ZKPodcast: DP-3T & Contact Tracing with Kenny Paterson from ETH Zurich

Transcript

[Music] welcome to zero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me Anna and me Fredrik so this week we're chatting with kenny patterson professor of computer science at ETH Zurich and head of the applied cryptography group there welcome to the show Kenny thanks so much for having me it's great to be here for today's episode our plan is to discuss DP 3t which is a proposal for secure and

decentralized privacy preserving proximity tracing now this will be the third episode that we actually addressed this topic if you're interested in finding out more about it you should have a listen to our episode with Claudia Diaz as well as the episode with Henry de Valence from Z cash foundation in both of those we talked about kind of other tracing systems and we mentioned sort of the DP 3t but I'm excited that we get a chance to dig into it today I'm looking forward to talking to you and your listeners about that along with what some other stuff too cool so let's start off I'm curious where you got your start and what led you to working on cryptography in the first place so my background is originally in mathematics so my PhD is in maths from a long time

ago and but I was always interested in how is maths to be applied and so you know as a teenager I had a home computer at home and I laugh at the program and I played a lot of games and I wrote software that could copy tips and all that kind of stuff that you did as a teenager and so I always had this kind of real interest in computer science and one of the places where mathematics meets computer science is cryptography there are other touch points as well including things like communications theory and coding and has worked on those in the past - but cryptography is just is really fascinating intersection point between all these different topics so I spent some time working in industry that he would pack our laboratories between 1996 and 2001 during that time I got interested in Republic even more

strongly through flight projects that I was working on at HP Labs and then when I returned to academia finally in 2001 I decided to jump the fence and make cryptography the main subject of my research particularly focusing on applied cryptography so cryptography is one of those subjects where there's a lot of people who approach it from a very theoretical computer science perspective there's people who are essentially software developers who are using cryptography and are really approaching it from a very pragmatic perspective and I'm somewhere in the middle between these two groups trying to get them to talk to each other and trying to get them to understand each other better that sounds cool that kind of sounds like what you know two parts of our audience we're always trying to bring together as well yeah nice um so you're you're at ETH Zurich currently have you

been there for a long time I was first to ETA Peru between 1993 and 94 Wow it's a one year post-op and I had a great time that year working hard but also enjoying being in Switzerland and the mountains and even the skiing and last year I rejoined ETH Zurich as a professor of computer science I started off there as a postdoc and came back as a full professor which is a slightly different existence I'm one of the great things about ETH Zurich is that the professors there get given the resources to build a group so I've been able to hire outstanding people to what we need these D student support folks and also admin staff to help me run the group so I've been able to build very quickly a

nice booth there cool where were you in between so you sort of said you went back to academia in 2001 where are you studying or what were you doing there so between 2001 and 2009 teen I worked at Royal Holloway University of London okay it is a small College that's part of the Federal University of London and has a very famous information security group so I started off there as a lecturer in 2001 and I remember arriving on day one and being told you're teaching network security and having Solero network security but that turned our actually to be really great for my research because there's a big intersection between cryptography and network protocols and network security IPC TLS all that kind of stuff that your business would be very familiar with so

I ended up working a lot on that intersection and I think that really helped me and with building up the apply side of my research so I worked there from 2001 to 2009 team and then let's say ETH Zurich made me an offer that was hard to turn down and so here I am so I've been now ETH for just over one year I started April the 1st 2019 it's not clear who the April the first job is on what everyone seems sorry for me and I guess we're still finding out oh I'm actually I'm curious cuz like this episode is gonna be primarily about DP 3t but what do you normally work on like what exact space field the focus do you have so my philosophy for for research is I do whatever I find interesting in

the area of applied cryptography and so I work on things like communication security so how do we use cryptography to build secure channels things like TLS for example I did a lot of work on TLS security about five six years ago the had some impact on How Tos Loops today so we basically brought various algorithms in the TLS context sots went through some changes I also work on things like encrypting data at rest encrypted databases so how can we outsource our storage to the cloud for very large databases whilst protecting them from the cloud service provider who maybe we don't fully trust but also being able to do searches over the data and this is an area of surgical encryption and it's also an area called

database encryption and it's it leads to things like fully homomorphic encryption yeah I was about to say this idea of doing something over an encrypted field it's interesting so if we had super efficient fully homomorphic encryption and I would be out of a job because all these problems in Seoul so in some sense is fortunate that we don't and what that means is we come up with solutions to the problem and try to engineer them in such a way that they're efficient and also secure at the same time so fully homomorphic encryption is incredibly general and therefore very very powerful but as a consequence it's very inefficient so we can by limiting the functionality you can put something that's reasonably efficient and secure so it turns out this sort of in the first generation of these schemes they

had certain amounts of leakage that you could classify and we did a lot of work early on understanding the implications of that leakage so we're in this very strange position where we had security for this for these database encryption students the proofs identified exactly what the leakage was but then people were saying well we're done though rather than saying well what are the implications of that leakage from the screen so you did a lot of work that's what you tackled and I guess are you still are you still working on that or is that sort of have you put this aside to work a little bit more on the contact tracing stuff so a lot of a lot of my day-to-day research has grown to a halt as a consequence of dp/dt it's become all-consuming and that's because there's a huge desire to get something done in

