The Differences Between Contact Tracing and Exposure Notification
Taylor Owen, Derek Ruths, Peter John Loewen, Stephanie Cairns, Sta Kuzviwanza, Sara Parker, Sonja Solomun
June 2020
The purpose of this rapid response briefing is to provide an overview of the differences between contact tracing and exposure notification, and outline the current options for these technologies. We summarize the technical differences between the two approaches, and review the security and privacy risks, adoptability, and feasibility of three technologies:
GPS-Based Contact Tracing
Bluetooth Low Energy (BLE) Based Contact Tracing
BLE-Based Exposure Notification (Apple/Google model)
Should the federal government implement or endorse a contact tracing or exposure notification technology, this briefing recommends Bluetooth-based exposure notification. Federal decision-making will require a careful balance between public health and safety, technological capacity, and privacy protection. COVID-19 apps require the collection of vast amounts of data; this can compromise personal privacy and increase security risks, as individuals may be more easily identified or have their personal information (particularly sensitive health information) exposed. Location data of any kind is highly sensitive and can never be fully anonymized; even de-identified1 location data can be used to re-identify2 individuals, often from only a few data points.3 In addition to securing privacy, strong data protection is an integral mechanism for ensuring public trust and adoptability. The capacity of any pandemic response technology should be rigorously weighed against its democratic impact and possible unforeseen (mis)uses.
