RAPID: An Organizational Scale Approach to Privacy-Enabled Contact Tracing in COVID-19

Contact tracing has emerged as a key mitigation strategy to prevent the spread of pandemics such as COVID-19. Recently, several efforts have been initiated to track individuals, their movements, and interactions using technologies such as Bluetooth beacons, cellular data records, and smartphone applications. Such solutions can be intrusive, potentially violate individual privacy rights and are often subject to regulations that mandate the need for opt-in policies to gather and use personal information which, as several studies have shown, limits their adoption. This project takes a novel approach to empower organizations to mitigate spread of COVID-19 at their premises by exploiting connection events between mobile devices carried by individuals and the Wi-Fi infrastructure. There are several advantages of the planned approach. First, it takes an organizational perspective and is intended to help organizations, small and large, keep employees safe and ensure safety on their premises by exploiting network data (already being generated by their network infrastructures). Second, it is decentralized, i.e., instead of empowering/trusting a small number of organizations such as mobile OS companies, it empowers organizations to assume joint responsibility to implement safety measures at their premises. Third, it offers a fully privacy-preserving solution based on computationally and informationally secure cryptography with strong security properties guaranteeing privacy of individuals, including those who might be exposed or carriers. This will prevent misuse of the data collected by any entity against the will of the individuals. Fourth, it is based on connectivity events already generated by existing Wi-Fi infrastructure and does not require users of the network to either download any application and/or give explicit permissions (which is known to limit adoption). Finally, it offers a path to implement technology not just for contact tracing but empowers organizations with awareness about effectiveness of their policies/strategies such as social distancing, disinfecting/cleaning schedules, etc.

The planned approach is built upon several innovations including (a) new algorithms for cleaning noisy Wi-Fi connectivity data to develop models of occupancy, (b) new cryptographic solutions to implement privacy-preserving data analytics and queries over encrypted Wi-Fi connectivity data (collected from mobile devices), to generate a range of information -- e.g., level of adherence to social distancing policies, flow of people in spaces, and exposure hotspots, (c) design of a range of COVID-19 relevant applications that help organizations ensure safety of individuals on their premises. Such applications include publicly accessible organizational portals/dashboards and subscription-based alerting technologies developed in concert with stakeholder (e.g., UCI campus administration). Deployment and testing of the solution will be done at campus scale, particularly focusing on how the technology can empower the university leadership to determine strategies for reopening research labs while maintaining health and safety of all involved and follow the applicable mandates of the public health authorities. It is expected that the project will serve as a vehicle to inform and educate both individuals and scientists about virus transmission and spread and will contribute to the development of processes and actions at the organizational level to mitigate spread of COVID-19.

This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.