Philosophy

Vol.:(0123456789) Science and Engineering Ethics (2021) 27:23 https://doi.org/10.1007/s11948-021-00301-0 1 ORIGINAL RESEARCH/SCHOLARSHIP Privacy versus Public Health? A Reassessment of Centralised and Decentralised Digital Contact Tracing Lucie White1 * Philippe van Basshuysen1 Received: 2 December 2020 / Accepted: 18 March 2021 © The Author(s) 2021 Abstract At the beginning of the COVID-19 pandemic, high hopes were placed on digital contact tracing. Digital contact tracing apps can now be downloaded in many countries, but as further waves of COVID-19 tear through much of the northern hemisphere, these apps are playing a less important role in interrupting chains of infection than anticipated. We argue that one of the reasons for this is that most countries have opted for decentralised apps, which cannot provide a means of rapidly informing users of likely infections while avoiding too many false positive reports. Centralised apps, in contrast, have the potential to do this. But policy making was influenced by public debates about the right app configuration, which have tended to focus heavily on privacy, and are driven by the assumption that decentralised apps are "privacy preserving by design". We show that both types of apps are in fact vulnerable to privacy breaches, and, drawing on principles from safety engineering and risk analysis, compare the risks of centralised and decentralised systems along two dimensions, namely the probability of possible breaches and their severity. We conclude that a centralised app may in fact minimise overall ethical risk, and contend that we must reassess our approach to digital contact tracing, and should, more generally, be cautious about a myopic focus on privacy when conducting ethical assessments of data technologies. Keywords COVID-19 * Digital contact tracing * Privacy * Efficacy * Risk * Data ethics Introduction Contact-tracing apps were initially heralded as the key to keeping the spread of COVID-19 under control, but this promise has been all but abandoned, with governments now downplaying the potential efficacy of the measure, and suggesting that it * Lucie White email@example.com 1 Leibniz Universität Hannover (Institut für Philosophie), Hannover, Germany 1 3 23 Page 2 of 13 will have, at best, a limited role among a host of other mitigation measures (Lomas, 2020b; Taylor, 2020). We argue that this is partially due to the specific "decentralised" configuration of the app (that is, a configuration in which most information is stored on the user's own phone rather than on a central server) that has been adopted in many countries, which, after a debate in which the voices of privacy advocates featured strongly, has come to be largely regarded as the ethically superior alternative, because it is "privacy preserving by design". We contend, on the contrary, that an app with a different configuration, namely, an app that stores some pseudonymised information on a central server (that is, a "centralised" app), and that allows for reporting before a confirmed test, shows promise in increasing the efficiency of the measure. Once this is clear, it also becomes apparent that we must widen our focus beyond privacy concerns. Rather, we might be thought to be faced with a sort of trade-off of ethical risks: with risks of privacy infringements on the one hand, and risks of impairing efficacy, and thus of forgoing public health benefits, on the other. We argue that, rather than being privacy preserving by design, decentralised systems entail risks of breaches too. Then, drawing on principles from safety engineering and risk analysis, we compare the risks of centralised and decentralised systems along two dimensions, namely the probability of possible breaches and their severity. In order to make up for the higher probability of achieving public health benefits that centralised systems can provide, decentralised systems would need to exhibit considerable advantages on at least one of these dimensions, which we argue is not the case. Thus, once we understand the type of ethical trade-off that must be conducted here, we can see that the centralised app may indeed be ethically preferable. Our proposed approach for assessment provides a way of incorporating, but also looking beyond, privacy concerns in the evaluation and assessment of data technologies. The case of digital contact tracing in the COVID-19 pandemic presents us with a cautionary tale against letting privacy concerns dominate debates on data technologies, and overall risk analysis provides a potential means of widening our scope to encompass and evaluate other ethical concerns. To Increase Its Chances of Being Effective, Digital Contact Tracing Requires Centralised Data Storage There is, by now, consensus that two factors are key if a contact-tracing app is to make a significant impact on viral spread: it will need sufficiently high uptake, and it will need to allow for very fast intervention (i.e. persons that are likely to be infected must be identified and quarantined very quickly) (Braithwaite et al., 2020; Kretzchmar et al., 2020). There has been some discussion of various ways in which uptake might be increased (see e.g. Hernández-Orallo et al., 2020; Loi, 2020). We 1 3 Page 3 of 13 23 will focus here on increasing the efficiency of the app through increasing the speed at which contacts can be identified and quarantined.1 There is an obvious way to do this. At present, digital contact-tracing systems require that persons receive a positive PCR test before reporting on the app that they are positive for COVID-19 (which then results in an alert to those who they have been in high-risk contact with, advising them to self-quarantine and/or get tested) (Ahmed et al., 2020).2 The process could be sped up significantly if people could report that they might be infected immediately upon experiencing potential symptoms. This is particularly essential for COVID-19, because it appears that individuals become infectious shortly after they themselves are infected, and that a substantial degree of virus transmission occurs before the onset of symptoms (Ganyani et al., 2020; He et al., 2020). Allowing for reporting directly at symptom onset would allow contacts to be alerted to quarantine before they have begun to experience symptoms, thus isolating them before they are well into their window of infectiousness. Indeed, some mathematical modelling suggests that "delaying contact tracing by even half a day from the onset of symptoms can make the difference between epidemic control and resurgence" (Hinch et al., 2020). No matter how quickly PCR testing can be conducted, it seems very difficult to imagine that tests can be routinely sought, administered, the results received, and reported in the app within this small window. Given the agreement that speed is of the essence here, how did it come about that such a configuration has not been implemented? We suggest that this is largely due to the development of the debate on contact tracing apps. Such a system, we will show, requires that some information is stored on a centralised server. But the early debate on contact tracing apps quickly became dominated by privacy concerns. Privacy advocates argued that the centralised storage of information entailed the unacceptable risk of privacy breaches, and that an app configuration in which most information was stored in a decentralised manner (i.e. on the user's own smartphone) is "privacy preserving by design" and thus ethically superior (see e.g. Joint Statement, 2020; Lomas, 