  Since the global spread of Covid-19 began to overwhelm the attempts of
governments to conduct manual contact-tracing, there has been much interest in
using the power of mobile phones to automate the contact-tracing process
through the development of exposure notification applications. The rough idea
is simple: use Bluetooth or other data-exchange technologies to record contacts
between users, enable users to report positive diagnoses, and alert users who
have been exposed to sick users. Of course, there are many privacy concerns
associated with this idea. Much of the work in this area has been concerned
with designing mechanisms for tracing contacts and alerting users that do not
leak additional information about users beyond the existence of exposure
events. However, although designing practical protocols is of crucial
importance, it is essential to realize that notifying users about exposure
events may itself leak confidential information (e.g. that a particular contact
has been diagnosed). Luckily, while digital contact tracing is a relatively new
task, the generic problem of privacy and data disclosure has been studied for
decades. Indeed, the framework of differential privacy further permits provable
query privacy by adding random noise. In this article, we translate two results
from statistical privacy and social recommendation algorithms to exposure
notification. We thus prove some naive bounds on the degree to which accuracy
must be sacrificed if exposure notification frameworks are to be made more
private through the injection of noise.
