‘Privacy is actually something we can address, if governments stick to the principles we set out’
Hundreds of security experts have signed an open letter calling for privacy safeguards to be built into coronavirus contact-tracing apps.
Smartphone-based contact-tracing apps are designed to alert users that they have been close to someone who later goes on to develop symptoms or tests positive for Covid-19. Recipients of alerts would be advised to self-isolate or quarantine themselves at home.
Policymakers view the technology as a tool that might allow them to safely ease population-wide lockdowns in place across much of the world.
But doubts exist about both the effectiveness of the contact tracing technology and the privacy implications that arise from its use.
These concerns arise partly from false positives (for instance, being physically close to someone who develops an infection but separated by a partition or other barrier would not actually put you at risk) and false negatives (such as picking up infection through a mutually touched object without ever being in proximity to the virus carrier) that might undermine the effectiveness of contact-tracing apps.
In addition, contact tracing based on Bluetooth beacons along the lines of technology already deployed in Singapore and under consideration elsewhere is not terribly reliable.
Poor voluntary uptake of the technology and the possibility of denial-of-service attacks and other forms of malevolence and mischief are among other criticisms, as previously reported.
RELATED Coronavirus: UK contact-tracing app raises privacy concerns
Privacy preserving by design
Scientists and researchers who do see some utility in contact-tracing apps are nonetheless also concerned about the privacy implications. They worry that contact-tracing technologies established for an emergency might be repurposed and used for surveillance once the pandemic is eventually defeated.
Around 300 scientists and researchers worldwide have written an open letter highlighting their concerns and proposing a path towards the development of apps that that are “privacy preserving by design”.
“Contact-tracing apps must only be used to support public health measures for the containment of Covid-19,” the open letter states. “The system must not be capable of collecting, processing, or transmitting any more data than what is necessary to achieve this purpose.”
The signatories argue that system design should be transparent and engineering choices biased towards privacy-preserving options and a decentralized system in order to limit the potential for abuse.
The system also ought to be dismantled once its goal – assisting containment of the pandemic – is achieved.
“The use of contact-tracing apps and the systems that support them must be voluntary, used with the explicit consent of the user and the systems must be designed to be able to be switched off, and all data deleted, when the current crisis is over,” the open letter from the academics concludes.
Professor Alan Woodward, a computer scientist at the University of Surrey, told The Daily Swig that “privacy is actually something we can address, if governments stick to the principles we set out. Sadly, some seem to be heading in other directions.”
Simply getting the technology to work reliably might be among the biggest challenges, Professor Woodward acknowledged.
“The bigger engineering challenge is the accuracy of BLE [Bluetooth Low Energy] RSSI (received signal strength indicator) as a measure of distance,” he explained.
“It is a poor proxy for distance, and you get 1.5-2m accuracy, if you’re lucky. The more naive apps are relying solely on RSSI but the better apps are measuring not just RSSI but also time you are within range of the other beacon.”
Prof Woodward continued: “From that the epidemiologists are constructing models to try to determine your risk. It’s new territory and experiments are ongoing, but the best apps will allow the public healthcare professionals to tweak the risk model as we learn more about the virus, how it spreads, how infectious it really is, etc.”
RECOMMENDED Coronavirus contact-tracing apps are worse than useless – Schneier