2020a; Troncoso et al. 2020). The original proposal to store information on a centralised server, and thus allow for reporting before a test, was made by Ferretti et al. (2020) and Hinch et al. (2020), and was originally used as the basis for the UK's centralised contact tracing app. However, as privacy advocates continued to make a stand against the centralised storage of information, Apple and Google announced that they would only support governments developing decentralised apps, providing them with the toolkit to accurately detect contact events, and to allow the app to run in the background while users go about their daily business (Scott et al. 2020). After persevering for a while with their centralised app, the UK was ultimately unable to independently solve these technical problems, and abandoned their centralised approach in favour of the decentralised option that could 1 It should also be noted that increasing the speed and thus efficiency of the app might also compensate to a certain degree for lower uptake, allowing for outbreak control without requiring an unrealistically high proportion of the population to use it (see Hernández-Orallo et al., 2020). 2 Often by issuing them with a code which they must enter into their app when submitting a positive report, see e.g. Dillet, 2020; Robert Koch Institute, 2020. 1 3 23 Page 4 of 13 meet Apple and Google's requirements for cooperation, while at the same time beginning to downplay the importance of digital contact tracing altogether (Lomas, 2020b). Other countries, such as Australia, Singapore (Criddle & Kelion, 2020) and Germany (Scott et al., 2020) also considered or pursued a centralised app before switching to a decentralised configuration to work with Apple and Google. Before we turn to the concerns of privacy advocates that so shaped the trajectory of contact-tracing apps during this pandemic, we will briefly outline why the storage of some information in a centralised manner is necessary to allow for rapid reporting. First, we will need to get into the fundamentals of how contact-tracing apps work. Most contact tracing apps work on the basis of Bluetooth signals, which are used to gauge when two people (or, at least, their phones) come into close contact, and for how long. Each person is assigned a frequently-changing series of ID-numbers ("ephemeral identifiers"). When two people come into proximity, their phones exchange ephemeral identifiers via Bluetooth. When someone reports that he is positive for COVID-19 on the app, anyone who has this person's ephemeral identifiers on her phone during the estimated window of infection can be immediately alerted and sent into quarantine. The difference between a decentralised and centralised app configuration, as already mentioned, inheres in where information is stored. In a decentralised app, the ephemeral identifiers are created and stored on each individual user's smartphone. The central server only comes into play when a user reports as positive-in this case, his own ephemeral identifiers for the period of infection are uploaded to a central server and then broadcast to all app users, who are then alerted when one of these identifiers is stored on their phone. In a centralised app configuration, the central server plays a larger role: each user is assigned a permanent pseudonymous identifier, which is stored on the central server. Ephemeral identifiers are created on the server, and sent to each user's phone. Phones exchange ephemeral identifiers, and when a user reports as positive, the ephemeral identifiers of his contacts are sent to the server, which matches these to their permanent identifiers and alerts the corresponding contact (Vaudenay, 2020). It is this storage of a permanent identifier that allows centralised contact tracing apps to accommodate reporting before a test-because this provides a way of dealing with false positive reports. As many may have anticipated, this will clearly be a problem when users can submit reports before a confirmed infection. The symptoms for COVID-19 can be difficult to identify, leading to the possibility that many positive reports might arise from genuine mistakes. There is also the possibility that some users might submit malicious false reports in order to disrupt the system. One possibility for mitigating the impact of false reports could be to require that reports are followed up with a positive test within a certain period of time-contacts could be temporarily quarantined, and then released, say, three days later if no follow-up test is forthcoming. The problem with this strategy is it is likely to break down completely when there is any delay accessing a test, or any shortage of tests. It also requires that a sufficient amount of users are diligent enough to follow up their report by immediately seeking a test and reporting their results. If any of these conditions are not met, either the quarantine period must be extended to allow time for a test to be sought, conducted and reported (leading to longer periods of erroneous 1 3 Page 5 of 13 23 quarantine), or contacts must simply be released where no follow-up is forthcoming (which could lead to the release of too many true positive cases, hampering the effectiveness of the measure). However, there is an alternative way to identify false positive reports, contingent on the ability to identify clusters of cases. When a certain proportion of an index case's contacts subsequently contract the virus, we can identify a cluster. When none (or few, depending on the background rate of infection) of an index case's contacts subsequently become infected, this might indicate that the initial report was a false positive (Hinch et al., 2020). This can proceed on a centralised app by following contacts over time. The server in a centralised app has enough information to determine, on the basis of the permanent identifiers of users, whether an initial report is followed by subsequent reports from contacts (and how many, and the duration and proximity of the contact). This provides a means of identifying likely false positive reports in the absence of a follow-up test, and a means of releasing users from quarantine. This can all proceed without directly identifying any of the app's users- permanent pseudonymous identifiers will suffice for this purpose. In a decentralised app, there is no way to identify clusters-each smartphone only holds the ephemeral identifiers of direct contacts, and the server only holds the ephemeral identifiers of infected users for the period of infection. There is no way to track contacts through time and thus identify clusters of infection, or, more to the point, a lack thereof, indicating a likely false positive report. To summarize, it is clear that speed of contact tracing will be absolutely crucial as a means to stop the viral spread of COVID-19 (or other viruses like it). Even short delays can significantly diminish the effectiveness of this measure. We can speed up the process (from identification of a likely case to quarantine) by allowing people to report as positive on the app directly upon experiencing symptoms of COVID-19. This, however, leads to the problem of false positive reports. We can mitigate this problem, minimising the duration of erroneous quarantines, by identifying where a report of infection is not followed up by (a sufficient number) of subsequent reports from contacts, indicating a likely false positive report, and allowing for the early release of contacts. But this can only be done when the permanent identifiers of app users are stored on a central server, allowing us to track contacts through time.3 Inherent Safety versus Secondary Prevention Measures Having established that, in order to increase the chances of being effective, digital contact tracing requires the centralised storage of some pseudonymised information concerning each user, we will now turn to a general ethical evaluation of the different contact tracing options. There are various values that should guide the design and implementation of contact tracing apps and ethical challenges that should be 3 The collection of these data on a central server may have further advantages, for instance, as input for epidemiological research or public health care planning (Lucivero et al., 2020). Centralised storage is thus also conducive to important public health values. 