Source-linked AI summary
Apps Gone Rogue: Maintaining Personal Privacy in an Epidemic
Ramesh Raskar, Isabel Schunemann, Rachel Barbar, Kristen Vilcans, Jim Gray, Praneeth Vepakomma, Suraj Kapa, Andrea Nuzzo, Rajiv Gupta, Alex Berke, Dazza Greenwood, Christian Keegan, Shriank Kanaparti, Robson Beaudry, David Stansbury, Beatriz Botero Arcila, Rishank Kanaparti, Vitor Pamplona, Francesco M Benedetti, Alina Clough, Riddhiman Das, Kaushal Jain, Khahlil Louisy, Greg Nadeau, Steve Penrod, Yasaman Rajaee, Abhishek Singh, Greg Storm, John Werner, Ayush Chopra, Gauri Gupta, Vivek Sharma
TL;DR
Mobile contact-tracing technologies raise risks of mass surveillance, constrained freedoms, and exposure of private details. The paper reviews technological approaches, discusses risks and trade-offs, and describes privacy-oriented methods, including PrivateKit and Safe Paths, while indicating that rapid identification may reduce transmission.
Problem
First-generation contact-tracing tools can expand mass surveillance, limit individual freedoms, and expose individuals’ private details.
Method
The paper reviews contact-tracing methods, examines risks and trade-offs, and discusses privacy and data-security approaches for deployment.
Results
With 100% use and appropriate action, R0 would be expected to fall below 1 through more rapid exposure and contact identification.
Takeaways & Limitations
Privacy-protective contact-tracing requires careful design to prevent abuse and mass surveillance, with PrivateKit and Safe Paths presented as approaches drawing on several models.
Takeaways & Limitations
The paper notes that diagnosed carriers’ data generally must be exposed rather than kept from the public, except in participatory sharing models.
Abstract
from arXiv · showhide
Containment, the key strategy in quickly halting an epidemic, requires rapid identification and quarantine of the infected individuals, determination of whom they have had close contact with in the previous days and weeks, and decontamination of locations the infected individual has visited. Achieving containment demands accurate and timely collection of the infected individual's location and contact history. Traditionally, this process is labor intensive, susceptible to memory errors, and fraught with privacy concerns. With the recent almost ubiquitous availability of smart phones, many people carry a tool which can be utilized to quickly identify an infected individual's contacts during an epidemic, such as the current 2019 novel Coronavirus crisis. Unfortunately, the very same first-generation contact tracing tools have been used to expand mass surveillance, limit individual freedoms and expose the most private details about individuals. We seek to outline the different technological approaches to mobile-phone based contact-tracing to date and elaborate on the opportunities and the risks that these technologies pose to individuals and societies. We describe advanced security enhancing approaches that can mitigate these risks and describe trade-offs one must make when developing and deploying any mass contact-tracing technology. With this paper, our aim is to continue to grow the conversation regarding contact-tracing for epidemic and pandemic containment and discuss opportunities to advance this space. We invite feedback and discussion.
1 | INTRODUCTION
The paper reviews mobile-phone contact-tracing approaches, their opportunities and risks, and security-enhancing strategies for balancing containment with privacy. It advocates citizen-centric, privacy-first, open-source, secure, and decentralized tools while inviting continued discussion.
- The paper responds to privacy concerns arising from technologies that can limit freedoms and expose individuals’ private details.
- The paper outlines mobile-phone contact-tracing approaches and examines their opportunities and risks for individuals and societies.
- It describes security-enhancing approaches to mitigate risks and the trade-offs involved in developing and deploying mass contact-tracing technologies.
- The paper identifies citizen-centric, privacy-first, open-source, secure, and decentralized solutions as next-generation epidemic and pandemic containment tools.
- It aims to advance discussion of contact-tracing for epidemic and pandemic containment and invites feedback.
2 | THE CASE FOR IMPLEMENTING CONTACT TRACING TECHNOLOGIES
Contact tracing can support epidemic containment by identifying contacts and monitoring them after exposure, but containment measures can impose broad social and economic costs. The paper presents contact tracing as a way to target interventions while recognizing challenges from asymptomatic infection and incomplete testing.
