Industry Specification Group (ISG) Europe for Privacy-Preserving Pandemic Protection (E4P) Activity Report 2020

Chair: Edgar Guillot, Orange

In the context of tracing persons potentially infected with a transmittable virus such as Covid-19, ISG E4P is developing a framework and consistent set of specifications for proximity tracing systems to enable the development of applications and platforms and facilitate international interoperability.

The devastating impact of the Covid-19 pandemic in 2020 placed the health systems of many countries under unprecedented strain. An immediate challenge was the reliable tracing and identification of individuals affected – or potentially affected – by the coronavirus to ensure their isolation. Traditional methods of contact tracing have relied on interviews with identified or suspected patients. As previous pandemics have shown, these methods were frequently hampered by interviewees’ imperfect recall of whom they had recently been in contact with, or the absence of contact information for other individuals with whom there may have been in proximity to.

From the first days of the pandemic, numerous initiatives emerged in attempt to tackle the spread of the virus with the help of the most varied technological solutions.

In May 2020 ETSI launched its Industry Specification Group (ISG) E4P (Europe for Privacy-Preserving Pandemic Protection), with the immediate goal of providing a standardization framework that enables developers to build interoperable mobile applications for automatic proximity detection and anonymous identification.  Complementing manual tracing methods, this framework must preserve users’ privacy and comply with relevant Data Protection regulation.

Scope of the group’s work considers:

  • Requirements for pandemic tracing systems
  • Proximity detection via the use of smartphones (and other devices), with requirements for anonymous identification, proximity data storage and protocols for sharing proximity data
  • Proximity tracing, including data protection and information security
  • Requisite APIs (Application Programming Interfaces)

The group’s first meeting attracted record participation from government and EC representatives, vendors, operators, research bodies, ethic, legal and cybersecurity players. By the end of the year E4P membership stood at 40 organizations plus seven participants and one counsellor (the EC).

Subsequently published in February 2021, the group’s first focus is a Group Report [GR E4P 002] that provides a comparison of existing pandemic proximity detection methods, applications and other aspects of a pandemic contact tracing system.

Similarities and differences between various available or upcoming approaches in different countries are examined in the report, particularly concerning the degree of interoperability, security aspects, use of centralized or decentralized approach, use of particular proximity detection methods and technologies, support of different device platforms, epidemiological value and privacy aspects. The analysis also includes a grouping of various approaches into several similar types (e.g. centralized or decentralized system) and provides examples of use cases to which the approaches apply.

The report is accompanied by a Group Specification [GS E4P 003], published in April 2021, presenting high level requirements for pandemic contact tracing systems using mobile devices that satisfy key requirements for reliability, accuracy, timeliness, privacy and security.

Work meanwhile progressed on further Group Specifications. Together these deliverables describe a contact tracing system satisfying the above criteria, with mechanisms covering both centralized and decentralized approaches.

The interests of ISG E4P saw the group liaising during 2020 with numerous other ETSI Technical Bodies, including EP eHealth that provided support to the group and SmartM2M that is exploring asynchronous contact tracing. Communication was also established with other groups including EPP 3GPP, TC ATTM WG SDMC, ISG OEU, TC SmartBAN, TC ERM TG30, ISG CIM and SC USER.

ISG E4P also established dialogue with external bodies including Bluetooth SIG, CEN/CENELEC JTC 13 and GSMA.

Look out for in 2021 – ISG E4P work in progress:

  • Group Specification (GS) on device-based mechanisms for pandemic contact tracing systems, including proximity detection mechanisms, anonymous identification of contacts and storage requirements for proximity data.
  • GS on back-end mechanisms for pandemic contact tracing systems, including architecture, information flow, protocols for sharing proximity data of contacts, data protection, user privacy, security and requisite APIs.
  • GS on interoperability framework for pandemic proximity tracing systems – allowing centralized and decentralized modes of operation to fully interoperate.