Covid-19 - Bluetooth Tracking

First, let me introduce myself. I run a startup using Bluetooth Low Energy (BLE) for smart homes. In particular, we provide presence functions. We've been continuously searching for ways to protect the anonymity of our users while providing the desired functionality. My own background is electrical engineering, computer science, and cognitive psychology.

Should we use Bluetooth Low Energy?

We are getting a lot of questions with respect to receiving and/or broadcasting BLE messages in the background on iOS devices. However, now there is Apple/Google collaboration (see spec), there will be much better OS support than cross-platform use of the so-called overflow region. Think of being able to rotate keys in the background for example. Note that if you don't use this, you'll need to ask people to keep their iOS app open in the foreground (as with BlueTrace, from Singapore).

According to the spec, an (infected) user is represented by a bunch of 15 minute keys. These keys are uploaded to and distributed by authorized healthcare entities. The devices will scan for other devices every 5 minutes (it doesn't say for how long: the duty cycle is not defined). Each day it will have an aggregated value of "contact duration" in increments of 5 minutes according to the code comments in an API draft. Note that you don't know how many infectious people there were, where they were, or how fast they were passing by. You only know from the 60/5*24 = 288 times your phone was scanning on a day, how often it encountered an infected key (this doc mentions 10 minutes = 144 times). It is also recommended to only upload keys 24 hours or older, so you basically only know how "dangerous" your past days were.

The advertisement interval is recommended to be 200-270ms. If we scan for 1 minute, we might encounter 1/0.2*60=300 packets per time window. The range of Bluetooth typically is around 10-20 meter outdoors, but can be up to 70 meter. The packet loss at the larger distances becomes really large though, still we will see those packets! Note that if we are scanning for 1 minute every 5 minutes, we are not scanning for 4 minutes! Let us summarize this:

• We will fail to register people who we encounter during the 4 minute "downtime" every 5 minutes;
• We will register many people who are not nearby. Even if packet loss goes to 99% we still get 3 packets in from a person if we use the above calculation;
• You might have heard that Bluetooth cannot go through walls, etc. However, our experience is that it gets remarkably far. You will definitely get many packets from your neighbors, etc. See also me scanning in this short video clip below;
• Bluetooth doesn't know anything about altitude. If you're on your balcony and someone walks by, it will look close. People often have mistaken ideas about how close floors actually are. Your upstairs neighbor is just 3 meters away.

Sure, but let's try this anyway you might say.

1. Can we translate the signal strengths (RSSIs) to a more accurate distance measure? Sure, you can! However, you need multiple packets and this will influence the number of both false positives and false negatives again!
2. Can we not get help with this from the device manufacturers? Yes, they know how their chips are designed, they can give additional info on e.g. BLE channels, etc. However, practice has learned that their role is often just the opposite. Here's e.g. a list of Android phone vendors who kill apps in the background. That's the reality you'll have to deal with it.

Should we want central processing?

The Apple/Google approach is centralized. There are authorities that are responsible for putting the "infected" keys in the database. If you wouldn't do this, you'll run the risk that an adversary can put their key in the database. Note that the keys on the phone and the ones communicated with a central entity can be different as long as they can be locally mapped. This is also recommended by D3-PT (ephemeral IDs versus daily keys). Likely the app that warns the health authorities is the same app that does the tracking. This will void the measures taken to ensure anonymity.

Can we expect this to work?

There are many non-technical aspects on this that have to do with human behavior.

• Not all elderly have smartphones. They're the ones most at risk.
• A lot of people have the habit to turn off Bluetooth.
• To have law enforcement check if you use a BLE tracing app is an invasion of privacy ("Sir, unlock your phone, please!").
• There are many initiatives that want to do BLE contact tracing. You'll have to compete with many other apps.
• It's expensive to "lure" people into your particular app.

Do we need tracing?

For the purpose of preventing the intensive care units to be overwhelmed you need to predict the number of future COVID-19 sufferers. For this you need general tests across the population. Do not only people who have symptoms. There's a delay between infection and need for IC, hence you'll have time to do epidemiological control. Measure the current situation! If you don't do that, why bother tracing!

If we want more fine-grained epidemiological control, we might want to have data about schools, daycare, churches, the workplace. Is indeed contact tracing truly the right way to go?

Even if we remove the privacy restriction of above and give data about "general statistics" to epidemiologists, would they benefit from knowing that there are X infected key "hits" per day for an average teacher versus Y infection key "hits" per day for a construction worker? Don't they have other data sources to estimate those risks?

Can we do something else?

Yes, you can be pro-privacy and anti-SARS-CoV-2. There are for example self-reporting websites that you can use to upload symptoms. Can we create something similar for "who do you have to contact?" when you get symptoms?

Let's say in two, three months people will start to have business meetings again, go to family, friends, etc. What about a quick information exchange before the meeting? It can even use Bluetooth if that's so necessary... Everybody checked in? Go! When someone gets symptoms they can choose to easily inform their friends, family, and business contacts. Voluntarily, totally up to them! Yes, it's like calling them... Just faster.

What does this mean?

I've excluded check-ins in public transport, restaurants, schools, etc. If you include those, then you'll have to ensure that you've no rogue actors (pretending to be infected) and you're back to square one (centralized control).

What does this mean for you? It means that if you use public transport, or if you go to a restaurant you run the risk of getting infected. However,

contact tracing does not make a difference!

You'll either be infected or not. Contact tracing is wisdom in hindsight. Its epidemiological worth is unsupported.

Is this not imperfect?

"Yes, but this will not be perfect! There can be a lot of strangers that could have potentially infected me! Maybe I should self-quarantine!" Sure, but

tracing through Bluetooth sucks too!

It only provides a false assurance of being accurate because it is automated.