View original post at The Telegraph
Treating, testing, tracing: until an effective coronavirus vaccine is developed,
governments around the world are deploying the three Ts as a way out of this
crisis. Now anti-money laundering technology may provide a way to secure
the last of these without mass infringement of privacy.
In countries like South Korea, which has kept case numbers low, “contact
tracing” has involved gumshoe detective work, with investigators poring
through CCTV surveillance footage, financial records and conducting personal
interviews to hunt down those who had been in touch with infected people
and may or may not have become spreaders themselves.
But in Europe, for the most part, contact tracing is likely to rely on automated
technologies, panning GPS data from mobile phones to analyse who has been
where and when, then cross-matching that information to pinpoint those who
may have come into contact with a carrier of the disease.
The NHS is well known to be working on a tracing app, following the success
of Singapore’s own app, TraceTogether. But the UK is not alone. Many nations
are working on similar technologies.
Such is the emerging rash of tracing software that yesterday the European
Data Protection Supervisor (EDPS) called for a single pan-European app,
suggesting it would ensure both greater effectiveness and privacy protection.
Even so, it conceded, some “interference” with privacy “may still be
necessary”.
“The right to the protection of personal data is not an absolute right,” said the
EU’s data privacy chief Wojciech Wiewiórowski. “Even when we recognize
that an unusual way of processing would interfere with the right to privacy
and data protection, it may still be necessary in the extraordinary
circumstances we are all living over the last few weeks.”
Some companies, however, insist there need be no compromise. Last week
Google published reams of anonymised user location data to reveal how visits
to parks, medical outlets, public transport stations and other places had
declined compared to normal traffic.
Now it is working with academics from the University of Southampton to help
crunch such data and plot links between restricted movement and rates of
disease transmission.
Insight from such analysis might show how lockdowns can be eased without
risking a new flare-up.
In Tel Aviv, data science startup Duality Technologies is one of a number of
companies worldwide which is commercialising a technique called
homomorphic encryption, which allows swathes of data to be analysed
without even being decrypted.
“The classic approach to data sharing is ‘share, and give up on privacy, or
don’t share,’” says Duality CEO, Alon Kaufman.
“What Shafi Goldwasser came up with, is a way of analysing data without even
seeing it. It sounds like a counterintuitive statement. But in technical terms
you can analyse data while it remains encrypted.” Goldwasser is an AmericanIsraeli computer scientist who won the Turing Award in 2012 for her work in
cryptography and is a co-founder of Duality, which was valued at more than
£43m after its last fundraising round in September.
“So the government might say to a telecoms firm like Vodafone: ‘We have a
list of 100 Covid patients, we know who they are. You [Vodafone] will never
know who they are. And you will give me back all the locations that these
people have been in, in the last say two weeks.
“The next part is, the government says ‘Listen, give me anyone else at these
locations at the time [the patient was there]’, and again you provide me with
only the right answer without me having to see the location data of all the
population.
“The government only sees who matches up, and Vodafone doesn’t see
anything. Because you don’t want the government to see everyone’s location
data, and you don’t want to tell Vodafone who is sick. Every side sees only
what it has to see. Nothing more than that.”
Such protections will be necessary, Kaufman says, because “contact tracing
will be with us for the long term. It’s not a matter of an emergency. It’s a
matter of how we’re going to start to live with the after effects.”
The bottom line, he says, is that “you can do contact tracing, with a privacy
preserving manner, because Covid is going to be around for quite a long time
and tracing will be crucial to economic recovery.”
Homomorphic encryption, which has been a familiar concept in academia for
a decade or so, has only recently been commercialised. Apart from healthcare
data, it is notably used in anti-money laundering investigations, enabling
financial institutions to uncover criminal networks by sharing and analysing
sensitive information without revealing so-called “Personally identifiable
information”.
Last July, a team including Lloyds, HSBC and Duality Technologies presented
a homomorphic project named “Simba” at the Financial Conduct Authority’s
week-long 2019 Global Anti-Money Laundering and Financial Crime
TechSprint.
“Look at countries like China. From them we know that contact tracing is the
way out of this,” says Kaufman. “But the Western world can’t allow what’s
happening in China [in privacy terms]. We can’t just allow governments to do
that. This may be an emergency but there will be a day after corona.”
What is homomorphic encryption?
Homomorphic encryption allows people to process data, performing calculations on it,
without ever needing to decrypt it.
The technology, which was first proposed in 1978 but was only properly developed in
2009, is particularly useful for banks processing financial information, and for
companies which store people’s confidential health data.
For instance, a homomorphically encrypted medical database stored in the cloud would
allow users to ask the health condition of an employee. However, it would only accept
an encrypted employee name and provide an encrypted answer. This bypasses any
privacy issues of handling such sensitive data.
This type of system can also be useful for electronic voting systems. Homomorphic
encryption means that encrypted voting information could be processed without a
country needing to know exactly who voted for which party.
One of the problems with this encryption is that it makes it slower to perform simple
processes. It takes significantly more computer power to process encrypted data whilst
keeping it encrypted than it does to process unencrypted, “plaintext” data. Some
homomorphic encryption procedures can take up to a million times longer than less
secure methods.