Apps Gone Rogue: Maintaining Personal Privacy in an Epidemic

TL;DR

This paper reviews mobile phone-based contact-tracing technologies for epidemic containment, highlighting their potential benefits and privacy risks, and discusses advanced security approaches to mitigate these risks.

Contribution

It provides a comprehensive overview of technological approaches, analyzes privacy risks, and proposes security enhancements for mobile contact-tracing tools.

Findings

Mobile contact-tracing can aid epidemic containment

Privacy risks are significant and need mitigation

Security-enhancing approaches can reduce privacy concerns

Abstract

Containment, the key strategy in quickly halting an epidemic, requires rapid identification and quarantine of the infected individuals, determination of whom they have had close contact with in the previous days and weeks, and decontamination of locations the infected individual has visited. Achieving containment demands accurate and timely collection of the infected individual's location and contact history. Traditionally, this process is labor intensive, susceptible to memory errors, and fraught with privacy concerns. With the recent almost ubiquitous availability of smart phones, many people carry a tool which can be utilized to quickly identify an infected individual's contacts during an epidemic, such as the current 2019 novel Coronavirus crisis. Unfortunately, the very same first-generation contact tracing tools have been used to expand mass surveillance, limit individual freedoms and expose the most private details about individuals. We seek to outline the different technological approaches to mobile-phone based contact-tracing to date and elaborate on the opportunities and the risks that these technologies pose to individuals and societies. We describe advanced security enhancing approaches that can mitigate these risks and describe trade-offs one must make when developing and deploying any mass contact-tracing technology. With this paper, our aim is to continue to grow the conversation regarding contact-tracing for epidemic and pandemic containment and discuss opportunities to advance this space. We invite feedback and discussion.