Contact Tracing Apps may Pave the Way for a New Generation of More Private Social Networks

The Exposure Notification is just the tip of the iceberg…

What is the purpose of an exposure notification for COVID-19 risk?

The exposure notification API has been built to enable contact tracing apps to exchange randomized identifiers using Bluetooth Low Energy when smartphones with the same app are in proximity. That way physical interactions can be recorded with other smartphone users. In the case of Apple if you install a contract tracing app that uses their exposure notification system you can now benefit from up to 14 days of history.

How does exposure notification work?

In the event someone gets diagnosed with COVID-19, the infected user can anonymously declare their status within the app, and other users who spent time with that person in the last 14 days will be notified as well.

1. If you come into contact with someone who declares they are showing symptoms or have tested positive, the contact tracing app will alert you
2. If you are showing symptoms or test positive, a random, anonymous ID is shared with people who were nearby and with whom you spent some time
3. An alert notifies you through the app that you were in contact with someone who was diagnosed as infected

Technically, the exposure notification API works by locally generating anonymous and temporary secure identities and exchange them using a local area wireless interface such as Bluetooth Low Energy. Notifications of one’s infectious state are done by broadcasting their infected temporary IDs so that contact tracing can be performed locally on all mobile devices without the need to exchange any personally identifiable information (PII).

Why is exposure notification just the beginning to help prevent the spread of Covid-19?

First of all, most contact tracing apps apply different models of notifications. Apple Google, and other protocols like the Whisper Tracing Protocol or TCN-Coalition have come up with a good privacy model but no one has done a study to know when to notify someone. The cautious approach would be to notify anyone you spent a short time with within 6 feet in the last 14 days after you were diagnosed with Covid-19 but this could prove to create many false positives.

A more dynamic solution is needed

The solution of recording interactions through the exposure notification API is passive. Instead of logging interactions for the simple purpose of notifying you when you have spent time nearby or with someone diagnosed as positive, the history of interactions could provide you with more dynamic information that can be helpful to assess the risks of meeting with somebody.

Currently, Facebook and other social networks create a social graph using your friendships and analyze your direct (first level) connections, then your second and third-level connections to recommend new friends or understand your profile better for ads targeting purposes.

To better protect your privacy, your social graph which can be built using your physical interactions and the second level interactions from the people you meet can remain anonymous. Then it can be analyzed and leveraged to alert you when needed. This shows there is a way for building more secure and private social networks.

The modern cryptography techniques discovered while developing solutions that protect privacy for contact tracing will certainly spark new ideas.

Your Personal Social Graph could notify you when you may be at risk

I am going to describe a few examples of interactions that could trigger a notification to help protect people even if no direct contact has yet declared that they had been diagnosed with Covid-19.

Example A

You are meeting a friend for the first time in a long time for more than 30 minutes. The contact tracing app of your friend knows that he has spent an abnormal amount of time with new people that are not in his direct social circles.

The app should notify him to be extra cautious as he put himself at risk and alert you to keep social distancing as you are meeting new people outside of your usual social circles.

Example B

You are in a crowded place with a large number of new contacts that stay within close proximity like at a stadium, a theater, or a plane.

The app should remind you to be extra cautious and to make sure to wear a mask and wash your hands often.

These are just some thoughts to help spur thinking about what could be the next generation of social networks. We have learned a lot with contact tracing protocols about keeping interactions anonymous and protecting people’s privacy. Further, new cryptographic techniques are becoming easier to deploy. As these new concepts are getting more adopted and traditional social networks more and more criticized for privacy abuses; I think we can foresee wider applications that could change the way we build and leverage our social graphs.

Other related reading: Passive Social Network Using Location