time that it can be deployed and tested and evaluated so that we can start to maybe use it as a tool and the thing the current walk times that are in place all over the world I still have to teach so like yesterday morning at 8 a.m. I was teaching applied cryptography I was teaching authenticated encryption to my master students at ETH 3 their brilliant students they asked amazing questions one of them managed to completely stumped me yesterday during the training session and then had to scurry around afterwards and find the answer to the question and then now I don't care what was the question so there's this thing called authenticated encryption which is basically how we do symmetric encryption today it's a combination of

confidentiality and integrity and there's a particular setting called non spaced authenticated encryption the idea here is that we want to relieve software engineers of the problem of handling randomness so all we ask them to do is come up with a fresh number each time they invoke the encryption algorithm and this fresh number is called a nonce short for a number used once we've actually covered that in the context of block headers I believe a lot creation like nonces are in there as well absolutely they are that's correct yeah so in the context of encryption pool and the question is well if you want to model security what do we ask the adversary to do with the nonsense do how much power do we give the adverse with over the nonces and later on I presented

an attack against some nonce based encryption schemes particular AES GCM which is a Nissa standard for authenticated encryption and the students said we'll hang on you said this before about the nonces in a security model and now you're saying this is how you've used the non-citizen in this attack is this a tag in a security model or not and I couldn't answer the question because actually I had missed stated on my earlier slide in the security model exactly what is the nature of the restrictions on the nonce is chosen by the grocery at 8 o'clock in the morning because just a little bit slow off the mark and so to go back to your original question has everything else stopped no and still teaching still designing new courses still interacting with Macaulay's but a lot of

the research claims that I would normally have had is now really focused on PT PT and it's become an enormous lis complex project with many partners internal and external so I hope we'll get into that a little bit later on definitely so I'm thinking we have touched upon this in previous episodes I do think it's worth it to define kind of what contact tracing or proximity tracing is yeah maybe if you want to just say quickly what that what that kind of technique is and how cryptography or any sort of protocol fits into that it would be interesting so one way of understanding this is to start by thinking about what contact tracing is not so when you think about doing contact tracing it's very easy to confuse the activity of contact tracing

but then what happens afterwards once you've identified people who are in contact with each other which is part of the kind of health system so there's like Kenna but there's a boundary that we need to draw align this thing that we're talking about and so as far as the dp/dt project is concerned our focus is really on enabling mobile devices to be used to identify people who have been in contact with other people and then be able to warn those people that they may have been exposed to somebody who has been infected with 19 and in a little bit more detail the idea is that we have mobile phones that almost universal you have some kind of Bluetooth functionality and Bluetooth can be used to send out these very short beacons on

a regular basis and so the idea is if you make the beacon some kind of identity or the mobile phone or the user holding a mobile phone then later you can send and record these these identities and then later when somebody does a test and finds out that they have been infected with code 19 then they can upload all of the recording that they made to a central server and the central server can then say AHA here are all the identities of people you've been in contact with and maybe you've been in contact with them for you know a certain duration because we have a certain number of beacons that we've recorded over a certain amount of time or you've been quite close to those people because we have some kind of signal strength information and so we can now then con

the people or they say that mobile devices of those people and send them an alert saying you may have been exposed please now again in touch with the Health Authority get a test or self isolate and so on now exactly what you do once you have this notification is really part of the health system and that would vary from system to system and country to country and maybe in the United States it might vary from state to state or county depending in Europe of course is going to be country by country what I described there is is a centralized system where the matching and the algorithm is run at a central server and what we wanted to do in dp/dt was be able to move all of that competition to the phones and not share real identity information to the central

server because we wanted to build a system that was had strong privacy guarantees for the users maybe we can actually tell a bit like the journey 2d p3t because I don't think as far as I understand it didn't start with like someone proposing this but rather the formation of groups Apple and Google announcing what they were doing so I'm just kind of curious to hear how we came to a place where there's the D p3t protocol sure so I think now about six weeks ago we started really thinking about this and it really started the EPFL which is a University in Lausanne which is sort of the sister University of ETH Zurich so there's a french-speaking version and a german-speaking version of ETH and it

actually is it Ecole Polytechnique something that I was on but my plan by a French accent it's not really off to seeing that so I was trying to avoid saying it's all Polytechnique fédérale de Lausanne you can so EPFL much like ETH Zurich has a has a big group of people doing security research and pregnancy research and they had actually started a little bit earlier than us thinking about how could we use technology to help with combating Corbett 19 there have been lots of discussions in on Twitter and other places about you know food bluetooth technology be used but the people a pfl started on a design and then they decided that actually they wanted to get some more help and they knew we all know

each other extremely well so as a small country and actually I researched it's also quite small small so everybody knows everybody and they reached out to us and a couple of people at each series so myself professor surgeon cap Cohen who's a specialist in physical layer communication security which is really ideal for this blue to stuff man another professor are called the professor David Basin who specializes in formal verification of protocols so we all decided to jump in and help and at that time there were a number of different designs floating around with different security properties in different privacy properties and so our first task really was to look at the design space and figure out what are the privacy properties you can achieve what can you

achieve cheaply in terms of competition in bandwidth and what can you achieve cheaply in terms of implementation so there's all kinds of amazing cryptographic techniques that you could throw at this problem you could use multi-party computation you could use your knowledge proofs you could use private set intersections all of these things but all of these things are wonderful but they are not exactly immediately ready for deployment and so we decided to K ISS keep it simple stupid and build a system is really as simple as possible that developers can build very very quickly using crypto that's already quite battle-tested battle-tested exactly so stuff that's widely available in standard fertilizers that developers are used to using so in

