Covid Notions: Towards Formal Definitions – and Documented Understanding – of Privacy Goals and Claimed Protection in Proximity-Tracing Services Christiane Kuhn∗, Martin Becky, Thorsten Strufe∗z ∗ KIT Karlsruhe, fchristiane.kuhn,
[email protected] y Huawei,
[email protected] z Centre for Tactile Internet / TU Dresden April 17, 2020 Abstract—The recent SARS-CoV-2 pandemic gave rise to they are at risk, if they have been in proximity with another management approaches using mobile apps for contact tracing. individual that later tested positive for the disease), their The corresponding apps track individuals and their interactions, architecture (most protocols assume a server to participate in to facilitate alerting users of potential infections well before they become infectious themselves. Na¨ıve implementation obviously the service provision, c.f. PEPP-PT, [1], [2], [8]), and broadly jeopardizes the privacy of health conditions, location, activities, the fact that they assume some adversaries to aim at extracting and social interaction of its users. A number of protocol designs personal information from the service (sometimes also trolls for colocation tracking have already been developed, most of who could abuse, or try to sabotage the service or its users3). which claim to function in a privacy preserving manner. How- Most, if not all published proposals claim privacy, ever, despite claims such as “GDPR compliance”, “anonymity”, “pseudonymity” or other forms of “privacy”, the authors of these anonymity, or compliance with some data protection regu- designs usually neglect to precisely define what they (aim to) lations. However, none, to the best of our knowledge, has protect. actually formally defined threats, trust assumptions and ad- We make a first step towards formally defining the privacy versaries, or concrete protection goals.