Info on and removal of COVID contact tracing in Google Play Services

Question

Has anybody had a closer look into this module what it really does? I want to know if the functionality will work if bluetooth is turned off. I guess a surefire method to test this would be to remove the SIM, disable all antennas and measure EM radiation (though I'm not sure if there's still cell tower communication with the SIM removed).

Even if the answer above is no: I don't want this software on my Phone.

• Is it possible to modify Google Play Services (GPS), remove contact tracing, and use GPS as usual after? This seems the best option but an update might then again overwrite it.
• Root and remove GPS. I have a OnePlus 7. Will everything keep working well except the Google apps of course?
• LineageOS maybe but I like OxygenOS a lot..
• Other options?

Much would be cleared up if we can see the code. Is this possible?

Answer 1

The Covid contact tracing in Google Play Services is an API. And according to he documentation this API is working opt-in. By default your device will not track anything. Also note that "contact" in this context means "a cryptographically random token generated by a different device that was within Bluetooth range at a certain time". No contact data like name is transmitted.

For "activating" this interface you need at least one of the Google certified Covid 19 tracing apps (there can be only one app per country and only public health agency is allowed to publish one).

And in such an app Google enforces that the user has a switch for enabling and disabling the tracking system.

However if you still not trust Play Services with integrated Covid tracking API you should switch to a Custom ROM + OpenGApps. Every device I have tested that uses this combination does not provide the COVID contact tracing API, even if the very latest version of Google Play Services is installed. Hence it seems like the tracing API is generally disabled for Custom ROMS using OpenGApps. It is still unclear why on some devices with CustomROM and OpenGApps the COVID tracking API is available and on other devices this option does not show up even with latest OpenGApps installed.

You can verify on your own if your PlayService support Covid 19 tracking:

Open Settings -> Google If the first entry in the services list shows you something about "Notifications on encountered Covid 19 infections" than the API is ready to use. If not then every Covid tracking app that wants to use this API will not work (the app will just show the error code 39501).

Answer 2

Google Play Services v20.15.15 seems to be the last version before covid tracing was added. Stock phone FW versions released before April 2020 should all have a lower version of Google Play Services - don't update past 20.15.15

Answer 3

Contact tracing is not the only way a user can be tracked and mass-scale user tracking has been in motion for a long time. Some examples:

• On Replicant, it is argued that Samsung Galaxy devices running proprietary Android versions come with a back-door that provides remote access to the data stored on the device..
• Keith Collins of Quartz says that Google collects Android users’ locations even when location services are disabled.
• Lindsworth Horatio Deer on his blog posted that NSA can hack the Baseband Processor and control your smartphone even when the phone is switched off.

One mitigating measure against Google Play Services' tracking is to root your device and use app like cn.wq.disableservice. With this you can have control over GMS and block single actions, like prevent GMS from updating itself. It's painful to understand all the things but it should be technically possible to block data transfers.

This however would not be sufficient. You are already being profile/tracked when you are using:

• proprietary software or services (such as Android OS as shipped by an OEM);

• various services such as cloud syncing of personal/private data;

• real-time text to speech translation -- your audio could be getting saved onto the cloud. You can see some of that data collected by Google here;
• maps with real-time live traffic data.

Some services/software, such as Google Play Store, even force this tracking by requiring the user to sign in to use the product. Furthermore, a staggering number of Android apps use some sort of analytics such as Firebase.

Answer 4

Google Play Services introduced user-tracking capabilities in my Android device without my knowledge or consent. I consider this software a user-tracking software (read Google's Software is Malware from Free Software Foundation) which also offers services to third-party app developers to spy on their users. This sordid state of affairs led me to the following solution which disables Google Play Services software, other preinstalled softwares from Google, and their user-spying capabilities.

Instructions in brief that you need to execute:

1. Transfer all your phones contacts into the phone's SIM card.
2. Download the APK for alternative browser to Chrome to external sdcard.
3. Move all the files you want to keep from phone's internal card to the external card.
4. Factory reset your phone.
5. Wait for Factory reset.
6. Skip past Google credentials prompt.
7. Switch off app permissions.
8. Delete Google apps like YouTube and Chrome.
9. Disable and close Google Play Services, and mute error messages about its absence.
10. Install browser APK from sdcard.
11. Browse to an independent app store and download replacement apps.

Details

1. Transfer all your phone's contacts into the phone's SIM card. Your phone is about to be wiped and your connection with Google is about to terminate. (There are working alternatives to everything Google offers, so you'll hardly notice it gone once you've did all this.)

2. Go to the website of Mozilla or Opera or whatever browser you like. Download the APK of the latest browser from their website. You're not going to install this APK yet. You are going to save this to your SDCARD and install it later. You will need this file and it's the only file you will need.