in dp/dt in the end we just use h mac based on sha-256 and a es in counter mode that's it dead simple simple as possible that makes it easy to implement it also makes it relatively easy for analyze so we had kicked around a lot of different designs and at the same time there was an organization called pet PT which is a pan-european attempt to develop Coby 19 contact tracing apps and we have been working with them and looking at solutions that they were also examining and giving them feedback on on those approaches and also suggesting this comparative analysis and in the end we came up with this DP PT protocol which we thought was a good trade-off

between privacy functionality and usability and we were we were promoting that within the pet PT project but in the end the PT project decided to not fully adopt the approach that we were suggesting and there are some issues for us around openness and transparency and decision-making the PT was using so in the end couple weeks back now you split off and EP 3t is kind of going its own way and if I quite a lot of success in adoption actually so maybe we'll get into this in more detail later but Switzerland and a couple of other countries have said they will use DP PT and we're in the process now of working with the Swiss health authorities and developers to get an app ready for this reason it's DP 3t and or

a coalition is it the protocol like what does that term mean now that's a great question I am I think it's both of those things so it's both a protocol specification and a reference implementation okay and it's also a project so you know exists on github we are in the process of working out exactly what we are what governance model is and it's one of those things that we know is absolutely essential for the medium term and it's actually very important in terms of openness transparency you know people will be quite right to ask well who funds you how who's paying you to do this do you have money from Apple and Google or you you know whatever and and so we're in the process of working all that but we don't want that to slow down progress on developing developing the

portfolio where does the funding for the research on DP 3t and the implementation where does that come from so I can give you a really clear answer to that question right now we have funding from our home institutions so you know everybody affiliated with the project more or less is working in a university and we're all doing this really just through our normal University day jobs and our senior management in those universities is aware of what we're doing and we have broad support for it we also have a grant from a foundation in Switzerland called the botton our foundation and which is administered through pfl and it's a purely charitable foundation that donates money to health projects and they've been very generous and giving us

funding for the project cool are you familiar also with the TCN coalition the ones sort of existing in the u.s. right now there may be there's a few of them but we've spoken to Henry and he mentioned this TCN coalition right so there's a TCN coalition which is actually an agglomeration of a number of different projects in the US and there are other projects in the u.s. that are not part of the TCN coalition at least two more okay and two of them even have the same acronym pact PA CTF so there's an East Coast pact in a West Coast plan and we're actually in contact with all of these different initiatives at the same time there's been discussion about could be form some kind of grand coalition to do this can we align all of our objectives and I think it's pretty clear that all of those proposals are

quite well aligned in terms of what privacy they seek to again for the users of the system and they can open this the way that they want to take to the approach on the other hand spending weeks and weeks and weeks negotiating over like exactly how you would be formed into one grand coalition and what the details of the protocol would be will take a lot of effort and it's not clear to us on this side of the Atlantic that we would get a huge amount of benefit over admitting clearly getting some constitutional rooms between different geographies is going to be important but we've kind of got our hands full at the moment trying to service all of the requests that we get in Europe from Switzerland from Austria from Estonia we're all going with ppth and I know Germany - I think interesting

if they're like is it's all open source so if those other organizations wanted to or and you sort of mentioned you're already in contact so you are sharing it sounds like I mean completely sharing whatever you're creating do you feel like is the differences between them just in the subtleties like what like and maybe when we go into some of the details about like the potential attack vectors we can we can understand a little bit better about like where are the differences where do they actually exist yeah I mean the there are differences of course and there are differences both in terms of security and reducing properties and also kind of at the low-level protocol details you know the bite formats and so on but the differences are much smaller than the similarities are between these different

decentralized approaches what's not something we've really emphasized yet but all of these approaches take this decentralized view where you try to do as much as possible on the phones and you use pseudo pseudonymous identity is instead of true identities in the system in an effort to protect the privacy of users so they're all really in the same in the same circle and then there are other approaches which are much more centralized where there's a central server that knows the relationship between true identities and the pseudonyms that you're using and potentially they're not designed this way but they could potentially give me purpose to abuse that capability to do you know my skill tracking for example so there's more that unites us than

separates us in that group of protocols that you mentioned how does the Apple and Google announcement fit into this so they announced that they were kind of enabling something on there like the Bluetooth on an iPhone and the Bluetooth on an Android can now be used for this kind of protocol but what what how exactly do they fit in and what what was their announcement I mean I've read it but I think would be good actually I've read it I can't really exactly say what they're doing I just know that it's open yeah okay that's a great question so when we were developing gptt you ran into this issue that everybody has run into specifically on Apple devices the issue that's specifically on Apple devices if you want to use Bluetooth

beacons then your app has to run in the foreground and your phone has to be switched on okay so that would require people who were going to use the system to like permanently keep the phone on in their pockets and that's bad for battery but it's also bad for security because it means if you lose your phone your phone is probably unlocked and then you know actually picks up the phones in the street can make use of your phone so this is not ideal and it's certainly not going to make the system easy to promote for people to adopt and use in their everyday lives and that's a crucial factor here like we have to build a system that users can use easily that doesn't kill their battery and where they can have pretty high level of trust in the previous insecurity though that are getting from from the app there's a

lot of factors there before you can really get to something like you know 60% or 70% penetration users that you need to make the app useful so there's the thing that's been studies done based on simulation showing that you need that kind of level of penetration before the apps going to give you a useful tool for helping to control thank you so Apple and Google have you come back to that what they did was they for the first time in many years got together and made a joint announcement that they were basically going to support these Bluetooth contact tracing apps by opening up an API that made it easier to use bluetooth on the phone and would allow you to run your app in the background and still use the Bluetooth

