Privacy-Protecting COVID-19 

Exposure Notification Via 

Cluster Events Without 

Proximity Detection

Paul Syverson

U.S. Naval Research Laboratory

Workshop on Challenges for Digital 

Proximity Detection in Pandemics 

NIST (via Cyberspace)

January 29 02021
2

Some Problems Motivating This Design

● COVID Testing can be: Expensive And Slow

- Many new infections before exposed knows to quarantine

● Exposure Notification depends on participation in 

proximity detection (bluetooth)

1. Any nonparticipant is never detected/notified/notify-others

2. Any participant not detected is never det/notif/notif-others

● System must track all participants, not just tested-pos

● False reporting individual can create havoc

- Johnny has a chem test tomorrow. Reporting a positive 

result (anonymously) he can close school.
Positive: Tested yesterday. Results not in.

3
4

Some Problems Motivating This Design

● COVID Testing can be: Expensive And Slow

- Many new infections before exposed knows to quarantine

● Exposure Notification depends on participation in 

proximity detection (bluetooth)

1. Any nonparticipant is never detected/notified/notify-others

2. Any not-detected participant is never det/notif/notif-others

● System must track all participants, not just tested-pos

● False reporting individual can create havoc

- Johnny has a chem test tomorrow. Reporting a positive 

result (anonymously) he can close school.
Proximity Detection Participant

Tested Positive

5
Proximity Detection Participant

Tested Positive

6
7

Some Problems Motivating This Design

● COVID Testing can be: Expensive And Slow

- Many new infections before exposed knows to quarantine

● Exposure Notification depends on participation in 

proximity detection (bluetooth)

1. Any nonparticipant is never detected/notified/notify-others

2. Any not-detected participant is never det/notif/notif-others

● System must track all participants, not just tested-pos

● False reporting individual can create havoc

- Johnny has a chem test tomorrow. Reporting a positive 

result (anonymously) he can close school.
8

Some Problems Motivating This Design

● COVID Testing can be: Expensive And Slow

- Many new infections before exposed knows to quarantine

● Exposure Notification depends on participation in 

proximity detection (bluetooth)

1. Any nonparticipant is never detected/notified/notify-others

2. Any not-detected participant is never det/notif/notif-others

● System must track all participants, not just tested-pos

● False reporting individual can create havoc

- Johnny has a chem test tomorrow. Reporting a positive 

result (anonymously) he can close school.
9

Some Things Leveraged By This Design

● Point-of-care tests dist. through HHS/DoD and WHO

- Cost about $5, Results in about 15 min

- 99.7 Million tests allocated in U.S. as of a week ago

- Sensitivity 97.1%, Specificity 98.5%

● COVID-19 propagates in clusters

- Vast majority of infected never infect anyone else

- Most distribution happens when multiple tested-positive 

individual are copresent with others

- “In an overdispersed regime, identifying transmission events

(someone infected someone else) is more important than 

identifying infected individuals.” -Tufekci
10
High level design summary

1. Individual positive test result

2. Enter + in notification app on phone

- Option: automatic receipt of test result (e.g. testor scans app QR code)

- Option: entering positive result requires authorization

3. App selects events (location,time) history for critical period

- From time might have become infected (not just infectious)

4. App pairs these w/ (random ID(i,t), location(random ID(i,t), t) ) 

5. App submits list of pairs through privacy preserving system

6. System clusters pairs from all reporting phones into events with 

multiple tested-pos individuals are present

- Clustering may use ancillary info

- Indiv. false reports: must actually be at event and cross reporting threshold

7. System pushes events to individuals/publishes on webpage

8. Participants (and nonpart) locally compare pushed events to local individual history 

11
High level design summary

1. Individual positive test result

2. Enter + in notification app on phone

- Option: automatic receipt of test result (e.g. testor scans app QR code)

- Option: entering positive result requires authorization

3. App selects events (location,time) history for critical period

- From time might have become infected (not just infectious)

4. App pairs these w/ (random ID(i,t), location(random ID(i,t), t) ) 

5. App submits list of pairs through privacy preserving system

6. System clusters pairs from all reporting phones into events with 

multiple tested-pos individuals are present

- Clustering may use ancillary info

- Indiv. false reports: must actually be at event and cross reporting threshold

7. System pushes events to individuals/publishes on webpage

8. Participants (and nonpart) locally compare pushed events to local individual history 

12
High level design summary

1. Individual positive test result

2. Enter + in notification app on phone

- Option: automatic receipt of test result (e.g. testor scans app QR code)

- Option: entering positive result requires authorization

3. App selects events (location,time) history for critical period

- From time might have become infected (not just infectious)

4. App pairs these w/ (random ID(i,t), location(random ID(i,t), t) ) 

5. App submits list of pairs through privacy preserving system

6. System clusters pairs from all reporting phones into events with 

multiple tested-pos individuals are present

- Clustering may use ancillary info

- Indiv. false reports: must actually be at event and cross reporting threshold

7. System pushes events to individuals/publishes on webpage

8. Participants (and nonpart) locally compare pushed events to local individual history 

13
High level design summary

1. Individual positive test result

2. Enter + in notification app on phone

- Option: automatic receipt of test result (e.g. testor scans app QR code)

- Option: entering positive result requires authorization

3. App selects events (location,time) history for critical period

- From time might have become infected (not just infectious)

4. App pairs these w/ (random ID(i,t), location(random ID(i,t), t) ) 

5. App submits list of pairs through privacy preserving system

6. System clusters pairs from all reporting phones into events with 

multiple tested-pos individuals are present

- Indiv. false reports: must actually be at event and cross reporting threshold

- Clustering may use ancillary info

7. System pushes events to individuals/publishes on webpage

8. Participants (and nonpart) locally compare pushed events to local individual history 

14
15

● Example: Reportable 

Cluster ancillary criteria

- Busy city street corner: 4

- Crowded poorly-ventilated 

barbershop: 2 

- Unknown location: 3
High level design summary

1. Individual positive test result

2. Enter + in notification app on phone

- Option: automatic receipt of test result (e.g. testor scans app QR code)

- Option: entering positive result requires authorization

3. App selects events (location,time) history for critical period

- From time might have become infected (not just infectious)

4. App pairs these w/ (random ID(i,t), location(random ID(i,t), t) ) 

5. App submits list of pairs through privacy preserving system

6. System clusters pairs from all reporting phones into events with 

multiple tested-pos individuals are present

- Indiv. false reports: must actually be at event and cross reporting threshold

- Clustering may use ancillary info

7. System pushes events to participant phones/publishes on webpage

8. Participants (and nonpart) locally compare pushed events to local individual history 

16
17

Questions?

● Work is described in a paper under journal review

● Full disclosure: just a high-level design and discussion

- No design detail

- Not implemented

● Contact author if interested: paul.syverson@nrl.navy.mil