Top Researchers Condemn Centralized COVID-19 Tracking Approach

As nations throughout Europe wrestle with how to contain the spread of COVID-19, several research units have been developing tracking solutions to help detect ill citizens. Not all of these solutions, however, offer equitable privacy measures for users. 

One offering could even spell the end of privacy rights for Europeans. 

The Pan-European Privacy-Preserving Proximity Tracing Initiative (PEPP-PT) was announced on Apr. 1, 2020. 

It was assembled to develop software that would notify citizens if they had been in contact with someone who had tested positive for COVID-19. If detected, users would be advised that they should quarantine themselves.

Phone apps could then be built on top of this software and leverage devices’ Bluetooth signals. This is called contact tracing and is the same iteration that Google and Apple will use in their tracking solution. 

It is distinct from facial recognition software or so-called digital “immunity passports.” More importantly, it is much more challenging to repurpose certain Bluetooth-based contact tracing solutions for commercial purposes or mass surveillance. 

Concerns over repurposing such software are at the heart of an emerging controversy within the European open-source research community. 

One of the core tenets of the PEPP-PT had included mention of another protocol called DP-3T. 

In short, DP-3T offers many of the same tracking benefits plus decentralization. Data would be stored locally on the users’ device rather than in a central server or cloud. The Google and Apple tracking solution closely resembles DP-3T too.

This benefit is two-fold. 

In the first, a decentralized tracking protocol is far more secure from digital piracy. Though malicious agents could access some data, the prize would only be limited to a few users. A centralized server that stores a continent’s worth of citizen’s movements, for instance, is far more attractive for hackers. 

Secondly, a decentralized solution would have limited applications once COVID-19 has run its course, and tracking technologies are no longer needed. The primary threat of a centralized solution is that of repurposing valuable data for reasons beyond curbing a viral illness. 

It is for these two reasons that a decentralized approach to tracking users has been championed as safer and more ethical.

On Apr. 16, 2020, PEPP-PT had, however, removed any earlier mention of using DP-3T. 

A day later, Hans-Christian Boos, one of the primary organizers of PEPP-PT and founder of the AI firm Arago, told the German media that he recommends a centralized tracking solution for Germany. 

Meanwhile, PEPP-PT had already earned the attention of various governments and sizeable European research institutes, like Fraunhofer and Inria. Critically, there has been little in the way of transparency as to how PEPP-PT and relevant research groups are progressing.

#DP3T entered as a candidate to so-called PEPP-PT in good faith, but it is now clear that powerful actors pushing centralised databases of Bluetooth contact tracing do not, and will not, act in good faith.

PEPP-PT is a Trojan horse.

— Michael Veale (@mikarv) April 16, 2020

Though discussions are actively populating DP-3T’s GitHub page and source code, PEPP-PT has done little to demonstrate a similar level of transparency. On Apr. 17, 2020, the project did publish a PDF document on GitHub, only to remove it shortly after. 

Nadim Kobeissi, a cryptographer and former Inria researcher, mirrored a copy of the “hastily written” proposal on his blog. 

In an interview with Crypto Briefing, Kobeissi described the document as a “freshman-level attempt” at a safe tracking protocol. Further, the document does not appear to fall in line with Europe’s GDPR mandate. 

The concerns around PEPP-PT’s proposed solution, the opacity of the project thus far, and the high stakes have led many members of the initiative to drop support. Logos from the Swiss Federal Institute of Technology Lausanne (EPFL), KU Leuven, ETH Zürich, and others have all been removed from the PEPP-PT site. 

ETH Zurich yesterday notified PEPP-PT that it is withdrawing from the PEPP-PT consortium with immediate effect. Our relentless focus from now on is #DP3T.

— kennyog (@kennyog) April 18, 2020

Dr. Kenneth Paterson, a lead cryptographer at ETH Zürich, told Crypto Briefing that the institution “kindly withdrew” due to the centralization concerns. Paterson said: 

“The centralized solution poses two key problems. It neglects data minimization, which means that the only data collected would be that which is needed for the application. It also fails to acknowledge the potential for repurposing.” 

On Apr. 17., the European Parliament also voted in favor of a decentralized approach that minimizes data collection.

Today, Paterson followed this up with a joint statement from roughly 300 scientists across 25 countries that condemns protocols that fail to uphold user privacy and security.

The document concludes that all of the teams represented will also be fully committed to developing ethical tracking services. 

This includes work on DP-3T, but also research within the TCN Coalition, the University of Washington’s CovidSafe program, and the Massachusetts Institute of Technology’s PACT initiative. 

Crypto Briefing has reached out to Hans-Christian Boos for commentary on PEPP-PT. He has not yet responded at the time of press. 

The post Top Researchers Condemn Centralized COVID-19 Tracking Approach appeared first on Crypto Briefing.