- Containment can slow infectious-disease spread and preserve healthcare capacity, but lockdown-like measures disrupt productivity, markets, and social life.
- Contact tracing provides an alternative when blanket testing is infeasible, although asymptomatic infection and incubation periods make containment difficult.
- Contact tracing identifies people who had contact with confirmed cases and supports monitoring, care, treatment, and prevention of further transmission.
3. Contact Follow-Up
Contact tracing can reduce transmission by identifying exposed people quickly and supporting isolation or testing, with the contact rate as a key adjustable factor in R0. The paper describes potential epidemiological benefits while making them conditional on uptake and appropriate responses.
- Contact tracing can increase readiness, enable earlier isolation, and reduce transmission chains by identifying exposures beyond symptom-based detection.
- Contact tracing can be deployed early and remain useful during resurgence concerns, helping avoid multiple peaks and renewed disease spread.
- R0 depends partly on contact rate, which is the most adjustable factor for a given disease because infectious period and transmission mode are comparatively fixed.
- The proposed application model assumes that users respond to known exposure through self-quarantine or testing, with effects depending on population mixing and contact patterns.
- High enough application utilization and appropriate responses could reduce contact rates so that R0 falls below 1, potentially ending ongoing transmission.
- A 10% uptake may produce downstream effects beyond 10% by identifying contacts more rapidly and reducing subsequent contact rates.
3 | THE LANDSCAPE OF INTERVENTIONS
Mobile contact-tracing interventions range from public broadcasting and selective alerts to unicasting, participatory sharing, and privacy-preserving hybrid designs. These approaches trade containment utility against risks involving location privacy, government access, identification, and participation.
- 3.1 | Broadcasting: Broadcasting quickly publicizes diagnosed carriers’ visited locations without requiring data from other citizens, but can expose identities and associated locations.Selective broadcasting can instead target defined groups, though it may require user registration or location information and can compromise location privacy.
- 3.3 | Unicasting: Unicasting privately informs users who were near a diagnosed carrier and can identify exposed users effectively, but requires government access to broad citizen data and risks surveillance abuse.The described system transmits unique risk information to each user.
- 3.4 | Participatory Sharing: Participatory sharing lets diagnosed carriers voluntarily release location trails while retaining control, but users must independently assess exposure and fraud is difficult to detect.The model does not require prompting by a central entity, but depends on users seeking and interpreting the information.
- 3.5 | Private Kit: Safe Paths: Private Kit: Safe Paths is an open-source, privacy-first tool that assesses whether users crossed paths with diagnosed carriers without collecting user information in an external cloud.Its open-source design supports expert auditing of security and privacy features.
- 3.5 | Private Kit: Safe Paths: Safe Paths’ planned hybrid combines participatory sharing with unicasting to avoid a central entity while providing personalized risk assessment and direct notifications without exposing individual trails to third parties.The design aims to protect diagnosed carriers’ shared trails while notifying users who were nearby.
4 | RISKS AND CHALLENGES
Contact-tracing technologies must inform potential contacts while protecting diagnosed carriers, users, businesses, and non-users from privacy violations and social or economic harm. The section identifies additional challenges involving consent, surveillance, stigma, and unequal impacts on vulnerable populations.
- 4 | RISKS AND CHALLENGES: The central challenge is securing privacy for diagnosed carriers, potential contacts, and visited businesses while still informing users about possible exposure.The paper also identifies opportunities for fear, fraud, misinformation, and surveillance-state abuse.
- 4.1 | Privacy of Diagnosed Carriers: Public release of location trails can identify diagnosed carriers, trigger stigma and persecution, and expose intimate inferences about their personal lives.The paper describes online speculation and witch hunts following South Korean disclosures.
- 4.2 | User Privacy: Exposure assessments require location data, but third-party or government access to that data can move systems toward surveillance and enable monitoring of users.Examples cited include suspected police reporting and automatic quarantine notifications.
- 4.3 | Local Businesses: Releasing diagnosed carriers’ trails can reveal businesses and damage them through boycotts, harassment, customer loss, and financial hardship.These effects can occur during an epidemic when businesses are already economically vulnerable.
