Source-linked AI summary
Contact Tracing Mobile Apps for COVID-19: Privacy Considerations and Related Trade-offs
Hyunghoon Cho, Daphne Ippolito, Yun William Yu
TL;DR
The document asks how app-based contact tracing can inform people about potential exposures without sacrificing too much privacy. It analyzes three privacy notions and proposes cryptographic and private-messaging approaches, concluding that stronger privacy is possible with additional computational resources, though TraceTogether gives authorities substantial access and Singapore’s disclosure requirement limits voluntariness.
Problem
Contact-tracing apps must reveal some information to inform people about exposure, creating privacy risks for snoopers, contacts, and authorities.
Method
The document analyzes privacy from snoopers, contacts, and authorities and discusses cryptographic approaches using private messaging systems and mix networks.
Results
With additional computational resources, contact tracing can provide increased privacy from snoopers, contacts, and authorities while still informing users about exposures.
Takeaways & Limitations
Privacy-preserving contact tracing offers options for protecting users without completely sacrificing public-health aims, so privacy should receive careful design attention before rollout.
Takeaways & Limitations
In Singapore, failing to assist the Ministry of Health in mapping movements is a crime, so releasing TraceTogether data is not fully voluntary.
Abstract
from arXiv · showhide
Contact tracing is an essential tool for public health officials and local communities to fight the spread of novel diseases, such as for the COVID-19 pandemic. The Singaporean government just released a mobile phone app, TraceTogether, that is designed to assist health officials in tracking down exposures after an infected individual is identified. However, there are important privacy implications of the existence of such tracking apps. Here, we analyze some of those implications and discuss ways of ameliorating the privacy concerns without decreasing usefulness to public health. We hope in writing this document to ensure that privacy is a central feature of conversations surrounding mobile contact tracing apps and to encourage community efforts to develop alternative effective solutions with stronger privacy protection for the users. Importantly, though we discuss potential modifications, this document is not meant as a formal research paper, but instead is a response to some of the privacy characteristics of direct contact tracing apps like TraceTogether and an early-stage Request for Comments to the community. Date written: 2020-03-24 Minor correction: 2020-03-30
1 Introduction
As COVID-19 cases grew, manual contact tracing became difficult, prompting countries to adopt varied data-driven approaches. The paper examines privacy-preserving alternatives because legal and societal differences may limit adoption of existing approaches, especially in the United States.
- Hundreds to thousands of cases made manual contact tracing much more difficult in some cities.
- Countries enabled tracing through measures including mobile-phone tracking, public patient databases, shared travel histories, and Bluetooth apps.
- Legal restrictions and public wariness about sharing location or contact data could slow adoption of tracing systems in the United States.
- The document discusses privacy issues and approaches for enhancing privacy guarantees while preserving public-health aims through contact-tracing apps.
2 Singapore’s TraceTogether App
TraceTogether exchanges time-varying Bluetooth tokens through a central server and asks diagnosed users to release received-token data. This protects users from one another but provides little privacy for infected individuals or from government access.
- TraceTogether exchanges time-varying tokens between nearby phones via Bluetooth and sends those tokens to a central server.
- Diagnosed users are asked to release app data containing tokens received from nearby phones.
- Time-varying tokens prevent users from identifying one another directly, except through timing information.
- After an infected individual releases their data, the government can build a list of people they contacted.
3 Desirable Notions of Privacy
The document distinguishes privacy from snoopers, contacts, and authorities, while recognizing that useful exposure notification necessarily reveals some information. It uses these notions to examine TraceTogether’s trade-offs and the limits of its protections.
- Privacy framework: The analysis considers privacy from snoopers, contacts, and authorities as three distinct privacy notions.The document notes that these notions illustrate shortcomings of direct contact-tracing systems rather than constituting rigorous formal privacy definitions.
- Privacy framework: Exposure notification necessarily reveals some information, even when the system reports only a binary exposure result.A linkage attack can expose an individual’s infection status when they were recently near only one person.
- Privacy from snoopers: TraceTogether’s random time-varying tokens prevent snoopers from tracking specific users across different time points when refreshed at a reasonable rate.Refresh frequency trades off tracking resistance against the number of tokens the server must store.
- Privacy from contacts: TraceTogether protects users from one another by sending exposure alerts through the Ministry of Health and revealing only a binary exposure indicator.The binary indicator is described as arguably the minimum information release needed for usefulness, apart from inferences based on a user’s full contact list.
- Privacy from authorities: TraceTogether provides little privacy from authorities because diagnosed users release contact tokens and the system does not hide information from the government.The design avoids GPS because Bluetooth suffices for finding contacts, but it relies on relatively high trust in government.
- Privacy from authorities: Because the government links time-varying tokens with mobile numbers, Bluetooth receivers in public places could theoretically be used to track activities without GPS.The authors note that this trade-off may be less acceptable in countries where citizens trust authorities less than Singaporeans do.
