PanCast

Listening to Bluetooth Beacons for Epidemic Risk Mitigation

About

PanCast has been designed by a Max Planck working group created in early April 2020, which assembles expertise from institutes in Intelligent Systems, Security and Privacy, and Software Systems. PanCast is part of a larger initiative from the Max Planck Society to bring together diverse fields in tackling COVID-19. We have published a white paper with a detailed description of PanCast hoping to contribute to the development of digital contact tracing systems that assist and benefit from manual contact tracing and provide valuable information to epidemiologists and local authorities.

The crisis caused by the current pandemic is a global one, triggering a spirit of open exchange of ideas, and there are a number of related technological efforts. While we have tried to cite all these related efforts, we appreciate suggestions for further references as well as constructive feedback and comments.

Summary

During the ongoing COVID-19 pandemic, efforts have been made to develop and deploy smartphone apps to expedite contact tracing and risk notification. Most of these apps track pairwise encounters between individuals via Bluetooth and then use the tracked encounters to identify and notify those who might have been in proximity of contagious individuals. Unfortunately, the effectiveness of these apps for contact tracing has been limited, partly due to low adoption rates, a difficult tradeoff between utility and privacy, and COVID-19’s overdispersion, i.e., most infected individuals do not infect anybody else but a few superspreaders infect many.

PanCast is a system for epidemic risk assessment and notification that scales gracefully with adoption rates, utilizes location and environmental information to increase utility without tracking its users, and can be used to identify superspreading events.

In PanCast, , Bluetooth beacons placed in strategic locations continuously broadcast ephemeral IDs that change over time. A subset of these beacons, called network beacons, also broadcast risk information (associated with times when individuals who tested positive were near specific beacons). Users carry inexpensive, zero-maintenance, small dongles in the form of cards or keyfobs that listen to these beacon broadcasts passively (without transmitting anything), store beacon ephemeral IDs in local memory and, when in proximity of a network beacon, compare these stored IDs with the broadcast risk information. When an individual tests positive for the infectious disease, they can optionally disclose (a selected part of) the list of ephemeral IDs stored in their dongle, which becomes part of the global risk information. This means that the information about which locations were dangerous at which times gets included in the broadcast risk messages. By design, a user learns their risk of contagion due to proximity to diagnosed individuals but does not learn anything about locations visited by other individuals unless the user was in physical proximity at the same time.

PanCast has the following key properties:

• It is useful despite low adoption. PanCast lends itself to incremental deployment naturally by placing beacons in locations where superspreading events are most likely to occur and it can assist and benefit from existing digital contact tracing systems and manual contact tracing.

• It ensures data minimization and prevents tracking of users. A healthy individual can use the system in a purely passive radio mode. Individuals who test positive can optionally and partially disclose the same type of information as in a manual contact tracing interview. Disclosed information is accessible only to individuals at risk and in a privacy-preserving way.

• It can be used to identify superspreading events. Similar to manual contact tracing, PanCast makes use of location and environmental information (in a privacy-preserving way). This is crucial to the identification of superspreading events.

• It is an inclusive system. PanCast enables the participation of technology challenged, economically disadvantaged, and physically challenged individuals, who cannot or do not wish to use smartphones.

• It can be gracefully dismantled. At the end of the pandemic (or at any time), users who only used the system in passive radio mode can reset or destroy their dongles. Risk information uploaded by users who voluntarily decided to disclose their list of stored ephemeral IDs does not contain any identifiable personal data and might be valuable for epidemiological studies.

PanCast in action

FAQs

1. How is PanCast different from DP3T/decentralized tracing systems?
PanCast relies on encounters between simple user dongles and beacons in well-known locations. While not essential, PanCast can also support other types of user devices, including smartphones, thus providing an inclusive system for all types of individuals.

Moreover, when recording users’ encounters with beacons, PanCast can collect rich contextual data including location and environment information. This data is useful in developing insights about the spread of pandemic and policies related to testing, social distancing, and isolation.

2. How is PanCast different from centralized tracing systems?
PanCast does not collect information about users’ encounters with each other. Therefore, unlike existing centralized systems, the central authority in PanCast cannot learn about the social graph.

3. PanCast requires placing beacons all over the place. Can these beacons not be exploited for surveillance?
PanCast beacons are blind and deaf by design — they only transmit but never record any information. Passers by can choose to listen to and record the beacon transmissions in order to avail the PanCast service.

4. PanCast collects location data, isn’t this a major privacy concern?
The location data can provide valuable insights to epidemiologists and health authorities, which can help determine response strategies for a pandemic. Therefore, it is essential to collect location data. Nevertheless, PanCast minimizes the data collection and takes great care to ensure privacy of users. In PanCast, a user’s location data can be known to the backend (only if the user chooses to upload the data) and to other users who were nearby during the same time.