   If you are unable to find the APK on the website you can consider a third-party app store such as APKPURE which is like Google Play Store, except that it's not from Google. See if you can find a decent browser APK as an alternative to Chrome (in my opinion, Google Chrome also tracks your location and reports your movements and contacts to unknown parties).

3. Go through your whole phone and copy across any files on the phone's internal card to the external sdcard. This can be a time consuming process depending upon how much data is stored in your phone. All the data from the phone's internal memory is about to be wiped in later instructions, so make sure you copy everything important beforehand.

4. Reset your phone. (Reset only the Internal memory if an option is available to you.) To do this you can go to Settings → System → Reset options, or you can just switch off the phone and switch it back on again whilst holding the Volume Up button.

5. Wait for Factory reset to complete and for your phone to boot to the device/phone setup screen.

6. Now that you've reached the First screen, please type in your Google credentials.

7. Swipe down from the Status bar and click the cog icon to open Settings. Go to Apps and Notifcations, then from there App permissions. Go through all of them and switch all of them to off state right away.

8. Go back to Apps and Notifications setting. If you see any app from Google just disable it, then force stop the app which is already running in the back ground. Get rid of everything preinstalled by Google before you even start using your new fresh phone, especially the Google Play Services which is essential for disabling removing COVID-19 notification API.

   Do note that disabling Google Play Services (upon which insanely high number of third-party apps in Play Store depend upon) means you are going to get some error messages from third-party apps to show up. You can mute such messages because even though they mention that they need Google Play Services to function they actually don't in reality. The benefit to the user is that user-tracking services offered by Google Play Services to third-party apps installed in your phone would no longer be available to such installed apps anymore.

   Speaking redundantly here, there would a few error messages that will appear immediately and may pop up occasionally over the course of the month until you have used all the apps you usually do in the course of a month, and until you have caught and dealt with all the error messages as they come up. This will include your phone's dialer app, text messages app, camera app, and basic functional apps. They will all work without Google Play Services

9. With caveat mentioned in step 8. in mind, go on, disable Google Play Services and force stop it, just like you did that with Chrome, YouTube, Photos, Drive, Gmail, etc. (You will still be able to access Drive and Gmail via your non-Chrome browser whose APK you downloaded earlier.)

   Now deal with the error messages. If you click on the error message itself, it raises up the Google Play Services app, expecting you to click Enable. That's not what you want to do. Each error message starts off with the name of the app that generated the error message. Go to Settings → Apps*not. → the actual app that generated the error messages, then click on Notifications. In there find a setting mentioning "Google Play Services notifications" or something to that effect. Switch off these notifications. If this notification toggle isn't there then there's the option of switching off the apps notifications generally.

   There will be three or four of these errors to work through right off the bat. Other error messages might pop up later in the day as you use an app for the first time on your freshly factory reset device. Just disable the notification on the app itself. It's unlikely you'll see any error messages after the first hour. Maybe in the first 24 hours you'll have dealt with all of them. Maybe one will pop up in a week, maybe a week. You will find your phone and its apps (non Google) still functions perfectly without Google Play Services, and that the error messages are more like a mutable warning rather than some fatal crash.

10. Go to Files. Go to your external sdcard and find the APK file you downloaded earlier. Click on it and you'll be asked about installing from other sources. Files is not Google Play Store so, yes, you want to install from other sources - your sdcard will be the primary means of installing software. Click through everything that needs to be clicked to get the browser installed. Now that that's done, you cant start looking for an alternative to Google Play Store.

11. I use APKPure app store myself but there are a variety of websites which cater toward getting the APK of an app rather than installing from the fancy mechanisms as offered by the likes of Samsung or a Huawei app store. I think some of these stores-by-manufacturer might provide you with an APK store independent of the fact you don't have one of their phones. If you can download the APK from it, then it will work in Android. The one thing you need to suss out is whether your phone is 32 or 64 bit and whether is ARM or x86. If it's x86, sod this whole post and just install a touch screen version of Linux. It's easy and your options are as open as a desktop PC. With ARM there are a few versions of Linux you can install but it's beyond the scope of this text to install it. Have a search for "UserLAnd" (sic) if you want a better version of Linux on your phone than Android but it can get quite technical at the moment.

    Most phones are ARM32, but try downloading APKX files. If they work on your phone, then that means you have an ARM64 chip in your phone.

    You probably want APKs to use email. Search email apps in your choice of app store. In the app, you can fill out your Gmail address on the create account screen and most email clients will fill out the server details automatically. There's a Google help page about setting up your email client manually with correct SMTP, POP3, IMAP, etc., kind of stuff if the email app you chose doesn't do it for you. I used AqualMail which doesn't rely on Google Play to function. As an alternative to an app, you can use Gmail, Hotmail, Outlook, Yahoo, etc., directly through your browser.

That's the end of the tutorial.