[Paper Review] Apps Gone Rogue: Maintaining Personal Privacy in an Epidemic

Ramesh Raskar, Isabel Schunemann+30 more|arXiv (Cornell University)|Mar 19, 2020

COVID-19 Digital Contact Tracing9 references75 citations

TL;DR

The paper surveys mobile contact-tracing approaches, highlighting privacy risks and proposing privacy-preserving, open-source solutions like Private Kit: Safe Paths for epidemic containment.

ABSTRACT

Containment, the key strategy in quickly halting an epidemic, requires rapid identification and quarantine of the infected individuals, determination of whom they have had close contact with in the previous days and weeks, and decontamination of locations the infected individual has visited. Achieving containment demands accurate and timely collection of the infected individual's location and contact history. Traditionally, this process is labor intensive, susceptible to memory errors, and fraught with privacy concerns. With the recent almost ubiquitous availability of smart phones, many people carry a tool which can be utilized to quickly identify an infected individual's contacts during an epidemic, such as the current 2019 novel Coronavirus crisis. Unfortunately, the very same first-generation contact tracing tools have been used to expand mass surveillance, limit individual freedoms and expose the most private details about individuals. We seek to outline the different technological approaches to mobile-phone based contact-tracing to date and elaborate on the opportunities and the risks that these technologies pose to individuals and societies. We describe advanced security enhancing approaches that can mitigate these risks and describe trade-offs one must make when developing and deploying any mass contact-tracing technology. With this paper, our aim is to continue to grow the conversation regarding contact-tracing for epidemic and pandemic containment and discuss opportunities to advance this space. We invite feedback and discussion.

Motivation & Objective

• Argue for privacy-aware epidemiological contact-tracing during epidemics.
• Categorize broadcasting, selective broadcasting, unicasting, participatory sharing, and Private Kit: Safe Paths.
• Identify privacy risks to diagnosed carriers, users, businesses, and non-users, and discuss consent and inclusion.
• Propose mitigations and trade-offs to balance public health benefits with privacy and security.
• Advocate for citizen-centric, open-source, decentralized solutions to improve trust and adoption.

Proposed method

• Review and compare different technological approaches to mobile contact-tracing (broadcasting, selective broadcasting, unicasting, participatory sharing).
• Describe Private Kit: Safe Paths as an open-source, privacy-first pull-model solution.
• Discuss risk mapping and utility–privacy trade-offs for each approach.
• Present security, consent, and inclusivity considerations and mitigation strategies.
• Propose a phased development & deployment path emphasizing decentralization and data minimization.

Experimental results

Research questions

• RQ1 What are the main technological approaches to mobile contact-tracing and their privacy implications?
• RQ2 How can privacy-preserving, citizen-centric designs (e.g., Private Kit: Safe Paths) mitigate risks while preserving public-health utility?
• RQ3 What are the key privacy, consent, and equity challenges across broadcasting, unicasting, and participatory-sharing models?
• RQ4 What trade-offs exist between data utility for containment and protection of individual privacy?
• RQ5 How can open-source, decentralized architectures improve trust and adoption in contact-tracing tools?

Key findings

• Privacy risks are significant for diagnosed carriers, users, local businesses, and non-users across broadcasting, selective broadcasting, unicasting, and participatory sharing.
• Government-led broadcasting methods can expose identities and invite harassment of places visited by diagnosed individuals.
• Private Kit: Safe Paths offers a privacy-first model that minimizes centralized data collection and enables exposure notifications without central data access.
• Consent mechanisms and data minimization are critical but often insufficient in practice; inclusive, accessible designs are needed.
• Open-source, decentralized approaches can enhance trust, security, and auditability, mitigating surveillance risks while supporting containment efforts.