1 3 23 Page 6 of 13 met (Lucivero et al., 2020; Ranisch et al., 2020). While many substantive and procedural values, such as justice and transparency, can be expected to be had "for free", that is, without violating other important values, we will focus here on those that might generate trade-offs that will be crucial for an ethical evaluation: namely, is there a configuration of the app with the ability to achieve the public health benefits it is supposed to achieve, while at the same time respecting its users' privacy? Or does the fulfilment of one of these values require a configuration that risks impairing the other? As we have shown, the centralised storage of data allows us to configure the app in a way that can make it faster and thus more effective, allowing for increased public health benefit (through better interrupting chains of infection). However, advocates of decentralised systems contend that apps for digital contact tracing should be "privacy preserving by design" (Joint Statement, 2020). They argue that this condition can be satisfied by decentralised systems, but not by centralised ones, because the centralised storage of information entails the risk of breaches that, if realised, would infringe on users' privacy (Joint Statement, 2020; Troncoso et al., 2020). If this argument holds water, we are faced with a stark trade-off between respecting users' privacy on the one hand, and reaping the public health benefits from an app on the other. To evaluate the argument, it is instructive to compare this notion of "privacy preserving by design" to a principle from safety engineering, namely inherent safety: a design is inherently safe if it eliminates a potential hazard altogether, rather than applying additional safety measures to decrease its risk of being realised (Möller & Hansson, 2008). For instance, making use of fireproof materials is inherently safe while using inflammable materials is not. While the risk of a major fire occurring in the latter case could be reduced by means of a "secondary prevention", such as installing a sprinkler system, the former option is a safer alternative, all else being equal. This is because the sprinkler system might fail through some unfortunate sequence of events, or be destroyed by a malicious actor, in which case a major fire might occur, while this is ruled out entirely if the hazard is removed (Hansson, 2010). Advocates of decentralised systems can be understood as arguing that their preferred systems are inherently safe ("privacy preserving by design"), while centralised systems are not. In centralised systems, we have to trust that the information on the central server can be adequately protected against breaches (Ahmed et al., 2020), and in order to underwrite this trust, legislation would need to be enacted and strictly enforced that would prevent information on the server from being accessed and used for foreign purposes (for instance, by law enforcement).4 But, being secondary interventions, these regulations cannot entirely exclude risks of breaches. These breaches might reveal the social graph, that is, a graph that depicts social ties between users (Troncoso et al., 2020). In contrast, "decentralised systems have no distinct entity that can learn anything about the social graph" (Joint Statement, 2020). By removing the hazard entirely, these systems presumably rule out the risk of breaches and are inherently safe. 4 We will return to this point presently. 1 3 Page 7 of 13 23 The argument that centralised systems entail risks of breaches, while decentralised systems rule out such risks, has been influential in debates about digital contact tracing and was part of the reason that centralised apps have fallen out of favour in many places. For instance, the European Parliament resolution on EU coordinated action to combat the COVID-19 pandemic and its consequences demands that "the generated data are not to be stored in centralised databases, which are prone to potential risk of abuse and loss of trust and may endanger uptake throughout the Union... all storage of data [must] be decentralised" (European Parliament, 2020). However, as engineers are well aware, inherent safety is not always possible as it may reduce the likelihood that a given design achieves its purpose (Möller & Hansson, 2008). We have suggested, thus far, that this might be such a case-it is the very collection of this information that decentralised advocates worry could be unmasked to reveal the social graph that allows centralised servers to identify whether clusters result from infections, and thus opens up the possibility of allowing for more rapid reporting. It seems, then, that failing to collect this information, even if it were to inherently protect the system against privacy breaches, might undermine the efficiency of the system, leaving it less able to achieve its purpose: controlling of the spread of infection. It is thus not clear, in this particular case, that inherent safety is to be preferred. Evaluating Ethical Risks: Probability and Severity But there is also a second problem here-cryptographers have cast doubt on the claim that decentralised systems are in fact inherently safe, as it is not central storage of data alone that entails risks of breaches (Ahmed et al., 2020; Vaudenay, 2020). Rather, they argue that different systems entail risks of different kinds of breaches. While a chief concern raised against centralised systems is that a malicious authority might access information on the government-administered, central server and identify users and their contacts, thus revealing the social graph, a problem with decentralised systems is that, because users' ephemeral identifiers are stored on their phones, access to an individual's phone would reveal more information than in a centralised system. Vaudenay suggests, for example, that in a decentralised system, "after a burglary during which a Bluetooth sensor captured an ephemeral identifier, suspects could have their phones inspected for two weeks to find evidence" (2020, p.6). Vaudenay notes, in addition, that an individual's smartphone is much easier to hack than a central server. Furthermore, decentralised systems are more vulnerable to breaches that would identify infected users. This is because all of a user's ephemeral identifiers are uploaded to a central server when they report as infected. Because these identifiers are accessible to any user of the app, it is possible for any user to identify infected users, by recording a user's identifiers and later comparing them to the identifiers stored on the server (Tang, 2020). If neither centralised nor decentralised systems are inherently safe, but rather entail risks for different kinds of