CS Nov-Dec 2020

contact tracing
WE HAVE CONTACT
THERE IS AN INCREASING RELIANCE ON DATA-DRIVEN TECHNOLOGIES TO HELP CONTAIN COVID-19,
ESPECIALLY THROUGH CONTACT TRACING. BUT MIGHT THESE INFRINGE HUMAN RIGHTS?
All contact tracing apps have one thing
in common: they record when you're
close to someone else (usually in a
way that preserves your privacy) and try to
characterise how close and for how long,
states Ian Levy, in a blog published on the
National Cyber Security Centre website.
In all sensible models, he points out, this
information is held privately on the user's
phone. "The differences start when someone
reports they're ill. Then, the different design
choices and cryptographic models dictate
the public health responses your app can
support." In his blog, Levy uses the word
'anonymous' in its security sense. "That's
different to the definition under GDPR and
other law. The proper legal descriptions of
the data we use are in the Data Protection
Impact Assessments, which will be
published," he continues.
In the first model (known as 'the
decentralised model'), you tell the system
you're ill and give it no extra information.
Periodically, it collects a list of everyone who
has said they're ill and sends it out to all users
of the app. "Individual devices look to see if
any of its local contacts are on the list and
tells their user, if this is the case (subject to
some local risk modelling about the sort of
encounters they had). Notifications will lead
to some health interventions, probably selfisolation
to start with."
Those concerned about failures to protect
individual's privacy have argued that this
decentralised model is the one to follow,
as it gives maximum protection. However,
Levy argues that, "while the health authority
would know the anonymous identity of the
22
computing security Nov/Dec 2020 @CSMagAndAwards www.computingsecurity.co.uk