to see _systemic_ corruption. Often when we hear of corruption, it is represented as a single point (politician X, company y, etc...) of failure in the democratic system.

Exposing data like thins allows the citizenry to be data driven instead of anecdotal and emotional. I think that's the important break from past governmental practices.

<comment><USER22> maybe young people see it as a single failure. most people over the age of 30 know better.

besides, what is the punishment model of our democracy? voting the other party in? yeah, that works.

I vote for a return of the public gallows.

<comment><USER23> I think you and I are in agreement. The feedback mechanism of the republic is broken because there is no punishment. You are correct when you say, "most people over the age of 30 know better." However, I believe that people under 30 understand that too. The difference with making data publicly available is that we can _quantify_ how systemic the problem is. Punishment to our representatives is difficult the same way it is difficult to punish most white collar crimes--it's easy to perform complected book cooking in ways that most can't follow. Making the data available will allow people with those abilities to monitor activity in the public. Or put another way, "Given enough eyeballs, all bugs are shallow."

I think once the hard evidence is in we'll see less and less of the party support mechanisms because the corruption can be so easily proven that congress critters will scatter once a little light is shown on their dirty deeds. Then new (possibly younger) data-driven representation will take their place. In my rough back-of-no-envelope estimation, this will take at least a generation.

<comment><USER22> to break this down: you think that showing that the _degree_ of corruption is constant (systemic corruption) will have a greater impact on the public conscious than traditional methods of exposing gov. corruption because the traditional methods have so much variance.

this could very well be true. I will be watching developments in this area.

</comment></comment></comment></comment></comment><comment><USER21> The design of this and whitehouse.gov drive me crazy. The gratuitous use of italics randomly in headings always seems to emphasize the wrong part of the sentence. Right on the front page of this site we have "Your money _AT_ work". Now why on earth would you emphasize the least important word in the phrase? It makes it sound like someone who can't quite make out some handwriting is narrating the page. Maybe a minor nitpick that not everyone notices, but in my case I find it really detracts from the readability and professional veneer these sites are trying to achieve.

</comment><comment><USER24> Unfortunately "Q: Is the spending data on recovery.gov available in a format (like XML) that developers can use to create mashups and gadgets? A: Not at this time. But, as new systems are developed to capture the allocations and expenditures under the Act, we plan to make that data available in exportable form"

[http://www.recovery.gov/?q=content/frequently-asked- question...](http://www.recovery.gov/?q=content/frequently-asked-questions#17)

</comment><comment><USER25> Very cool site. They're using opensource Javascript from MIT's Simile Project to power the timeline at the bottom. Good incorporation of an existing, powerful opensource resource: [http://www.newmediacampaigns.com/page/recoverygovs- javascrip...](http://www.newmediacampaigns.com/page/recoverygovs-javascript- timeline-graduated-from-mit)

<comment><USER26> i got it to go past 4000 BC. any idea when it ends?

<comment><AUTHOR> Hey, you can never be too careful when it comes to economic recoveries.

For instance, what if Bernie Madoff is secretly plotting to use a frozen donkey wheel to make us travel through time?

Yeah. That's what I thought.

</comment></comment></comment><comment><USER27> This is transparency after the fact. The actual bill was only available for review for something like 10 hours before it was voted on and passed. 1100 pages in 10 hours? Great.

This information should available on ALL bills at least a week before the bill is voted on by congress. I for one am appalled at how this thing was driven through.

</comment><comment><USER21> For a much more insightful breakdown, <http://stimuluswatch.org/> has a pretty interesting listing that allows people to vote, comment, and offer arguments for and against individual items.

</comment><comment><USER28> Neat to see all the open source software being used (Apache, PHP, MySQL, Drupal, jQuery, MIT Simile Timeline, etc). And once again YouTube is front and center.

Mix in an API and they'll be rocking.

</comment><comment><USER29> "Mission Accomplished"

...</comment>