breaches, how should these risks be traded off against each other? It might at first glance seem that preventing the risk of a major fire-that is, revealing the social graph-is more important than preventing the 1 3 23 Page 8 of 13 risk of small fires-identifying single infected users, and thus that concerning the risks of privacy breaches, decentralised systems are clearly preferable to centralised systems. However, it is not clear whether this is true. According to standard usage in professional risk analysis, "risk" refers to the expectation value of an unwanted event, that is, the product of the probability of that event happening and a measure of its severity, or "disvalue" (Hansson, 2004, p. 10). Adopting this notion for the comparison of the risks of different kinds of breaches, there are two dimensions that must be compared here, namely the probability of the breaches happening, and their severity, respectively. As to their severity, it might appear from outside that the disvalue from revealing the social graph is more severe than that of single infected persons being identified. However, users who are concerned about being identified in this way if infected may come to the opposite conclusion. This is backed up by empirical evidence; a survey conducted by Li et al. (2020) suggests that users are more concerned by the privacy vulnerabilities of a decentralised system, and would be more likely to use a centralised app, based largely on concerns about privacy. In this study (in which, notably, they assumed that users would be directly identifiable by central authorities in a centralised system, rather than being issued a pseudonymous identifier), some of those surveyed considered government authorities trustworthy and were willing to provide their information to them, while expressing concerns about the vulnerabilities of the decentralised system to leak information to tech-savvy individuals. Others expressed concerns about privacy violations in both systems, but regarded the vulnerabilities of decentralised systems as "a more severe threat" (2020, p.20). How, then, do the probabilities of the different kinds of breaches happening compare? In decentralised systems, the probabilities of breaches appear to be high, because any user could in principle identify infected users in the manner described above; in contrast, breaches in centralised systems would be very difficult to achieve, and would probably require a malicious government authority to store additional information as an app user registers, which would make identification possible (Vaudenay, 2020). Thus, concerning the likelihood of breaches, centralised systems may have an advantage over decentralised ones. Thus, when we compare the risks of the different kinds of breaches, it is not clear whether decentralised systems display an advantage on the severity dimension, while centralised systems exhibit a clear advantage on the likelihood dimension. Equipped with these results, we can now turn to the overall ethical evaluation of the two kinds of digital contact tracing options. There are two substantive kinds of ethical risks involved here: risks for privacy, and risks for public health if the contact tracing effort turns out to be ineffective. Some have argued that the risks for privacy may be acceptable if an app is an effective means of achieving public health benefits (Ranisch et al., 2020; Schaefer & Ballantyne, 2020). These two kinds of ethical risks are, however, difficult to trade off against each other, or might even appear incommensurable, and any particular claim about how they might compare will likely be subject to criticism. Rather than directly comparing the benefits and risks for public health and privacy, we merely draw on the principle that other things being equal, the higher the likelihood of a system being effective in bringing about public health benefits, the higher the level of risks for privacy that should be regarded as 1 3 Page 9 of 13 23 acceptable. Thus, because the likelihood of centralised systems being effective is higher, other things being equal, a higher level of risks for privacy may be acceptable. In other words, to possibly outweigh the risks for public health, the privacy risks in decentralised systems would have to be clearly much lower than those inherent in centralised systems, as might be the case if decentralised systems were to fare much better on both risk dimensions-that is, if the severity of possible breaches were clearly lower and their likelihood were lower, too. But we have argued that this is not the case. Because the overall ethical risks from centralised systems are thus lower, they should be regarded as an ethically preferable alternative to decentralised systems. Installing a Sprinkler System Now that we have identified and evaluated the risks in both centralised and decentralised systems, we should return to the notion of secondary prevention measures. We have now established that both centralised and decentralised systems entail risks: neither of these systems are inherently safe when it comes to privacy breaches, and so both will require secondary prevention measures to mitigate privacy risk. Constructing and implementing such measures is certainly no small task for either system. Vaudenay presents a pessimistic view of the possibility of mitigating the propensity of decentralised systems to reveal the identity of infected users, contending that these attacks "are undetectable, can be done at a wide scale, and...proposed countermeasures are, at best, able to mitigate attacks in a limited number of scenarios." Attacks to centralised systems, on the other hand, he suggests, can be better identified and mitigated by "accounting and auditing" (2020, p.6). This does not quite tell the whole story; we will need an adequate infrastructure in place to protect the centralised server against misuse of the information it stores, particularly by the government authority that is entrusted with this information. This will require legislation explicitly limiting the type of information that can be collected, and preventing the use of contact tracing data for non-public health purposes, such as that introduced in some US states (New Jersey Department of Health, 2020; New York State Senate, 2020). It requires a robust and independent judicial system that will stringently enforce these requirements (see e.g. the Provincial Court of British Colombia's 2014 decision about the disclosure of information concerning HIV-positive individuals). In addition, it necessitates agencies that have the autonomy to conduct the kind of "accounting and auditing" of the system that Vaudenay points out could allow us to spot problems. It should not be expected that these elements will simply fall into place without careful oversight, discussion and planning. But nor should it be assumed that these risks cannot be minimised. Just as many countries allow the collection of (non-pseudonymised) information for manual contact tracing purposes, or some countries allow the centralised storage of digital health records, such a policy should be approached with awareness of the risks and the measures necessary to mitigate them, but not completely taken off the table. It is also noteworthy that, while we have focused on general lockdowns and decentralised digital contact tracing as our 1 3 23 Page 10 of 13 points of comparison here, other potential pandemic mitigation measures involve ethical risks too. General lockdowns involve direct health risks and economic damages that may entail