beacons at a very high level that's what they're are known speed means however there's a couple of caveats so one of one of the things about their API they've opened up is it more or less forces you to build a decentralized that where all of the computation and matching is done on the phone and some countries that were going for a centralized approaches so UK France and Germany at that time obviously what caused problems by this and I think it's well known from the press that they were then let's say in discussions with Apple and Google trying to persuade them to change what they were doing to support a centralized approach but actually last week on Friday Apple and Google doubled down they had a big press conference where they said no

we're sticking with this approach and what's more we're making even more private so we're changing the API in slightly different ways to respond to feedback from the research community and now for example in the initial announcement there would be a kind of a power device root key from which all of the ephemeral identities would be generated and now that has been removed and now there's like a daily key instead this is actually an improvement in the security properties device so the Google Apple approach is actually really really important for the whole space because it makes it much easier to develop apps and in essence it restricts you to if you want to make use of their API restricts you to using a decentralized approach which we and DP cutie is think you think

is better for privacy hmm I mean I later on in this episode I want to talk a little bit about like what what we're looking at post quarantine how some of these technologies could have impact this is really helpful actually to understand a little better about how like what exactly Apple and Google have done what you're saying is they've provided almost like a new API like a separate API from what they usually have but only for decentralized tech that is privacy me they also verify like are they still is there a way that there are curating what can actually be built here or are they actually saying anyone can build anything they have not given through details on this but what we expect is that they will control which apps can go

on the App Store's names if you guys so they would be able to do some vetting of apps and I'm guessing that they will work closely with national health authorities to check these apps and the issue that they comply and then perhaps pork other apps that may try to use these issue eyes at the same time in the first phase what I really destroyed so far as the first phase of Google and Apple but in the longer term what they're proposing to do is to build more of this functionality directly into the operating system well no they will not as far as we know they will not go as far as building apps themselves but they will make it let's say substantially easier to use so you'll have you'll need to have less and less knowledge of of bullet to the internals in order to make use of this

technology so this is in a second phase the exact date that that will become available is not clear but the first phase and it's going to be available from mid-may onwards and already the API is available as a public specification so it's possible to start developing against that étoile what again that's exactly what we're doing pppt i guess it's also possible for researchers to start evaluating it and this is where some of the feedback came in absolutely yes and I think it's fairly public knowledge that we and dp/dt and other groups were talking to Apple and Google before their announcement and explaining to them how dp/dt words and other systems worked and what we would like to see in the API we were delighted when it came out because they're very much

matched Mobe needs to build something like DB 30 and that conversation has continued at the same time I assume that governments that want to pull with centralized approaches have also been talking with Apple and Google but as far as we can see publicly that's not being successful and this is extremely interesting because after Google and Apple in some sense double phone Weiss Brady ion going with the decentralized approach it was on Saturday morning that Germany announced that they were changing their tag for all my previous announcement about doing something probably centralized and switching to a fully decentralized approach and I think we have reasonable expectation that they

will go with the EPT as their based protocol so there was a major consequence of Google and Apple saying this is how we would like to do it on our devices is that Germany changed tack so you know one of the major European countries said okay you know we understand we see what the limitations are our plan to do things in a centralized way that this is going to be difficult to make work we want to get something out to our users to our population say we're going to switch actually I think that's a really great decision and it takes a lot of political cojones to make a switch like that a lot of people's careers are you know writing on these things politicians generally are if they make mistakes then they have to resign but and here that's not

happening Germany has managed to effect this change of direction without resignation is left by a center and I see that as a really positive thing nice so before we dive deeper into DP 3t I had one last question about kind of adoption and sort of other solutions out there we heard early on I mean I at least I heard about some early contact tracing in South Korea I understand there were some in Singapore as well like what what were they using what are they using to do that so in both Singapore and Korea they were using Bluetooth proximity I think in Korea they were also using GPS information from the phone okay or possibly cell tower information which gives you rough location information the broad view in Europe and North America

seems to be the using location information in addition to Bluetooth proximity is to privacy invasive and most of the solutions I'm aware of have moved away from that and Singapore was using bluetooth only and not using geolocation information or GPS information but was a centralized approach which meant that at the central server the server knew the relationship between the true identities and the pseudonyms and so potentially could unmask that information and thereby build what we call the social contact graph which is basically when an effective user 4:7 says okay here's all the ephemeral IDs I've seen her all the pseudonyms I've seen the starter would then be capable of saying ah so these are all

the people you've been in contact with over the last two weeks so whatever the length of the transcript is and that's something that we consider I mean I can see that that's epidemiologically potentially useful but there's something that we consider in DBT TV too much information and to privacy invasives so you know for all of the people who are reported as infected you can get a pretty much complete picture of through the people talking to you over the last two days that's a lot more than you would ever get from a manual contact tracing system and what we're supposed to be doing here is complimenting manual contact tracing the old school where you ask somebody so who did you have the nura with last week and from which you can't figure out see who used to think this ID on the bus because that's just

not somebody you know yeah so we're trying to complement that without doing like a massive kind of privacy invasive data overreach so the Singapore system was doing that kind of centralized approach unfortunately uptake in the population is quite low maybe something like fifteen percent of the Singapore population started using the app okay and so the diagnostic value of it probably is not that whole wasn't as high and so that was at the same time though it was an optional app so that's interesting like that's true that it was optional and what I kind of don't understand about that is like if Apple and Google just opened up these api's what were they using for any sort of Bluetooth stuff before then I know you

