The goal here was to ensure the central node had the ability to let all the users know about new contagious cases keeping this information anonymous. On the other hand, all the users would need to use this information to signal if they crossed their path with a positive case, calculate their own risk index and get back to the central node with this information.

Here how this would technically work:

- The central node broadcasts a list of anonymized people IDs. The broadcasted IDs will be the ones associated with risk index values above the threshold, meaning certainly positive individuals or highly probable positive ones;

- When a smartphone gets these IDs, it will verify if one or more are in the logs list built in the last days (with number of days configurable depending on the disease you want to track. Covid-19 would be 14 days);

- It’s possible to truncate the publicly broadcasted people IDs to protect their privacy even more: many more devices would match with it.

- With a second exchange of information, central node can then confirm (or deny) in a one-to-one communication, protecting privacy;

- It’s also possible to continuously change the Citizens’ IDs for privacy reasons. A layer of IDs translation servers could be added.

- Every broadcasted ID is sent along with its own risk index value. So that who receives it, can calculate her own probability of contagion (risk index);

- Sharing risk indexes allows the prioritisation of the countermeasures: millions of people could be potentially involved in two weeks of incubation, but testing the right people first can discharge the most of the other suspects very soon (the second and third grade contacts, for example), avoiding a lot of expensive tests and quarantines.

- The IDs should be generated by the smartphones themselves using a cryptography hash formula (MD5, SHA or stronger), and must include a number from the citizen’s ID card. This way, the citizen can demonstrate the ownership of the app (i.e. airport check-in), without ever disclosing her identity to the central node.

- To shard the broadcast lists, every anonymized ID should partially resolve in its own routing instructions. So that a uniform and huge global system could be created, supporting billions of people, not depending on borders.

We were there satisfied with the architectural solution we designed. It can sustain our idea and we didn’t see any specific technology issue in implementing such an architecture yet.

We therefore turned to BLE.