- 4.4 | Non-users: Contact-tracing can harm non-users connected socially or geographically to diagnosed carriers, including patrons, employees, and people near sensitive locations.Such individuals may face stigma, economic burdens, or exposure of military and research sites.
- 4.5 | Consent: Consent remains constrained when explanations are incomprehensible or users must surrender privacy to obtain a service, leaving true consent unresolved.Exposure assessments typically require sharing location with a third party.
4.1 | Misinformation and Panic
Misinformation, panic, fraud, hacking, and unequal access can undermine contact-tracing during an epidemic. The section emphasizes that unclear risk communication and weak privacy or security protections can produce harmful public responses and unequal burdens.
- 4.1 | Misinformation and Panic: Alerts lacking exposure timing or comprehensible risk magnitude can cause users to overestimate danger, panic, or overwhelm medical services.The paper notes that even location and time information may be insufficient when risk magnitude is difficult to understand.
- 4.1 | Misinformation and Panic: Failure to communicate system limitations can create false reassurance, causing users to underestimate disease risk and reduce preventive behaviors such as social distancing.This false sense of safety may follow the absence of an exposure notification.
- 4.2 | Fraud and Abuse: Fraudsters may exploit contact-tracing by blackmailing businesses, falsely reporting illness, or coercing people to provide location data for unrelated purposes.Fear of such abuse may prevent adoption of systems intended to support containment.
- 4.4 | Equity and Social Justice: Requiring smartphones excludes vulnerable groups such as older, homeless, and lower-income people, while privacy abuse and economic harms disproportionately affect those already vulnerable to surveillance.Device access remains a significant near-term challenge for contact-tracing technology.
5 | MAPPING TECHNOLOGICAL INTERVENTIONS WITH RISKS
The reviewed contact-tracing approaches involve an inverse relationship between risk-assessment accuracy and user privacy, creating a utility–privacy compromise. Private Kit: Safe Paths is presented as having potential to alter this trade-off.
- The inverse relationship between risk-assessment accuracy and user privacy necessitates compromise by the user community.
- Private Kit: Safe Paths is presented as having potential to fundamentally alter the utility–privacy trade-off.
6 | DISCUSSION OF RISKS, MITIGATION AND TRADE-OFFS
Deploying contact-tracing technology requires balancing containment benefits against privacy, security, equity, and economic risks. The paper discusses mitigation measures while recognizing that these choices involve unavoidable trade-offs.
- Contact-tracing deployment requires weighing containment benefits against risks to privacy, security, equity, and local businesses.
- Privacy of Diagnosed Carriers: Diagnosed carriers are especially vulnerable, so limiting public data, reducing third-party involvement, restricting access, and using consent can strengthen privacy protection.
- Privacy of Local Businesses: Location disclosure can protect public health while exposing local businesses to identification, harassment, and economic hardship; decisions should be evaluated case by case.
- Access and Inclusion: Unequal device access and varying health literacy can disadvantage marginalized groups, requiring access to exposure information beyond smartphones and accessible presentation.
- Information and Security Risks: Misinformation, false reassurance, hacking, and prolonged data retention remain risks that can be mitigated through education, data minimization, distributed or encrypted storage, and time limits.
7 | CONCLUSION
The paper argues that contact-tracing can improve the ability to identify exposure, but its design must prevent abuse and mass surveillance. It reviews technological methods, risks, precautions, and trade-offs, highlighting Private Kit: Safe Paths as a privacy-oriented approach.
- Contact-tracing can improve the ability to trace contacts and notify potentially exposed people, but its design must prevent abuse and mass surveillance.
- The paper reviews contact-tracing methods, risks to individuals and societies, and precautions and trade-offs for privacy and data security.
- Private Kit: Safe Paths is presented as eliminating government-surveillance risk while drawing on advantages from several contact-tracing models.
8 | ACKNOWLEDGEMENTS
The authors acknowledge mentors from I-DAIR, WHO, and HHS for their guidance in advancing contact-tracing solutions.
- The authors acknowledge mentorship from Amandeep Gill, Bernardo Mariano Jr, and Don Rucker in advancing contact-tracing solutions.