mentioned there was GPS as well but yeah so in Singapore they were using bluetooth again but they didn't have access to the nice Apple Google API so they had to basically hack it for themselves oh wow and that meant significant issues on on iOS on Apple devices in Android the API is alright or are already a little bit more relaxed and so they were able to use ones quite effectively but there are severe issues in using iOS one way you can do it is to establish Bluetooth connections instead of just sending out Bluetooth beacons that's even more battery hungry and is also difficult to do in noisy Bluetooth environments when you have a lot of devices in close proximity everything's trying to establish Bluetooth

connections everything else and then it just doesn't work everything just interferes with everything I think we've all experienced that with Bluetooth right it's not the most stable of technologies I use bluetooth or home to try to connect my phone to my Bluetooth speaker sometimes it works sometimes it doesn't and I really don't understand and it drives me a bit crazy so this is why the Google and Apple API is are tremendously important in terms of building stable apps that I actually you know I'm gonna work for days and hours and days and weeks at a time so Singapore didn't have the benefit of that and I think the Apple app probably had to be switched on constantly in the pocket well and that again is bad for user adoption so and this this idea

about the app being voluntary as well as very very important in let's say Western democracies or all across Europe everything we've seen so far suggests that governments are not going to demand that their users install this app and use it because I think that almost literally cause revolution right it's just you know this can't happen and there's a lot of language around you know war without war against this virus and so on we're not at war the virus can't read our messages and and and you know fight back against us it might mutate and then we have a problem but we're not actually a war against this thing so we don't need wartime measures at the same time these apps are only going to be successful if the adoption and the optic is spinning up and so then issues about you know trust and ease of

use and so on become very very important and I said that's one of the great things about Switzerland in Switzerland ETH Zurich and EPFL are pretty well regarded by the Swiss population they are the kind of top universities in Switzerland and actually they're amongst the top universities in Europe and generally speaking in Switzerland people trust scientists and they trust the health authorities and there's a really good relationship between and these universities and the population at large so I think in Switzerland we have a pretty good chance of getting videotaped for this aha I actually had a really nice water taps exchange last night with a friend of mine who she has a background in tech but she's not really directly in the field and she said oh I saw this great

article about this app that you're building it's whistlin and she said I think it's so great that you guys are you guys are doing it and I said yeah well it'll only work if everybody trusts us and she said I trust you you will make this work and I think that okay that's one data point right it's not scientific to extrapolate from there but let's do it anyway I think that's reflective of a general situation in Switzerland and I hope that in other countries we can build that kind of trust - and that's not technical trust it's a different kind of classified so there's sort of this idea that it's it's a less confrontational approach to users maybe that would mean that there's more collaboration and that potentially the creators of this or the implementers this will be listening a lot more to the average person it's

almost more like taking care of people rather than trying to figure out this is something I said before trying to figure out like what people are thinking what horrible things are in their minds it's much more like how do we how do we help out that makes perfect sense and I think there's a tremendous amount of goodwill around about installing and using these ass CDs Vox Pop interviews on TV and on video and people generally are trying to do the right thing for example in the UK by a month ago the government put a call for volunteers to come and help delivering medicines and taking people to hospital and so on and they expected to have a few thousand volunteers and they were completely overwhelmed but I think they had seven hundred and fifty

thousand people Wow one of those people are now sitting around wondering what they're supposed to be doing to help and I think that's an issue to this trust then the speed will can be squandered if you don't do it right if you don't do it in an open way so for example right now in the UK is it's a very interesting situation where there's an app has been announced an organization called NHS X is building it NHS is National Health Service X is X who knows I guess it means like extreme more exciting or undefined and they haven't really released any technical specifications there's no code and it's not clear whether it's centralized or decentralized or pink one can infer from public statements that it's probably

centralized and we really feel like in our community we like to do things as open as possible because that enables you to shine a light on the dark corners and see where the flaws are and eliminate them and find bugs and in the UK that's simply not happening at the moment the NHS X experts have said maybe that's why X stands for experts they've said that they will open the roofing up eventually but it may be too late and maybe that the app is already being deployed before they actually make it open and so there's a lot of concern in my research community privacy security cryptography around making sure that we are able to hold governments to account when they

deploy these apps because yes there's a lot of goodwill out there but that goodwill can evaporate quickly if people don't feel that they can trust the apps if you feel like their purpose is being invaded or if they feel like this is a system that's being built for one purpose but it might eventually get repurposed and turned into something else totally that sounds like that's what that's the fear that kind of crosses my mind when you say stuff like that I think this actually leads us nicely to another point or actually this is sort of like digging a little bit more into the protocol itself I wanted to cover some of the risks of Bluetooth enabled proximity tracing we can walk through sort of the different categories of attacks and how D p3t tries to mitigate some of these there seems to be

sort of three main categories of risks and one has to do with the identity of the individual one has to do with the behavior kind of after information is given to the to the individual so their behavior and the last one is sort of risks to the entire system yeah and so let's start in with this risk to sort of the identity the data on the personal front there are fundamental risks to all of these systems that they all share and then there are specific risks that different architectures bring with them so one thing that all systems share and actually a lot of people engaged in this debate there's a sort of debate raging amongst the academic community on Twitter and different

