Thread by @LeaKissner

@carmelatroncoso is speaking about "CONTACT TRACING APPS: ENGINEERING PRIVACY IN QUICKSAND" at #enigma2021

usenix.org/conference/eni…

Engineering contact-tracing apps has been a marathon

Why make them?
* manual contact-tracing became totally overwhelmed with covid cases
* can we supplement with technology?

Constraints: security and privacy
* protect from misuse: surveillance, target marginalized individuals, etc.
* purpose limitation by default
* hide user's identity, location, behaviour
* preserve system integrity

Those fears were well-founded -- information collected for covid was used by other parties e.g. police

Hidden constraint: reality
* highly scalable and reliable
* design under time pressure, has to be built and verified quickly
* dependencies, dependencies -- have to use the sensors we already have

First idea... never got made because reality is hard and has to work with the phones we have
* can't use too much battery
* Apple needed to be involved so that the app could see BT beacons (blocked for privacy reasons)
* needs to be compatible between Android and iOS

Google and Apple did the implementation, which had a lot of implications

* App creates a secret every day
* creates unlinkable BT tokens to broadcast that day
* when you see BT tokens, store them for later use

* If you're infected, upload your BT tokens to a server for when you were infectious
* Everyone gets the "infectious" tokens. If you've seen them, then the phone tells you to isolate and get tested

Strong privacy protections
* unlinkable
* information virtually all stays on the phone
* system sunsets by design

Protocol is just a part of a whole interlocking solution
* epidemiological etc

Authorization mechanism first design
* has to be hard to delegate
* privacy

We know how to do this with crypto (commit in a token)
... but health systems don't have the tools to handle this!
have to use a simple activation code

Are we done?
* in this system the only uploads are from covid+ people
* we can solve! first version: have everyone upload random crud
* but in the real world, you don't know peoples' behaviour. It's going to get messy. And you could accidentally DDoS the server/network
* battery

* also can't use an anonymity network (e.g. ToR) because it's not everywhere, would get DoSed, and we can't afford delays to notifcation (the whole point is to be faster than manual contact tracing)

How to get this access code?

Servers don't live in a vacuum
[ I can vouch for this. It's very messy. No you can't read that whole diagram, I know. It's messier than that. ]

Where is this deployed?
Field experiment in Zurich Oct 2020
* 80% of COVID+ users upload codes
* 22% sent quarentine
* 1/10 tested + after notification

Key lessons:
* data is not a must
* privacy engineering goes well beyond crypto
* privacy engineering in a cloud world is hard [yes]
* keeping in mind socio-technical integration is key
* purpose limitation and abuse prevention is a must

[end of talk]