5. What information about users is revealed to the backend/central authorities?
No information is revealed about a user to anyone until the user volunteers to upload their data to the backend. When a user uploads their dongle’s data, the backend learns the user’s diagnosis result, their recent location history, along with any personally identifying information that they shared at the time of registration. Note that patients share this information with health authorities even during manual contact tracing.

6. What information about users is revealed to other users?
Users learn nothing about other users except through risk notifications. Therefore, users cannot learn anything about healthy users in the system.

A user learns about a diagnosed individual’s visit to a location only if they visited the same location around the same time as the diagnosed individual. If the diagnosed individual was the only one around at the time, the user learns the identity of the diagnosed individual. Otherwise, a user does not learn the remaining location history of a diagnosed individual.

7. How much would a dongle cost?
We expect dongles to cost less than 10 EUR each when produced in bulk.

8. Who installs beacons? How many beacons are installed in a region?
We envision beacons will be installed by different organizations independently, such schools, universities, companies, sports facilities, bars, restaurants, and public transport providers. Each organization installs beacons within their own campus or public transport vehicles.

9. What is an ephemeral ID?
An ephemeral identifier or ID is a random string generated by beacons periodically (e.g., once every 15 minutes). Each ephemeral ID is cryptographically generated, which means that a string produced by one beacon could never be generated by another without access to the original beacon’s secret keys. Thus, each ephemeral ID uniquely determines a beacon (location) and time interval. The changing ephemeral IDs ensure that a user cannot learn a place visited by a diagnosed individual without having themselves visited the same place around the same time as the diagnosed individual.

10. How does PanCast complement and benefit from manual contact tracing?
In manual contact tracing, when an individual is positively diagnosed, they are required to share the list of places they visited recently. Patients may not remember all the details of their location and travel history due to illness or stress. With PanCast, a patient’s dongle collects the list of places visited by the owner and, therefore, can aid the patient in recalling their history.

11. If I decide to upload my location history stored in my dongle to the system, can anyone get to know the places I visited?
Location history uploaded by a sick individual is broadcast back as risk notification. A user may learn if a patient visited any of the locations as them at the same time. Location history voluntarily uploaded by a healthy individual is restricted to only epidemiologists and health experts in the backend, and is not shared with the general public.

12. Can a smartphone app be developed to use PanCast?
Beacon transmissions can be recorded by any Bluetooth-enabled device. Thus, even a smartphone-based app can be used to listen to PanCast beacons.

13. But Google and Apple disallow location tracking on phones. How can smartphones be used with PanCast?
In PanCast, a user’s device collects the location information of only beacons and not of the device itself. Therefore, smartphone-based apps are compatible with PanCast.

Publications

• PanCast: Listening to Bluetooth Beacons for Epidemic Risk Mitigation [PDF]
  Gilles Barthe, Roberta De Viti, Peter Druschel, Deepak Garg, Manuel Gomez-Rodriguez, Pierfrancesco Ingo, Matthew Lentz, Aastha Mehta, Bernhard Schölkopf
  White Paper, 2020.
  This paper describes the technical design of Pancast.

  Bibtex

  @misc{barthe2020pancast,
    title={{PanCast: Listening to Bluetooth Beacons for Epidemic Risk Mitigation}},
    author={Gilles Barthe and Roberta De Viti and Peter Druschel and
    Deepak Garg and Manuel Gomez-Rodriguez and Pierfrancesco Ingo and
    Matthew Lentz and Aastha Mehta and Bernhard Schölkopf},
    year={2020},
    eprint={2011.08069},
    archivePrefix={arXiv},
  }
  

• Listening to Bluetooth Beacons for Epidemic Risk Mitigation [Link]
  Gilles Barthe, Roberta De Viti, Peter Druschel, Deepak Garg, Manuel Gomez-Rodriguez, Pierfrancesco Ingo, Heiner Kremer, Matthew Lentz, Lars Lorch, Aastha Mehta, Bernhard Schölkopf
  Under review, 2021.
  This paper shows the effectiveness of Pancast’s architecture through simulations.

  Bibtex

  @misc{barthe2020pancast,
    title={{PanCast: Listening to Bluetooth Beacons for Epidemic Risk Mitigation}},
    author={Gilles Barthe and Roberta De Viti and Peter Druschel and
    Deepak Garg and Manuel Gomez-Rodriguez and Pierfrancesco Ingo and
    Heiner Kremer and Matthew Lentz and Lars Lorch and Aastha Mehta and Bernhard Schölkopf},
    year={2021},
    doi={https://doi.org/10.1101/2021.01.21.21250209}
  }
  

Imprint / Data Protection