Digital Contact Tracing

 Using someone's mobile device to track who they are in contact with. The entire class is technical detail of stuff.  

These levels of contact are VERY important for people managine this disease at a state or country level. 

How does the state of Wisconsin do contact tracing? 

Phone-based proximity learning havephones, and exchange information, and depending on this information you have to perform contact tracing, based on location.

The second type is infrastructure-based interaction. These are based on access points, MAC addresses, and NET IDs. This is mainly Wi-Fi points. The technology enabling that is. How do we use GPS to do proximity sensing? We look at each person's location AND compare it to that of other people. There is a lot of location and privacy issues involving with subpoenas. 

We don't really care about the absolute locations to get this proximity information. What technologies can be used?

-Bluetooth Low energy can be used to achieve this proximity sensing, something called  Bluetooth Low, Energy, or BLE. 

Bluetooth is an attractive communication technology because it is short range, with a low energy footprint and supported by most of the hosts. 

BLE helops to facilitate the communication with smart devices. This year, 2.7 billion BLE products are expective. It is short range and has a relatively low energy footprint. 

The BLE device is in standby almost all of the time. Very occasionally, it will transmit a certain enterprising devices.

Standby: low power mode: receiver and transmitter switched off.

Advertising is used by low power "server".

Scanning is used by "client".

Initiating is when the "server" sends a connection request, and the connection happens after scannign where the "client responds to the server advertisement. 

There are 3 dedicated advertising channel, where are channels 37, 38, and 39 with 2402, 2426, and 2480 MHz and these overlap with Wi-Fi.

 There are 3 main channels to deploy the network on which are channels 1, 6, and 11. 

ADV_DIRECT_IND connects to a particular device only, and ADV_IND has general prescence known _ connections. There is a random delay. 

A device says "Hi I am here I am here I am here" and the other device says, "Oh! look! someone says I'm here!"

We want to record the time of a BLE advertisement at an address and track that at a particular period of time. 

This is the format of the BLE advertisement. It has a source address and a transmission power. 

What about proximity without infrastructure? We act as advertisers and scanners at the same time. Our phones send advertisement messages, scan for messages, and when the distance is less than a threshold. 

Any problems with the final solution? 

BLE collects time stamp, bluetooth adress, advertisement content and RSSI. Some of these devices can leak a lot of data, including a key finder a glucose monitor, a smartband, a heart rate monitor, and a digital pen. Using the smartphone as a digital contact tracing solution, you have to be careful.

You can also connect to some devices without any security, and are able to get information to them. 

If I am the developer of this technology, the basic mechanism that I can deploy to protect someone's privacy is to secure as much metadata as possible, and only allow the acknowledgement devices to be sent. 

My phone send beacons with an identifier, and I scan and store these messages. If someone tests positive, I alert the health authorities, and update the users with "positive" identifiers. 

Apple and Google have released a joint specification for privacy-preserving proximity tracing on iOS and Android. 

A phone broadcasts an ephemeral ID, because it changes.

The user stored Ephemeral IDs and send them to the backend health authorities, and send them to all the users participating in the system, and match them for scan people. Durations are also collected, and if there is a match, say, "Hey, you need to be tested for COVID". 

The attacker could send a bunch of Bogus keys and see if they hit, they can definitely inject fake contacts in the system, but the attacker needs to use IDs that can match someone else's IDs. 

Adversaries are warDriving and attacker drive-by in drones. 

There is a Wi-Fi based alternative in Georgia Tech.

The idea is that everytime there are lots of points deployed on campus

UW Madison can have these logs and can connect to these access points. There can be a time window, and individual who were connected to an individual access point at the same time. 

The BLE tracing has Privacy pros but a bad adoption rate. The Wi-fi has a good adoption rate, but it has issues with privacy. 

The last picture pertains to what the Contact tracing model looks like, and how privacy is protected.