further risks for public health. Some other measures have been proposed to overcome lockdowns. For instance, Savulescu and Cameron, (2020) propose a policy of selectively locking down the elderly, while allowing the rest of the population to go about their lives unhindered. However, it has been argued that such a selective isolation policy would severely discriminate against the elderly (van Basshuysen & White, 2020; White & van Basshuysen, 2020). Such discrimination would risk violating another substantive value, namely justice (Ranisch et al., 2020). Given that in a pandemic such as COVID-19, there are no risk-free options, the risks of centralised contact tracing, particularly when we take into account the risks inherent in our alternative options, might indeed be worth taking under these circumstances. Conclusion We have argued that in order to provide us with an appropriate balance between a general lockdown and unrestrained viral proliferation, contact-tracing apps must collect some pseudonymised information about their users on a central server. However, privacy advocates have expressed concerns about such a system, contending that contact-tracing apps should be "privacy preserving by design", while at the same time arguing that this cannot be achieved by systems that rely on central data storage. According to this line of argument, only decentralised systems can be designed to preserve privacy, as these systems can preclude breaches by storing very little data on central servers. We have evaluated this argument by drawing on a principle from safety engineering-that we should typically strive to make a design inherently safe, rather than merely reducing the likelihood of potential hazard through secondary prevention. We argued, however, that decentralised systems are not inherently safe (i.e. fail to be "privacy preserving by design"), primarily because these systems broadcast the ephemeral identifiers of infected users, which can be used to identify these users. After showing that both systems entail privacy risks, we conducted an assessment of the overall ethical risks of centralised and decentralised systems, taking into account that digital contact tracing options may not only involve risks for privacy, but may also involve considerable risks for public health if they fail to allow for effective contact tracing. While trading off the risks for privacy against those for public health would be difficult and any particular claim about how these risks might compare might be disputed, our argument does not rely on a comparison of these two kinds of risk. Rather, we argued that, if the likelihood of a system being effective is higher, other things being equal, a higher level of risks for privacy should be regarded as acceptable. Because decentralised systems have a smaller chance of being effective, it follows that their ethical risks would only compare favourably to centralised systems if the latter were to entail privacy risks that are clearly much higher than those of decentralised systems. This might be the case if decentralised systems were to fare much better on both 1 3 Page 11 of 13 23 risk dimensions-that is, if the severity of possible breaches were clearly lower and their likelihood were lower, too. We argued, however, that this is not the case. It follows from this risk assessment that, all things considered, centralised systems should be seen as involving less overall ethical risk than decentralised systems, and may thus be the ethically preferable option. Where does this leave us with respect to ethically justifiable policy making concerning digital contact tracing, and the technological use of personal data more generally? The privacy advocates' arguments have been influential in debates about digital contact tracing and, backed by Apple and Google's strategy to make it difficult to produce a centralized app which can function effectively on their smartphone systems, they have apparently led policy makers in most countries to implement decentralised systems. It follows from our risk assessment that these policy makers may well have been misled, as centralised systems are in fact the option that could minimise overall ethical risks. The trajectory of this debate provides us with reason to be cautious about allowing privacy concerns to trump other relevant values. Others have pointed to further problems with focusing solely on data privacy to the neglect of other ethical issues, both in the context of contact-tracing apps (see Sharon, 2020) and in other uses of data (e.g. Prainsack & Buyx, 2016). By conducting an overall risk analysis, we can widen our focus to incorporate other considerations and draw them into our ethical assessment of data technologies.5 Author Contributions Both authors contributed to the conception, drafting and revision of the manuscript. Funding Open Access funding enabled and organized by Projekt DEAL.. This research was funded by the Volkswagen Foundation within the project "Digital Contact Tracing, Privacy, and Discrimination: On the Ethics of Fighting Corona". Declarations Conflicts of interest The authors declare that they have no conflict of interest. Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http:// creat iveco mmons. org/ licen ses/ by/4. 0/. 5 Many thanks to an anonymous reviewer, whose helpful comments allowed us to significantly improve the manuscript. 1 3 23 Page 12 of 13 References Ahmed, N., Michelin, R., Xue, W., Ruj, S., Malaney, R., Kanhere, S., Seneviratne, A., Hu, W., Janicke, H., & Jha, S. K. (2020). A survey of COVID-19 contact tracing apps. IEEE Access, 8, 134577– 134601. https:// doi. org/ 10. 1109/ ACCESS. 2020. 30102 26. Braithwaite, I., Callender, T., Bullock, M., & Aldridge, R. (2020). Automated and partly automated contact tracing: a systematic review to inform the control of COVID-19. Lancet Digital Health, 2, e607–e621. https:// doi. org/ 10. 1016/ S25897500(20) 30184-9. Criddle, C. & Kelion, L. (2020). Coronavirus contact tracing: world split between two types of app. BBC News, 7 May. https:// www. bbc. com/ news/ techn ology52355 028. Accessed 17 Nov 2020. Dillet, R. (2020). France rebrands contact-tracing app in an effort to boost downloads. TechCrunch, 22 October. https:// techc runch. com/ 2020/ 10/ 22/ francerebra ndsconta cttraci ngappinanefforttoboost downl oads/? gucco unter=1. Accessed 6 Nov 2020. European Parliament (2020). European Parliament resolution of 17 April 2020 on EU coordinated action to combat the COVID-19 pandemic and its consequences (2020/2616(RSP)). https:// www. europ arl. europa. eu/ doceo/ docum ent/ TA-920200054_ EN. pdf. Accessed 17 Nov 2020. Ferretti, L., Wymant, C., Kendall, M., Zhao, L., Nurtay, A., Abeler-Dörner, L., Parker, M., Bonsall, D., & Fraser, C. (2020). Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing. Science, 368(6491), 1–7. Ganyani, T., Kremer, C., Chen, D., Tornerl, A., Faes, C., Wallinga, J., & Hens, N. (2020). Estimating the generation interval for COVID-19 based on symptom onset data. Eurosurveillance. https:// doi. org/ 10. 2807/ 15607917. ES. 2020. 25. 17. 20002 57. Hansson, S. (2004). Philosophical perspectives on risk. Techné, 8(1), 10–35. Hansson, S. (2010). Promoting inherent safety. Process Safety and Environmental Protection, 88, 168–172. He, X., Lau, E., Wu, P., Deng, X., Wang, J., Hao, X., Lau, Y. C., Wong, J. Y., Guan, Y., Tan, X., & Mo, X. (2020). Temporal dynamics in viral shedding and transmissibility of COVID-19. Nature Medicine, 26, 672–675. Hernández-Orallo, E., Calafate, C., Cano, J., & Manzoni, P. (2020). Evaluating the effectiveness of COVID-19 bluetooth-based smartphone contact tracing applications. Applied Sciences, 10(20), 7113. https:// doi. org/ 10. 