Many countries are currently gearing up to use smart-phone apps to perform contact tracing as part of the effort to manage the COVID-19 pandemic and prevent resurgences of the disease after the initial outbreak. With the announcement of the Apple/Google partnership to introduce contact-tracing functionality to iOS and Android, it seems likely that this will be adopted in many countries. An important part of the functionality of the app will be to decide whether a person should be advised to self-isolate, be tested or end isolation. However, the privacy preserving nature of the Apple/Google contact tracing algorithm means that centralised curation of these decisions is not possible so each phone must use its own "risk model" to inform decisions. Ideally, the risk model should use Bayesian inference to decide the best course of action given the test results of the user and those of other users. Here we present a decentralised algorithm that estimates the Bayesian posterior probability of viral transmission events and evaluates when a user should be notified, tested or released from isolation while preserving user privacy. The algorithm also allows the disease models on the phones to learn from everyone's contact-tracing data and will allow Epidemiologists to better understand the dynamics of the disease. The algorithm is a message passing algorithm, based on belief propagation, so each smart-phone can be used to execute a small part of the algorithm without releasing any sensitive information. In this way, the network of all participating smart-phones forms a distributed computation device that performs Bayesian inference, informs each user when they should start/end isolation or be tested and learns about the disease from user's data.
In 2020 the coronavirus outbreak changed the lives of people worldwide. After an initial time period in which it was unclear how to battle the virus, social distancing has been recognised globally as an effective method to mitigate the disease spread. This called for technological tools such as Mobile Contact Tracing Applications (MCTA), which are used to digitally trace contacts among people, and in case a positive case is found, people with the application installed which had been in contact will be notified. De-centralised MCTA may suffer from a novel kind of privacy attack, based on the me…
We report the development of an open-source, hardware-based contact tracer, made from readily available parts, costing less than $20USD. This work was motivated by the need for a technology-assisted contact tracer that avoids privacy issues found with those involving a mobile phone. Contact tracing is done here without the use of a mobile phone or an app at all. Instead, contact tracing is implemented using Bluetooth Low Energy on an ESP32 micro-controller. The ESP32 is used to both advertise and receive health information to others in close proximity, forming a strictly peer-to-peer contact t…
This paper discusses the aspects of data reliability and user privacy for the emerging practice of mobile phone based contact tracing for the COVID-19 pandemic. Various countries and large technology companies have already used or plan to design and use mobile phone based solutions, in an effort to urgently expedite the process of identifying people who may have been exposed to the disease and limit its spread to the general population. However, serious concerns have been raised both in terms of the validity of the collected data as well as the extent to which implemented approaches can breach…
In the cases when public health authorities confirm a patient with highly contagious disease, they release the summaries about patient locations and travel information. However, due to privacy concerns, these releases do not include the detailed data and typically comprise the information only about commercial facilities and public transportation used by the patients. We addressed this problem and proposed to release the patient location data as open data represented in a structured form of the information described in press releases. Therefore, residents would be able to use these data for au…
The onset of COVID-19 has led to the introduction of far-reaching digital interventions in the interest of public health. Among these, digital contact tracing has been proposed as a viable means of targeted control in countries across the globe, including on the African continent. This, in turn, creates significant ethical challenges for vulnerable communities, including LGBTQIA+ persons. In this research paper, we explore some of the ethical implications of digital contact tracing for the LGBTQIA+ community. We refer specifically to the digital infringement of freedoms, and ground our discuss…
During a pandemic, contact tracing is an essential tool to drive down the infection rate within a population. To accelerate the laborious manual contact tracing process, digital contact tracing (DCT) tools can track contact events transparently and privately by using the sensing and signaling capabilities of the ubiquitous cell phone. However, an effective DCT must not only preserve user privacy but also augment the existing manual contact tracing process. Indeed, not every member of a population may own a cell phone or have a DCT app installed and enabled. We present KHOVID to fulfill the com…
As a response to the COVID-19 pandemic digital contact tracing has been proposed as a tool to support the health authorities in their quest to determine who has been in close and sustained contact with a person infected by the coronavirus. In April 2020 Google and Apple released the Google Apple Exposure Notification (GAEN) framework, as a decentralised and more privacy friendly platform for contact tracing. The GAEN framework implements exposure notification mostly at the operating system layer, instead of fully at the app(lication) layer. In this paper we study the consequences of this appro…
We outline a contact-tracing strategy based on proximity sensing using mobile devices. We discuss what an ideal system should look like and what it can do. We show that, when adopted sufficiently broadly, such a contact-tracing strategy can bring COVID-19 under complete control, end the need of social distancing, and return the society to full normalcy. We also review some of the challenges faced by the current generation of proximity-sensing technologies, including Bluetooth Low Energy used by phones, and consider both interim and longer-term solutions. Our main contribution is that we reason…