places a lot of people forget in this debate that these systems always give you one bit of information that you were in proximity to somebody who is infected okay so there's always one bit at least one bit of leakage no matter what system you go and with that single bit of leakage you can do attacks against all systems no matter what the system is and I think this is really fundamental fact that particularly proponents of centralized systems who criticize certain aspects of the decentralized systems tend to forget or maybe don't understand right it's a little bit subtle so there's a fundamental leakage in all of these systems what it means is for example suppose I register I don't know 100

different identities in the system maybe I can do that right depending on how the registration process works I know what I can do is I can switch between those different identities of different enemies and then later if I find out that Oh identity 27 was notified that's how they've been exposed I can look back in my own blog and say well I was using identity 27 on Monday afternoon at 3 o'clock and at that point I was talking to Anna from the zero knowledge podcast so she's in fact yes okay sorry yeah you could pretend the room yeah yeah sure and so she must be the one who infected me and that's that's a fundamental threat for every system no matter how it's bill now of course the

realizability the extent to which you can make that threat real depends on the registration process how quickly you can switch identities in the extreme version you just register one identity and then you only use the app while you're talking to that one person and then you can find out whether that person infected you or not but so that's like that the minimalist version which doesn't abused any registration properties of any of the foot-post there's one avoid of injured Sanders yeah so if you want to do is contact tracing using Bluetooth you have to accept the paths or risk of the system the ability to potentially identify someone else who test positive yes and be able to kind of pinpoint or point a finger at them and say ah you're the one

who infected you mm-hmm and now why is that important well in maybe in manual contact tracing systems you can interview somebody and find out who they were in contact with and then you can go off and interview the people that they identify as contacts without naming the person that they were in contact with and then you can you can get them to take a test and then maybe it has positive you can then notify them you know and then do contact tracing on them and you can snowball it for more and so that's sort of different right because you can preserve the anonymity of the person who was responsible for the infection in a manual contact facial system it's easier more easy to do whereas in all of these kind of automated systems that's much harder to

do got it so that's the first one it's this idea of potentially identifying you mentioned kind of two strategies that somebody could use to do it are there are mitigations to that though like so you sort of mentioned the multi obviously the multi account is a multi identity that's something that's relatively easy to tackle but yeah what what what are the mitigations absolutely so that that attack is easy to tackle in a system where you do strong authentication during registration but that's actually runs against the anonymity properties that you might write because what that means is you're somehow recording a real identity and make or a real phone number and making sure that each phone is only registered once

there are ways you can mitigate that for example you can make a separation between the registration process and then the running of the system and make sure the registration process enforces that each phone safe is only registered once but that's actually not easy to do and it's not it's not easy to do in such a way that you can really demonstrate the separation between the two parts of the system the registration and then the running of the system so it's actually quite hard to do you can do things like you can make foreign solve puzzles you know catch buzz or you know Bitcoin mining on your phone or something and that would maybe limit the number of times that you could register a given device and so there are things you can do to slow down the registration process or to make it harder to to register

multiple multiple times with the same device but in the end the single device single bit attack still applies and is unavoidable another threat that's all systems are subject to which is basically we're using bluetooth and no Bluetooth is a wireless communications technology and it can be abused in various ways so for example I could record your pseudonyms and then I could relay them to a remote location and broadcast those pseudonyms locally in that remote location so I could make you look as if you're somewhere else and I could do that very high power I could use a big Bluetooth broadcast device I'll get baby a dish and I could fill a train station with your signal I think we mentioned

one example of this where like if there's Bluetooth enabled devices like I think Henry mentioned sort of the garbage cans in London I mean chips in them so potentially like subjet like if you infect those you could spread this falsely much wider than it actually would be exactly yeah I was also sort of you know dustbins also represent another issue which is they represent the ability to listen to these Bluetooth beacons in a large number of places at once so maybe you can build kind of like a network of listening stations now for systems that are decentralized and anonymous you don't actually maybe you learn less from that

than from systems that are centralized so let me try to very briefly explain why suppose you have a look at a network of Bluetooth monitoring stations like dishes that are just spread around the city then you can Hoover up you can gather up all of the all the pseudonyms that are being cast by all the devices and if you know in the background because you have a centralized system the relationship between those pseudonyms and the true identities and then you take the two information sets and put them together then you have a mass surveillance system now you can correlate in time and space real users and where they are and I think this is one for me is one of the big risks of the centralized systems is

that unless you have a mechanism for switching them off after the current crisis is done they can be repurposed and they can be repurposed without that much effort another thing that we learnt as well and this is going to sound a little bit like paranoia but we learned from Snowden and the Snowden revelations in 2013 the government's absolutely specialized in breaking into these systems and stealing their secrets so what's to stop an NSA or a GCHQ in the UK or the French equivalent from actually hacking into the health system stealing the keys that give you the relationship between true identities and ephemeral identities and then harvesting all this data from a network of Bluetooth stations and now

knowing at all times where all the population are and to me that's a really scary possibility and for me it's one of the main reasons why I and other people in computing have been pushing very hard against these centralized solutions it they do bring intrinsic Krita SiriusXM that I think are worse than the decentralized systems but they also have this ability to be repurposed and that's really what scares me what what do you do then with the protocol to mitigate against that in DP 3t all of the relationships between true identities and pseudonyms are only held on individual forms okay okay and so when it comes a point when a user is