3390/ app10 207113. Hinch, R., Probert, W., Nurtay, A., Kendall, M., Wymant, C., Hall, M., Lythgoe, K., Cruz, A.B., Zhao, L., Stewart, A., & Ferretti, L. (2020). Effective Configurations of a Digital Contact Tracing App: A report to NHSX. https:// 045. medsci. ox. ac. uk/ files/ files/ reporteffec tiveappconfi gurat ions. pdf. Accessed 2 Jul 2020. Joint Statement on Contact Tracing (Joint Statement) (2020). 19 April. https:// www. esat. kuleu ven. be/ cosic/ sites/ conta cttraci ngjointstate ment/. Accessed 11 Nov 2020. Kretzschmar, M., Rozhnova, G., Bootsma, M., van Boven, M., van der Wijgert, J., & Bonten, M. (2020). Impact of delays on effectiveness of contact tracing strategies for COVID-19: A modelling study. Lancet Public Health, 5, e452–e459. https:// doi. org/ 10. 1016/ S24682667(20) 30157-2. Li, T., Yang, J., Faklaris, C., King, J., Agarwal, Y., Daddish, L. & Hong, J. (2020). Decentralized is not risk-free: Understanding public perceptions of privacy-utility trade-offs in COVID-19 contacttracing apps. arXiv e-print, https:// arxiv. org/ abs/ 2005. 11957. Loi, M. (2020). How to fairly incentivise digital contact tracing. Journal of Medical Ethics. https:// doi. org/ 10. 1136/ medet hics2020106388. Lomas, N. (2020a). EU privacy experts push a decentralized approach to COVID-19 contacts tracing, TechCrunch, 6 April. https:// techc runch. com/ 2020/ 04/ 06/ eupriva cyexper tspush-adecen trali zedappro achtocovid19conta ctstraci ng/. Accessed 7 Aug 2020. Lomas, N. (2020b). UK gives up on centralized coronavirus contacts-tracing app: will 'likely' switch to model backed by Apple and Google. TechCrunch, 18 June. https:// techc runch. com/ 2020/ 06/ 18/ ukgives uponcentr alizedcoron avirusconta ctstraci ngappwillswitchtomodelbackedbyappleand google/. Accessed 19 Aug 2020. Lucivero, F., Hallowell, N., Johnson, S., Prainsack, B., Samuel, G., & Sharon, T. (2020). COVID-19 and contact tracing apps: Ethical challenges for a social experiment on a global scale. Journal of Bioethical Inquiry, 17(4), 835–839. Möller, N., & Hansson, S. (2008). Principles of engineering safety: Risk and uncertainty reduction. Reliability Engineering and System Safety, 93, 776–783. 1 3 Page 13 of 13 23 New Jersey Department of Health (2020). What are common misconceptions about contact tracing? 9 June. https:// covid 19. nj. gov/ faqs/ njinfor mation/ slowi ngthespread/ whatarecommonmisco ncept ionsaboutconta cttraci ng. Accessed 13 Aug 2020. New York State Senate (2020). An act to amend the public health law, in relation to the confidentiality of contact tracing information (Senate Bill S8450C). 21 July. https:// www. nysen ate. gov/ legis lation/ bills/ 2019/ s8450/ amend ment/c. Accessed 11 Nov 2020. Provincial Court of British Columbia (2014). Det S. Cullingworth, VPD v. BC Centre for Excellence in HIV/AIDS. March 26, Vancouver. Production order: Confidentiality of medical records. http:// www. aidsl aw. ca/ site/ downl oad/ 14135/. Accessed 14 Aug 2020. Prainsack, B., & Buyx, A. (2016). Thinking ethical and regulatory frameworks in medicine from the perspective of solidarity on both sides of the Atlantic. Theoretical Medicine and Bioethics, 37, 489– 501. https:// doi. org/ 10. 1007/ s110170169390-8. Ranisch, R., Nijsingh, N., Ballantyne, A., van Bergen, A., Buyx, A., Friedrich, O., et al. (2020). Digital contact tracing and exposure notification: ethical guidance for trustworthy pandemic management. Ethics and Information Technology. https:// doi. org/ 10. 1007/ s1067602009566-8. Robert Koch Institute. (2020). Infektionsketten digital unterbrechen mit der Corona-Warn-App [German]. 4 August. https:// www. rki. de/ DE/ Conte nt/ InfAZ/N/ Neuar tiges_ Coron avirus/ WarnA pp/ Warn_ App. html.. Accessed 10 Aug 2020. Savulescu, J., & Cameron, J. (2020). Why lockdown of the elderly is not ageist and why levelling down equality is wrong. Journal of Medical Ethics, 46(11), 717–721. https:// doi. org/ 10. 1136/ medet hics2020106336. Schaefer, O., & Ballantyne, A. (2020). Downloading COVID-19 contact tracing apps is a moral obligation. JME Blog, 4 May 2020. https:// blogs. bmj. com/ medic alethics/ 2020/ 05/ 04/ downl oadingcovid19 conta cttraci ngappsis-amoraloblig ation/. Accessed 13 Nov 2020. Scott, M., Braun, E., Delcker, J. & Manancourt, V. (2020). How Google and Apple outflanked governments in the race to build coronavirus apps. Politico, 15 May. https:// www. polit ico. eu/ artic le/ googleapplecoron avirusapppriva cyukfrancegerma ny/. Accessed 16 Nov 2020. Sharon, T. (2020). Blind-sided by privacy? Digital contact tracing, the Apple/Google API and big tech's newfound role as global health policy makers. Ethics and Information Technology. https:// doi. org/ 10. 1007/ s1067602009547-x. Tang, Q. (2020). Privacy-preserving contact tracing: current solutions and open questions. arXiv e-print, https:// arxiv. org/ abs/ 2004. 06818. Taylor, J. (2020). How did the Covidsafe app go from being vital to almost irrelevant? The Guardian, 23 May. https:// www. thegu ardian. com/ world/ 2020/ may/ 24/ howdidthecovid safeappgofrombeingvital toalmostirrel evant. Accessed 19 Aug 2020. Troncoso, C., Payer, M., Hubaux, J., Salathé, M., Larus, J., Bugnion, E., Lueks, W., Stadler, T., Pyrgelis, A., Antonioli, D. & Barman, L (2020). Decentralized privacy-preserving proximity tracing (DP-3T White Paper). arXiv e-print, https:// arxiv. org/ abs/ 2005. 12273. Accessed 7 August 2020. van Basshuysen, P. & White, L. (2020). Living with a Pandemic: How to Do Better than Lockdown. Working Paper, https:// philp apers. org/ archi ve/ VANLWA5. pdf. Accessed 13 Jan 2020. Vaudenay, S. (2020) Centralized or decentralized? The contact tracing dilemma. IACR Cryptology ePrint archive, ia.cr/2020/531. Accessed 15 Aug 2020. White, L., & van Basshuysen, P. (2020). How to overcome lockdown: Selective isolation versus contact tracing. Journal of Medical Ethics, 46(11), 724–725. https:// doi. org/ 10. 1136/ medet hics2020106680. Publisher's Note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.


Book Review: Krzysztof Czerniawski. Trzy wersje epistemicznej teorii prawdy: Dummett, Putnam, Wright [Three Versions of the Epistemic Theory of Truth: Dum- mett, Putnam, Wright]

Philosophy

A few years ago, Krzysztof Czerniawski published the book Three Ver- sions of the Epistemic Theory of Truth: Dummett, Putnam, Wright. It at- tracted my attention, as while there are many works which are concerned with the philosophical problem of truth, there are just a few compara- tive studies of different ideas concerning the theory of truth. The author in question focuses on the so-called Epistemic Theory of Truth, which as- sumes, according to the characterization of Wolfgang KÃ¼nne, that being true depends to some extent on our judgement. It is clear that many other philosophers have understood truth in similar terms: e.g. Pierce, Brenta- no and Neurath. However, Czerniawski concentrates on the most recent history of the Epistemic Theory, and does not seek to take account of the philosophies of either Habermas or Gadamer, whose ideas on truth stand in a somewhat more complex relationship both to this line of development and to the analytical tradition from which it has mostly emerged. Thus, he chooses Michael Dummett, Hilary Putnam and Crispin Wrightâthree analytical philosophers who have significantly contributed to the devel- opment of âepistemicâ approaches to the problem of truth.

