Why Contact Tracing Apps Are Not Anonymous

Read Time:2 Minute, 0 Second

First a couple of definitions.

Track or trace? It depends, it means different things. From basic dictionary definitions, I paraphrase the following meanings:

to trace: follow the completed path backwards from its current point to where it began.

to track: follow the emerging path forwards from your starting point to wherever the thing currently is.

What is contact tracing in the context of epidemic outbreaks? According to WHO definition it is a “monitoring process” consisting of “3 basic steps”: Contact identification, contact listing and contact follow-up.
The full definition can be found here.

So, to have tracing, you must not only identify (and track) the infected, you must also trace (and identify) all his (close)contacts.

The operative word here is “identify”. Someone must do that, be it a government, health-care institution or private entity. Thus, contact tracing cannot be possibly done in a anonymous manner.
Can this be done in a decentralised fashion? Maybe, but that doesn’t improve the privacy, nor does it create anonymity. Once you have identified the individual, (s)he is identified.

I haven’t looked at all apps currently under development, and randomly picked the DP3T app DP3T stands for “Decentralized Privacy-Preserving Proximity Tracing” and its goal is, according to the project’s White Paper:

The goal of proximity tracing is to determine who has been in close contact physical proximity to an infected person, without revealing the contact’s identity or where the contact occurred.

Okay, but if you don’t know who met whom and where, then where is the “tracing” part of the app? It would appear that this is more like a “Proximity Radar” that alerts you, when a person who’s identified as being tested positive comes into your perimeter.

Also if the phone starts to beep when your neighbour is close to you, you’ll know exactly who’s positive – again, no anonymity, do data privacy. This even has a name: It’s calle information leakage in IT security circles.

What’s my conclusion about these “contact/proximity tracing” apps? Don’t use them. As soon as you are in this system, your information will be used, sooner or later, to track and trace you and the people you had contact with. Even if that tracking & tracing were not used, the app might still give away some very private information about you and your health.
Or short: Use at your own risk, but you’ve been warned.