Governments are pondering if apps can help them perform contact tracing for COVID-19 infected people. The "why" of this is explained very well here: 1/16
Some countries just track the location of everyone all the time and perform matching on a government server. This is a privacy nightmare. 2/16
www1.cbn.com/cbnnews/israel…
www1.cbn.com/cbnnews/israel…
Can we do better? An international team has designed a protocol that allows tracing, while preserving privacy: DP-3T
/cc @marcelsalathe @mikarv 3/16
/cc @marcelsalathe @mikarv 3/16
It works like this. The app on your phone starts broadcasting seemingly "EphID" random numbers over Bluetooth LE. People around you with the app do the same. 4/16 
All the phones also store the numbers they receive, for fourteen days. These numbers don't tell us a lot because they appear to be random. 5/16
The number you broadcast stays the same for a while, and then it changes, many times per day. This means you can't track individual people (for very long). Bit like "TMSI". 6/16
Let's say I get infected with COVID-19, I go to the doctor, the infection is confirmed. I would now like to share this news with the world. Perhaps the doctor would too! 7/16
And here is the clever bit. For every day, all the numbers I broadcast were generated with the same cryptographic key. With the doctor's confirmation, I upload my last 14 daily keys. 8/16
These 14 keys are now shared (via internet) with all the installed apps, and all of them then use the keys to check if any of the many numbers it has received are a match. 9/16
If so, the owner of the phone knows: I have been in contact with someone who was infected. If we only received an infected number ONCE, contact was probably brief. 10/16
If we find that we received the infected number a lot of times, we were probably in the same car / tram / train / class / cinema. 11/16
The app could also tell us how long ago the numbers were received, and possibly also where we were at the time. 12/16
Indoor contact for example is a lot more infectious. Based on this, the user of the app can be strongly advised to self-isolate (or not). 13/16
The DP-3T protocol design is simple and clever. The privacy implications look good. A lot depends on the implementation details however.
github.com/DP-3T/document… 14/16
github.com/DP-3T/document… 14/16
There is another protocol as well called CEN, DP-3T and CEN are compared here: zfnd.org/blog/private-c… 15/16
Will this work? I don't know, but it looks worth a try. Is anyone implementing DP-3T? Are any governments interested? I'd love to hear! 16/16