infected they can upload a key that reveals that relationships are central serve them and then that central server can push that key out of the entire network also know people locally can make that connection but only the relationship not the identity I guess exactly and also then this there's no central server that has the ability to do this on its own there's no ability to link a mass collection of harvested data from like a network of Bluetooth speaker Bluetooth recorders two keys from a centralized database so there's a there's a distinct difference in how the two systems can be transformed into into a mass surveillance now and I know that for some listeners that's gonna sound

completely paranoid and completely crazy but these days post Snowden I don't take any of those possibilities off of the table we have learned much too much about the intent and the capabilities of national security agencies so one other kind of attack or a risk that's mentioned in the report that I'll be sharing in the show notes that we're kind of following here is this idea of revealing app usage what could that actually do in terms of data like how is that a risk that's a great question so the basic idea here is that depending on the user status whether they are exposed to another user who has been infected or with whether they themselves have been

affected the will behave in a different way and that behavior might be observable by an attacker on the network for example so for example if you are tested positive and then you're asked to upload all of your logs of which ephemeral IDs you've seen for the last two weeks then suddenly your app is going to upload a lot of data now of course that uploads going to happen over TLS it's all going to be properly cryptographic protected but just by looking at the amount of data being uploaded or downloaded you might be able to infer something about the status of the owner of the app and these are the kinds of attacks that we're very familiar with from things like traffic analysis of network traffic for example does DP Treaty do anything to prevent that

not right now and we regard those risks as something that we are willing to accept and we are not really trying to protect against Network adversary's that do traffic analysis although we certainly want to protect the confidentiality and the integrity of the data uploaded content with it but do you think eventually this could be something you do build in or is that more just like very low priority unfortunately it remains a fairly low priority for Larry because we have so much other work to do there are well understood mechanisms for providing protections against those kinds of attacks for example traffic padding I'm but typically they cost something like you end up uploading and downloading

more data or you have to uploaded on the phone or data all the time and so they're not really that practical in on mobile phone networks where and you know you want to minimize the amount of data usage you want to kill people's data clients might be hiding other things that are not so what's that got it okay so let's go on to the next sort of overarching category of risk which is basically something it's sort of behavior affecting actions that would be malicious so an example of this would be like a false alarm like basically sending out across the network that a number of people are infected around you when they aren't or there is an infected person near you and that message is not sent to you or it's not captured

correctly yeah exactly and these are again or risks that a research system faces so you know you can have attacks where you come infected you know what your pseudonyms are going to be that are going to be broadcast in the system and what you do is you relay those to lots of points different points in space and then broadcast them all of these different localities and so now you have a user an infected user who appears to be in multiple places at the same time but depending on the anonymity levels that you get then this can this can lead to you know lots of people being falsely identified as having been exposed to get lots of false positives in the system so another related risk is that somebody

armed with a powerful Bluetooth device should stand out jamming signals and block signals from reaching phones and so you can disrupt the operation of the entire system quite easily and then you would end up essentially not notifying people later who should be notified that they may have been exposed and again this is completely endemic to all of these kinds of systems impossible to prevent and so maybe it's worth reiterating something that these systems are not intended to be used in a standalone manner they would be a complement to traditional manual contact tracing and another source of information the epidemiologists can use to get a handle on the situation we've

covered nineteen so we have to be very careful always to remind ourselves that technologies that the technology here does not have all of the answers epidemiologists and you know health professionals have been doing this kind of thing for years and we need to help them and not think that we can replace them the technology got it is there anything else that you had to think about in the creation of this to avoid any external malicious actor from potentially like hacking the entire system or like yeah breaking it absolutely so we tried to take a broad view of all the threats against our system dp/dt but also the general class of these kinds of systems and our

analysis document tries to be comprehensive in covering all of that territory and actually maybe you know I'd really love it if your listeners were actually able to read our document and then if we see something that they think we've missed then they should let us know and we have github and you can just file an issue there and one of the team will look at what you've written and say ah that's something new we didn't anticipate that or yeah we've already thought of that please see section 6.2 of our document so there are these kind of broad attack vectors against all such systems for example dos all these systems have some kind of back-end infrastructure which is trusted to a greater or lesser extent depending on whether you're building a centralized or

decentralized system and you know it's always possible for someone to dial up a boat form and then just start sending large amounts of traffic against your server yeah in DP 3t and because we actually also need to distribute quite a lot of information to mobile devices we're going to be working in the real world deployment so DP DT with cloud service providers and CDNs content distribution network providers to make sure that we have that kind of DDoS protection and that we have the capacity that we need to distribute the information and also to receive the uploads and it's you know we do live in a world as I said before where people for all kinds of reasons want to do

malicious things just because they can or because they really think the approaches is the wrong way or whatever reason and we try to design against that that's hard to eliminate all of the risks here so let's talk about the kind of that philosophical risk that we touched on a couple times throughout the episode but this is this idea that like what we're doing right now and the systems that are being rolled out could potentially be repurposed reused post quarantine to really turn every country or to turn some countries into surveillance States where they weren't before so I'm curious I mean I think this is a question that everybody can weigh in on and everyone has feelings

about thoughts about concerns about but I'm curious like since you're working right now on that on that baseline protocol how do you feel about it what are you thinking yeah this is something that actually gives me sleepless nights and my dreams are filled with kovat 19 flying around my bed and light shining in through the window which are like you know Bluetooth beacons all kinds of weird stuff entering my dreams and I think that's really a reflection of the great responsibility that I feel and I think all the people in the DPT teaching skill and indeed all the other projects is that there's a fundamental question should we build these systems at all because they run the risk of taking us one step down the road towards this kind