Book Reviews FORUM PHILOSOPHICUM 23 (2018) no. 1, 133–139 SUBM. 30 April 2019 ACC. 30 May 2019 ISSN 1426-1898 E-ISSN 2353-7043 DOI:10.5840/forphil20182315 ✍ Jakub Pruś, Jesuit University Ignatianum in Cracow, ul. Kopernika 26, 31-501 Kraków 📧 firstname.lastname@example.com  0000-0003-0585-3865 Krzysztof Czerniawski. Trzy wersje epistemicznej teorii prawdy: Dummett, Putnam, Wright [Three Versions of the Epistemic Theory of Truth: Dummett, Putnam, Wright]. Warsaw: Centre for Philosophical Research, 2014. A few years ago, Krzysztof Czerniawski published the book Three Versions of the Epistemic Theory of Truth: Dummett, Putnam, Wright. It attracted my attention, as while there are many works which are concerned with the philosophical problem of truth, there are just a few comparative studies of different ideas concerning the theory of truth. The author in question focuses on the so-called Epistemic Theory of Truth, which assumes, according to the characterization of Wolfgang Künne, that being true depends to some extent on our judgement. It is clear that many other philosophers have understood truth in similar terms: e.g. Pierce, Brentano and Neurath. However, Czerniawski concentrates on the most recent history of the Epistemic Theory, and does not seek to take account of the philosophies of either Habermas or Gadamer, whose ideas on truth stand in a somewhat more complex relationship both to this line of development and to the analytical tradition from which it has mostly emerged. Thus, he chooses Michael Dummett, Hilary Putnam and Crispin Wright-three analytical philosophers who have significantly contributed to the development of "epistemic" approaches to the problem of truth. The aim of book is twofold: on the one hand it is historical, as it presents the three philosophers' ideas and discussions concerning the problem of truth as they have unfolded over the years, while on the other it is 134 BOOK REVIEWS systematizing, in that it offers various arguments, along with relevant developments and modifications, and many highly specific details, pertaining to the concept of truth and theories of meaning, assertibility and rationality-thus providing a broad perspective on the problem of truth in analytical philosophy. To put it very briefly, the principal value of the book lies in the fact that it serves to familiarize the reader on a deep level with the contemporary debate in analytical philosophy surrounding the Epistemic Theory of Truth. It would be too much to say that the author offers his own grand solution to problems in the sphere of alethiology, yet the very detailed descriptions, accompanied by extensive references to the capacious literature, as well as the pursuit of systematic comparisons between different ideas and arguments, seem to be enough to constitute a comprehensive introduction to the topic itself. Readers are invited to join in an intellectual journey-that of investigating one of the key issues in analytical philosophy today. I will now seek to present, as concisely as possible, what I take to be the main reasons for considering this book an effective introduction to the problem of truth in contemporary analytical philosophy. As regards the philosophy of Dummett, Czerniawski first provides a short biography of the latter, which aims to contribute to a better understanding his philosophy: e.g. the fact that he was a Catholic, which can be regarded as helping to explain his maximalist approach to metaphysics (16). The author describes Dummett's intellectual journey throughout various philosophical issues-which, furthermore, is most useful when it comes to shedding light on his theory of meaning (itself an essential idea when it comes to properly understanding his arguments concerning the nature of truth). Czerniawski astutely points out Dummett's sources of inspiration in the work of other philosophers, such as Austin's anti-scientism, Wittgenstein's pragmatics-oriented approach to meaning, and, above all, Frege's theory of meaning (22). He provides many references from the various works of Dummett himself, and thus arrives at a clear and systematic presentation of the evolution of Dummett's philosophy. Czerniawski's astutely chosen selection of quotations, both from Dummett himself and from contemporary commentaries and criticisms pertaining to his ideas on truth, is more than adequate to the task in hand. What is most valuable when it comes to analyzing Dummett's position is his exploration of the debate between realism and antirealism. Czerniawski shows, following Dummett, that these two metaphysical conceptions in fact differ at the level of the theory of meaning (51). He shows that BOOK REVIEWS 135 metaphysical questions pertaining to the nature of reality can be transformed into questions about what it means that some particular statement is true, and how we can understand true statements. He then presents, in very broad terms, Dummett's discussion with John McDowell on past statements, offering a step-by-step analysis of each argument and its response (65). In short, Czerniawski, thanks to his very careful examination of Dummett's works, precisely captures Dummett's key ideas at different stages in the development of his philosophy, introduces his discussions with other philosophers, and provides an up-to-date commentary on Dummett's alethiology. He explains many thoughts that will be quite new to those not already familiar with analytical philosophical terminology. Thus, while explaining Dummett's thought and discussions, he evokes the Acquisition Argument, the Circularity Argument, and the socalled Manifestation Argument against semantic realism-all arguments that have played a significant role in supporting or challenging his Justification Theory of Meaning and his Epistemic Theory of Truth (110). In the first part, Czerniawski demonstrates why it is that for Dummett, logic is justified by semantics, and why semantics is in turn supported by a theory of meaning, so that the question of what justifies the theory of meaning can finally receive an answer. Hence, by virtue of this alone, the author's analysis of Dummett's philosophy may be said to furnish the reader with a broad perspective on his thought, offering an excellent introduction to Dummett's ideas regarding truth as justified assertibility. At the beginning of the second part of the book, Czerniawski presents three stages in the development of the philosophy of Hilary Putnam, supplementing his historical account of the evolution of Putnam's ideas with the latter's autobiographical comments taken from his work My Intellectual Autobiography. He accepts the standard division of Putnam's philosophy into three stages, and dedicates one subsection to each stage. Thus, he starts with an analysis of Putnam's article Do True Assertions Correspond to Reality?, in which the American philosopher argued for the correspondence theory of truth and tried to build his own version of it. Czerniawski presents the Putnamian critique of Tarski's Semantic Theory of Truth, which Putnam accuses of being circular and detached from reality, where in Putnam's view this renders it a purely linguistic-i.e. non-semantic-affair. He then lucidly presents the axis of the dispute between Putnam and Tarski, supplementing this with comments made by such contemporary specialists on Tarski's theory of truth as Jan Woleński and Adam Nowaczyk (139). Putnam formulates his argument against Tarski's theory in terms of the claim that it does not present any theory 136 BOOK REVIEWS of meaning, but does nevertheless involve some sort of implicit theory of meaning. Tarski-according to Putnam-removed semantics from his Semantic Theory of Truth, so that it does not refer to any meanings. However, Czerniawski invokes Woleński's response here, according to which Tarski's theory does not need any theory of meaning for Convention T and statements translating from an object-language to a meta-language to be correct. Tarski was aware of the difficulties involved in constructing a theory of meaning, and for this reason did not seek to explicitly present any such thing. The implicit conception of meaning that he relied on was only an addition to his theory of truth. Meanwhile, Putnam's critique, as Czerniawski points out, refers to Tarski's implicit theory of meaning, not his theory of truth. To show this, he quotes Woleński's example, in which some counterintuitive statements show up as true just because truth (for Tarski) corresponds to a complete model of reality and not to the meanings that particular statements can have (152). Czerniawski refers to Woleński's distinction (originally made by Pitcher) between strong and weak notions of correspondence, and this is crucial for a proper understanding of Tarski's theory, as well as for responding to Putnam's argument. Tarski assumes a weak correspondence between language and reality: that is to say, he claims that words and statements do not refer to particular facts or objects, but to reality modeled as a whole. This part of the book possesses additional value thanks to its detailed analysis of