4 Privacy-Enhancing Augmentations to the TraceTogether System
The document examines polling-based and other augmentations to TraceTogether that improve privacy from authorities, while noting that simple noise addition is ineffective and stronger guarantees require trade-offs or more infrastructure.
- 4.1 Partially Anonymizing via Polling: Polling lets Alice learn whether she was exposed without revealing Bob’s identity, although Grace can still attempt linkage attacks.The approach provides some privacy from authorities but not perfect privacy, and malicious queries may reveal Bob’s identity.
- 4.2 Ineffectiveness of Adding Spurious Tokens for Further Anonymization: Adding uniformly random tokens provides little privacy because Grace can filter them out and identify the genuine tokens.The extra tokens mainly pollute Grace’s database without changing her linkage analysis.
- 4.3 Mixing Servers: Mixing diagnosed users’ token groups across servers makes linkage harder by preventing Grace and individual servers from seeing complete token sets.The approach can be simulated with many IP addresses, but that alternative may not be feasible for most users.
- 4.4 Public Database: Publishing the entire infected-token database allows Alice to query locally without revealing which mailboxes she owns to Grace.This is more feasible when relatively few people are infected, but may fail as the epidemic peaks; batching can reduce transmission costs.
5 Privacy from Authorities based on Private Messaging Systems
The proposed private-messaging design treats contact tracing as secure communication between exposed users and uses layered encryption and mix networks to hide message metadata from the authority. It offers stronger authority privacy while leaving adoption-relevant privacy and scalability issues unresolved.
- Security and Utility: The private-messaging approach aims to provide provable privacy from authorities while retaining contact-tracing usefulness, but it is not claimed to be optimal.The authors present it as a sketch based on private messaging systems and private set intersection protocols.
- Private Messaging Design: Alice and Bob exchange public keys as tokens, while encrypted infection-status messages are delivered to mailboxes and queried through proxy servers.Layered encryption ensures only the final server learns Alice’s mailbox and only Alice reads the infection status.
- Privacy Leakage: Contact tracing exposes metadata about who communicates with whom, including sender, recipient, and time, which can reveal contact histories.The document treats this metadata leakage as distinct from disclosure of message contents.
- Private Messaging Design: Mix networks shuffle messages through proxy servers so the sender is decoupled from the destination mailbox.Frank and Fred forward messages without telling each other the source.
- Remaining Issues: Time-varying IDs can let contacts infer a sender’s identity from travel history, creating a trade-off among contact privacy, authority privacy, and tracing effectiveness.Less frequent token refresh may reduce this risk, while aggregation with multi-key homomorphic encryption is deferred to future work.
- Remaining Issues: Message volume can reveal how socially active users are, while dummy messages may mitigate this leakage at a scalability cost.The suitable balance between latency and privacy guarantees requires further stakeholder discussion.
6 Strategies for Encouraging Widespread Adoption
The document argues that contact-tracing apps depend on rapid voluntary adoption and that understandable privacy guarantees, openness, and social or institutional incentives can help build trust and participation.
- Network Effects: Contact-tracing apps require critical mass because their effectiveness depends on widespread installation and peer adoption.The app’s adoption must have a higher “transmission rate” than the virus itself to be effective.
- Building Trust: Strong privacy guarantees may encourage voluntary adoption when apps clearly explain protections against snoopers, contacts, and authorities.The document presents understandable privacy communication as a condition for earning user trust.
- Transparency and Customization: Open-source code audited by security and privacy experts could improve accountability and allow countries to customize apps for local needs.The document notes that TraceTogether was not yet open source at the time of writing, although its creators planned to release the code.
- Institutional Incentives: Requiring app installation for entry to selected public places is proposed as an alternative to mandating installation for all residents.Suggested settings include grocery stores, schools, and universities.
- Social Incentives: Displaying how many nearby people have the app could create social pressure to persuade others to install it.The proposed incentive is framed as supporting public health through greater local adoption.
7 Discussion
The document compares privacy trade-offs in direct Bluetooth contact tracing and outlines increasingly protective alternatives. It emphasizes that stronger privacy may support adoption, while implementation, scalability, security, and policy challenges remain.
- Polling-based contact tracing can provide some anonymity from authorities with minor modifications, unlike TraceTogether.
- Polling still exposes information that authorities could link to individual users, while additional mixing servers offer relatively practical protection.
- Private messaging systems could increase privacy from snoopers, contacts, and authorities, but require greater computational resources.
- The proposed stronger guarantees could provide exposure information without requiring users to trust a third party with private location or medical data.
- Future work must address engineering, security, and policy issues, including scalability and false infection claims.
- The document aims to start discussion about acceptable privacy trade-offs and privacy-preserving contact tracing before early design choices persist.