Privacy-Preserving Infection Exposure Notification without Trust in Third Parties

Abstract

In response to the COVID-19 pandemic, Bluetooth-based contact tracing has been deployed in many countries with the help of the developers of smartphone operating systems that provide APIs for privacypreserving exposure notification. However, it has been assumed by the design that the OS developers, smartphone vendors, or governments will not violate people's privacy.We propose a privacy-preserving exposure notification under situations where none of the middle entities can be trusted. We believe that it can be achieved with small changes to the existing mechanism: random numbers are generated on the application side instead of the OS, and the positive test results are reported to a public ledger (e.g. blockchain) rather than to a government server, with endorsements from the medical institutes with blind signatures. We also discuss how to incentivize the peer-to-peer maintenance of the public ledger if it should be newly built.We show that the level of verifiability is much higher with our proposed design if a consumer group were to verify the privacy protections of the deployed systems.We believe that this will allow for safer contact tracing, and contribute to healthier lifestyles for citizens who may want to or have to go out under pandemic situations.

User perceptions about sharing exposure notification information for communicable diseases

“…Furthermore, users may have varying motivations for using an ENS app, including intrinsic motivation to help others (15, 16), compliance with rules/regulations for fear of not being able to work or participate in desirable activities (12,14), fear of illness or death (15, 16), and others. By and large, public resistance to the ENS has focused on user trust and app usefulness contrasted by the potential infringement of privacy (16,(18)(19)(20)(21)(22)(23)(24)(25). Privacy and security risks may lead to low app performance, user fears about using the service, or distrust in results (21).…”

Technical Analysis of Contact Tracing Platform Developed by Google–Apple for Constraining the Spread of COVID-19

“…Google and Apple developed a privacy-preserving contact tracing platform, named Exposure Notifications System (https://covid19.apple.com/contacttracing) (accessed on 9 August 2022) (ENS) to curb the spread of COVID-19 through a shared sense of responsibility. It is the first OS-assisted ENS with strong privacy guarantees [11]. The ENS protects the privacy of users by not collecting any location/identity-related data, most processing is done locally without a central server, and only legitimate health authorities use the system under strict rules.…”