Putnam's critique of Tarski's theory of truth, conducted with reference to present debates on this topic-something which affords the reader a broad perspective on the problem, introducing him or her to the current state of specialized discussions of this topic. Further to this, Czerniawski outlines Putnam's model-theoretic argument and its role in the polemics associated with metaphysical realism. Taking various quotations from Putnam's articles as a basis, he explores how metaphysical realism is affected by problems of conceptual relativity, and how internal realism avoids these (180). Czerniawski, following Putnam, demonstrates exactly why it is that thinking about epistemically ideal conditions should be replaced with a focus on "sufficiently good epistemic conditions." However, what is far more valuable is the fact that he succeeds in showing how Putnam's thoughts on truth and realism have themselves changed over the decades. Czerniawski not only demonstrates his enormous knowledge of Putnam's works, but also presents an engaging intellectual history, whose subject matter is how Putnam's own ideas came to be shaped by particular arguments put forward by various other BOOK REVIEWS 137 philosophers. Thus, he presents us with the American thinker's discussions with Quine and Rorty on truth and interpretation, with the influence of the Wittgensteinian notion of language games upon internal realism, and with his criticisms directed at Tarski's semantic theory of truth. Czerniawski sets up an effective comparison between Putnam's and Dummett's theories of truth, one that involves showing that for Putnam it is impossible to prepare "a list of conditions for justifying statements," as conditions of justification are subject to change just as all human knowledge is, and some statements considered true today will one day be false, so that the same can surely happen to our procedures for justifying beliefs, too. Czerniawski, following Putnam, therefore concludes that we cannot formalize conditions for justifying statements-much as we cannot formalize human rationality per se. Furthermore, Czerniawski shows us Putnam's route from internal realism (understood in verificationist terms) to commonsensical realism-the point where he ends his long intellectual journey back to realism. The author really does capture here the intricate details of Putnam's conception of realism and its relations to metaphysical realism, as well as the more finely graded differences between variants of the realist stance. He also manages to present clearly some criticisms of this conception, alongside some responses to these. To cut a long story short, Czerniawski recounts how Putnam started out on his journey as an adherent of the correspondence theory of truth, but did not accept Tarski's Semantic Theory of Truth. The American philosopher pointed out that it follows from the Löwenheim-Skolem theorem that Tarski's theory suffers from a problem of multiple possible interpretations. In advancing his criticism, he also relied on the so called "model-theoretic argument," which states that it is impossible to establish a one-to-one correspondence between some language-element and some specific part of reality. Putnam then turned to verificationism, claiming that interpretation is performed "internally" in one's mind, rather than via actual truth-conditions: "language usage performs interpretation." He subsequently reached the decision that reality and language are given to us proximately, where this turned him in the direction of commonsensical realism. In the meantime, it is fair to say that he also came under the influence of a variety of philosophers and philosophical arguments (e.g. Quine's case for ontological nominalism). In this second part of his book, Czerniawski presents, in a highly detailed manner, the intellectual journey of Putnam from the correspondence theory of truth and criticisms of it (especially as regards Tarski's 138 BOOK REVIEWS theory of truth), through internal realism and the role first of epistemically ideal, and then of epistemically adequate conditions, to his final arrival back at commonsensical realism and the disquotational theory of truth. The author has undertaken the demanding task of describing, analyzing and systematizing the thought of a philosopher who has himself traveled a considerable distance, and has handled this task very well. Czerniawski not only shows his wide knowledge of Putnam's works, but also demonstrates an ability to invoke various quotations whose particular value lies in the fact that they allow the reader to gain a broader view of this turbulent landscape than would otherwise be available. The third part of the book is devoted to Crispin Wright's Epistemic Theory of Truth. His contribution to the philosophical problem of truth is also significant, due to his development of anti-realism, his appeal to two arguments from normativity, his discussion with Putnam and, finally, the concepts of "superassertibility" and alethic pluralism. Czerniawski draws a map of realism, idealism, skepticism, and antirealism, and shows very clearly where the borderlines between them fall. Where Wright is concerned, he outlines what amounts to a normative theory of meaning and a normative theory of truth. Czerniawski shows clearly how various analytical philosophers differ as regards such concepts as language, Convention T, conceptual relativity, the language-reality relation, and disquotational and deflationary theories of truth. What seems particularly valuable here is the account given of Wright's discussions with Putnam, Dummett and Paul Horwich, in which the author provides step-by-step analysis of each argument, as well as the principal responses to it. In this way, the author shows how Wright challenged Dummett's theory of meaning based initially on verification and subsequently upon justification, while elsewhere demonstrating how the concept of superassertibility can be deployed to resolve the problems facing Putnam's version of realism. Czerniawski invokes Wright's argument against maximalist realism, pointing out that the only statements that are indeed true realistically are the theorems of logic and mathematics: their truthfulness is fixed independently of our testimonies, and they are fundamentally grounded in reality itself, not in perception. Putnam put forward an example showing that even in the empirical world there are situations where truth exceeds testimony (namely, the well-known example of Lizzie Borden). Therefore Wright-as Czerniawski mentions-limits his Epistemic Theory of Truth to just ethics and aesthetics, leaving room for realistic theories where different areas of human cognition are concerned, even though he himself BOOK REVIEWS 139 does not embrace a commitment to realism (257). Thus, Wright accepts certain realist intuitions, but cannot affirm realism with all of its metaphysical assumptions, and in this regard we can view him as being at most a minimalist realist (258). Czerniawski guides the reader insightfully through the exchanges between Wright and Putnam to finally show how they play so-called "burden tennis": that is to say, they are unable to agree about who should feel the burden of obligation to provide a warrant for their position-the realist or the anti-realist (263). Czerniawski's book deserves attention, as it not only offers a broad introduction to the problem of truth in contemporary analytical philosophy, but also amounts to a highly systematic piece of work in that field-one that gives a detailed insight into the evolution of different philosophical ideas relating to the Epistemic Theory of Truth. Czerniawski has managed to describe Dummett's, Putnam's andWright's philosophies in a lively and engaging way, and has shown how their theories came to be shaped by various arguments and influences. The book can thus be recommended as an excellent choice for those not so familiar with this specific issue in analytical philosophy who nevertheless wish to broaden their knowledge about recent developments pertaining to the Epistemic Theory of Truth. JAKUB PRUŚ FORUM PHILOSOPHICUM 23 (2018) no. 1, 139–143 SUBM. 18 November 2018 ACC. 26 November 2018 ISSN 1426-1898 E-ISSN 2353-7043 DOI:10.5840/forphil20182316 ✍ Andrzej Wierciński, University of Warsaw, ul. Mokotowska 16/20, 00-561 Warszawa 📧 firstname.lastname@example.com  0000-0001-9096-6535 Urszula Zbrzeźniak. Genealogia i emancypacja. Studia nad współczesną filozofią polityki [Genealogy and Emancipation: Studies on Contemporary Political Philosophy]. Warsaw: The University of Warsaw Press, 2018. Urszula Zbrzeźniak's Genealogy and Emancipation: The Studies in Contemporary Political Philosophy is a plaidoyer for a diverse and possible world, in which the hermeneutics of emancipation and liberation happens within the horizon of the tension between liberation and domination. The task of philosophy is to undertake an interpretative challenge that involves an understanding of a human being as homo interpretativus. Dasein has to face a political way of being in the world, clarifying the lan-