of Bluetooth everywhere you know you walk into a shop and some device starts recording your Bluetooth beacons and maybe it gets hard to switch off your beacons again maybe you can have your mobile phone switched on without it transmitting these beacons at some point in the future we've had some pretty strong assurances from Apple and Google about this technology and how they plan to disable it after the current pandemic but of course the capability will be there still in the phone's deeply in the operating systems maybe it can be reanimated by malicious actors at some point in the future maybe if you can have malware running on your phone then it can be provoked into sending out these Bluetooth beacons so this is a really difficult issue it's something

we've discussed a wall internally in the tttt team our slack is full of discussions about these kinds of issues and in the end I'll give you my personal view we a dp/dt are building a system that minimizes the privacy impact as much as possible recognizing that the alternatives are much worse so if we didn't do DP 3 T countries would be deploying centralized systems right now and actually we feel that those would be much worse than the decentralized system and the DPP T represents and that other projects are also trying to go damage in that CCM coalition and so for me what I'm trying to do here is create the least worst

option when none of the options are actually backed away I feel like we've kind of talked a little bit about the worst case scenario where these things are rolled out and then are converted and just like the scariest type of tracking tools possible and we and and the it's Pandora's Box and it's out and there's no way to put it back in but what's the best case like what's a better future like what would be an ideal role deployment implementation and then kind of roll back or or not I don't know maybe there's a different yard way so in an ideal world and I'm hopeful that this might happen particularly in Europe I'm less competent about the US because they're the health care system just

seems so fragmented and there also seems to be a lot of dysfunction at the top federal levels and being able to deploy such systems but in in in other countries you would hope that we would build systems that we can explain clearly we make cartoons 4d p3t for example to try to help general population understand what this technology is we hope then that there's there's a technology there that people can adopt safely and trust that we'll get very large-scale adoption that because of the cooperation of Apple and Google will get a system that's actually workable and doesn't kill people's batteries and gives useful information but we will be able to work hand-in-hand with epidemiologists and understand

their requirements but also be able to explain to them that this is not a data fest but this is not an excuse for them to get their hands on ever larger amounts of data because of the public trust requirements that we need to be able to explain to the public that they're giving up a certain amount of privacy but the minimum amount of privacy is consistent with the function of the system and so if we get all of that and the system actually works and we can iron out all the issues with Bluetooth interference and ranging and so on then we get a tool as epidemiologically extremely useful and makes it possible to do kinds of contact tracing that manually are almost impossible so the old on the bus or on the train on public transport scenario

where it's impossible to trace the contacts of the guy who is sitting behind you on the bus the other day because you have no idea who he is and you can't identify a specific person a specific phone and you can't track down those people but with this kind of system potentially you could notify them that they might have been exposed and encourage them to get in touch and get tested so that would be my ideal scenario and then in maybe maybe a year from now or 18 months from now I think there's a great chance that we will have a vaccine and the at-risk groups and health workers first of all can be vaccinated and then we can go over out to the population as a whole

and then we switch the system off and actually this is a design goal of dp/dt is to build a system that can be gracefully dismantled at the end of the crisis we will again maybe need such systems again in the future and so we want to be able to mothball to our project and make sure that the the knowledge that we gained from the current crisis can be dusted off and reused but we don't have to start from scratch again but I really don't want to live in a world where everybody is surveyed by Bluetooth all the time yeah it's it's interesting like that idea of how wonderful the data like even even very private the epic how do you say it epidemiology let me try to pronounce

this it's it's weird when you think of like the richness of the epidemiological like I said it right there data that you would actually be getting I mean it's super tempting then to suggest like well what if you started tracking other things like yeah water quality or you know maybe way less widespread but regional viruses or bacteria some some other medical thing I mean these are life-saving tools potentially and so there's a there's a strong impetus to you keep using them I imagine yeah and I think this is a huge moral dilemma for our time and it's not that different from the kind of dilemma of it's a

nuclear scientists face when they were working on you know the Manhattan Project they're inventing this technology that can be used to generate huge amounts of energy in either a controlled fashion or an uncontrolled fashion yeah and as you refer to as opening Pandora's box I think that's a great analogy the only thing left in Pandora's box after all of the diseases and the ills of the world before now it was hope what was left in the box I'm not confident in the hope enough is these days and so I think it's was really good about VP 3t as well as that and other projects is that we're engaged in this debate and we're gonna stay in that debate for as long as it takes and we're gonna keep pushing back on on governments and epidemiologists

you quite naturally would like to get their hands on as much data as possible and have to keep patiently explaining no we're sorry you know Jim we can't we can't do that and the Pirates Space Odyssey yeah so it's a really difficult thing and but I think what's really nice these days is that our community of privacy and security researchers is engaged in that way I mean you mentioned that you interviewed probably ideas the other week yeah she's one of the most prominent researchers in Europe dealing with these issues and really it's a central part of her research and there are many other researchers in the same kind of camp to question these things and to try to pull governments to offense and so I'm confident that with a strong research community and a constant

awareness we can counter the drift into you know a mass surveillance state cool well I think that's a nice point to wrap up the interview thank you so much for joining me on the podcast it's been great to be here thanks a lot for having me and I hope some of it made sense for sure and thanks for sharing with the audience a little bit more about contact tracing dp3 T which I still stumble over a little bit I've said it a billion times in this interview but yeah and thanks for for sharing all of this and your thoughts for what the future could hold like what are you so thanks a lot and to our listeners thanks for listening [Music]