This document describes and analyzes a system for secure and privacy-preserving proximity tracing at large scale. This system, referred to as DP3T, provides a technological foundation to help slow the spread of SARS-CoV-2 by simplifying and accelerating the process of notifying people who might have been exposed to the virus so that they can take appropriate measures to break its transmission chain. The system aims to minimise privacy and security risks for individuals and communities and guarantee the highest level of data protection. The goal of our proximity tracing system is to determine w…
Manual contact tracing is a top-down solution that starts with contact tracers at the public health level, who identify the contacts of infected individuals, interview them to get additional context about the exposure, and also monitor their symptoms and support them until the incubation period is passed. On the other hand, digital contact tracing is a bottom-up solution that starts with citizens who on obtaining a notification about possible exposure to an infected individual may choose to ignore the notification, get tested to determine if they were actually exposed or self-isolate and monit…
Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy, the so-called "Google/Apple Proposal", which we abbreviate by "GAP". We demonstrate that in real-world scenarios the current GAP design is vulnerable to (i) profiling and possibly de-anonymizing infected persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts with the potential of affecting the accuracy of an app-based contact tracing system. For both types of attack, we have built tools that can easily be…
Contact tracing is a well-established and effective approach for the containment of the spread of infectious diseases. While Bluetooth-based contact tracing method using phones has become popular recently, these approaches suffer from the need for a critical mass adoption to be effective. In this paper, we present WiFiTrace, a network-centric approach for contact tracing that relies on passive WiFi sensing with no client-side involvement. Our approach exploits WiFi network logs gathered by enterprise networks for performance and security monitoring, and utilizes them for reconstructing device …
Containment, the key strategy in quickly halting an epidemic, requires rapid identification and quarantine of the infected individuals, determination of whom they have had close contact with in the previous days and weeks, and decontamination of locations the infected individual has visited. Achieving containment demands accurate and timely collection of the infected individual's location and contact history. Traditionally, this process is labor intensive, susceptible to memory errors, and fraught with privacy concerns. With the recent almost ubiquitous availability of smart phones, many peopl…
Several governments introduced or promoted the use of contact-tracing apps during the ongoing COVID-19 pandemic. In Germany, the related app is called Corona-Warn-App, and by end of 2020, it had 22.8 million downloads. Contact tracing is a promising approach for containing the spread of the novel coronavirus. It is only effective if there is a large user base, which brings new challenges like app users unfamiliar with using smartphones or apps. As Corona-Warn-App is voluntary to use, reaching many users and gaining a positive public perception is crucial for its effectiveness. Based on app rev…
The coronavirus (COVID-19) has appeared as the greatest challenge due to its continuous structural evolution as well as the absence of proper antidotes for this particular virus. The virus mainly spreads and replicates itself among mass people through close contact which unfortunately can happen in many unpredictable ways. Therefore, to slow down the spread of this novel virus, the only relevant initiatives are to maintain social distance, perform contact tracing, use proper safety gears, and impose quarantine measures. But despite being theoretically possible, these approaches are very diffic…
Digital contact tracing is being used by many countries to help contain COVID-19's spread in a post-lockdown world. Among the various available techniques, decentralized contact tracing that uses Bluetooth received signal strength indication (RSSI) to detect proximity is considered less of a privacy risk than approaches that rely on collecting absolute locations via GPS, cellular-tower history, or QR-code scanning. As of October 2020, there have been millions of downloads of such Bluetooth-based contract-tracing apps, as more and more countries officially adopt them. However, the effectiveness…
The highly transmissible COVID-19 disease is a serious threat to people's health and life. To automate tracing those who have been in close physical contact with newly infected people and/or to analyse tracing-related data, researchers have proposed various ad-hoc programs that require being executed on users' smartphones. Nevertheless, the existing solutions have two primary limitations: (1) lack of generality: for each type of analytic task, a certain kind of data needs to be sent to an analyst; (2) lack of transparency: parties who provide data to an analyst are not necessarily infected ind…
Since the global spread of Covid-19 began to overwhelm the attempts of governments to conduct manual contact-tracing, there has been much interest in using the power of mobile phones to automate the contact-tracing process through the development of exposure notification applications. The rough idea is simple: use Bluetooth or other data-exchange technologies to record contacts between users, enable users to report positive diagnoses, and alert users who have been exposed to sick users. Of course, there are many privacy concerns associated with this idea. Much of the work in this area has been…
Responses to COVID-19 have largely been led by local, national, and international public health agencies, who have activated their pandemic plans and opened the epidemiological toolkit of modelling, testing, isolation and movement restrictions, surveillance, and contact tracing. In the contemporary tech-heavy world, many assumed that the common manual process of human investigators and phone calls could or should be replaced by digital solutions. But it's not as simple as "add more technology" - the complex way in which users and societies interact with the technology has significant impacts o…
Contact tracing requires a strong understanding of the context of a user, and location with other sensory data could provide a context for any infection encounter. Although Bluetooth technology gives a good insight into the proximity aspect of an encounter, it does not provide any location context related to it which helps to make better decisions. Using the ideas presented in this paper, one shall be able to obtain this valuable information that could address the problem of false-positive and false-negative to a certain extent. All of this within the purview of Google/Apple Exposure Notificat…
