Text File

Date: 29 Oct 89 20:27:52 GMT From: stodol@diku.dk (David Stodolsky) Subject: Secure Distributed Databases for Epidemiological Control To: misc-security@dkuug.dk

English update of: Stodolsky, D. S. (1989, August). Brugerforvaltet datakommunikationssystem til bekaempelse af seksuelt overfoerbare infektionssygdomme [Secure Distributed Databases for Epidemiological Control]. Research proposal submitted to the AIDS-Fund Secretariat, Danish Health Department. (Available from the author at the Psychology Department, University of Copenhagen )

==============================================================

Secure Distributed Databases for Epidemiological Control

Abstract

The project's objective is to develop a personal computer-based system for control of infectious agents. The overall goal is a better understanding of affects of enhanced social facilitation and health education on disease transmission. A theory of real- time epidemiological control, based on contact tracing, specifies a cryptographicly-secure distributed-database system providing situationally specific risk assessments that are based upon personal histories.

Personal computer systems negotiate exchanges of information that permit preselection of conversation partners. The techniques used yield unprecedented protection for user's identities and data. Users communicate under the protection of pseudonyms. Data is kept private, but is releasable through exchange negotiations. The systems permit self-administration of questionnaires and distribution of health information, as well as communication with selected conversation partners.

Information on changing health status and risk related behaviors are routinely gathered during system operation. In addition to giving users situationally specific risk assessments, these data permit new types of epidemiological analysis.

A pilot project devoted to design and development of a prototype system is specified in detail. The plan includes discussions with potential organizational participants in the proposed experiment and other interested parties.

=====================================================

30 August, 1989

"I don't want to know your name, I want your history." (Painters and Dockers, 1988).

Secure Distributed Databases for Epidemiological Control

(Controlling Sexually Transmitted Diseases with Informational Barriers)

1. Objectives

Information technology offers new techniques for the control of infectious agents that can complement medical and public health measures. The techniques described here are most useful when medical measures are of limited value and where privacy concerns predominate. The discussion is focused on control of the Human Immunodeficiency Virus (HIV), even though the approach is of general applicability. For instance, HIV seropositive persons benefit even more from this approach than others, since it helps protect them from exposure to infectious agents that can activate the virus and cause other infections. The specific project objective is the development of information technology techniques for control of sexually transmitted diseases. The overall project objective is to investigate the impact of social facilitation and health education on disease transmission, that is achieved by using such techniques.

Social facilitation has two roles. First, to enhance risk free contacts through preemptive detection of risky transactions. Second, to reduce the total number of transactions, and thereby risk, by stabilizing relationships through increasing the probability that continuing interactions results from mediated contacts. Both of these objectives require negotiations using significant amounts of sensitive information prior to actual contact. In the first case this information is of a medical nature, in the second it is of an ideological or social nature. The negotiation procedure can be highly restrictive, resulting in rejection of most potential contacts. Thus, if social support is to be maintained, the scope of potential contacts must be increased. This requirement is satisfied by using telematic systems and computer support in the negotiation process. Such automatic mediation also permits effective protection of sensitive personal information, thereby enhancing the likelihood that the data is complete and reliable.

1.1. Detection of risk

Preemptive risk detection is facilitated by individualized real-time epidemiological modeling. Both the medical and behavioral history of each person is available during the negotiation process. Certain risky contacts are blocked by the mediating system. For instance, a HIV seropositive person would never be matched with a HIV seronegative person. In most cases, however, medical test results will not be available, thus behavioral information provide estimates of risk. Adequate data is maintained to permit contact tracing in real-time when a positive test result occurs. Thus, a single positive test result could propagate through a chain of contacts, changing the risk status of a large number of persons rapidly. Persons at high risk would be rejected as social contacts, in most cases, until a negative test result was obtained. This would lead to voluntary compliance with a program of selective testing for persons at greatest risk. Thus, preemptive risk detection operates in two ways. First, risky contacts are rejected by presumably uninfected persons, thereby blocking transmission of infectious agents. Second, at-risk persons are motivating to seek medical assistance for a change of risk status.

1.2. Stabilizing relationships

As long as infectious agents are prevalent, risk of infection is proportional to the number of (risky) contacts. In the case that persons are seeking a stable relationship, a prior knowledge of objective factors including behaviors, and subjective factors such as interests, desires, attitudes, and beliefs can play a role in predicting outcome of a contact and thereby minimizing the number of contacts needed to find a stable relationship. While guarantees of privacy can improve the reliability of data contributed by persons, it is likely that feedback from prior contacts can be used to improve data accuracy. It certainly can play a role in confirming that self reports are complete and honest.

1.3. Security system development

The success of the strategy proposed requires the ability to use data without disclosing it except when absolutely required. The highly sensitive nature of the data needed for this study presumes development of improved security models. Security that is dependent on trusted third parties may be adequate for the initial phase of this study, but elimination of such intermediaries is an objective. Thus, in the limit, each person would exercise control over their sensitive data directly. This would, of course, require a personal computer or "smart card" for each user. Such systems have been proposed and will become economically feasible in the near future. Specification and feasibility analysis of various security enhancements will be examined as part of the project.

A first security enhancement step would be to provide the user with a card that in connection with a password or personal identification number (PIN) could be used to activate remotely held sensitive data. This level of security is currently available with electronic funds transfer (EFT) terminals (automated teller machines). A next level of security is to provide each user with a "key loader" that provides a sequence of binary digits that is used to decode remotely held data files that normally remain enciphered.

Optimal security is available when data is under the direct physical control of the user as well as being secured by password and cryptographic security mechanisms. Currently available personal computers have adequate capacity to perform these functions. Central data would list pseudonyms (public-keys) of persons using compatible systems and provide mail boxes for messages. All exchanges of information would be encrypted.

2. Significance

The AIDS epidemic has created a medical emergency of major proportions. It also threatens to create a crisis of social control unprecedented in modern times. The major reason for this is the lack of medical countermeasures against the virus. A second reason is the effect of the HIV on the brain, AIDS dementia complex (ADC), that can result in irresponsible behavior (AIDS not, 1987; Smith, 1989). A third reason is that some common institutions for social coordination may actually accelerate the spread of the disease. This deficiency can be overcome by a strategy that simultaneously enhances personal integrity and social control.

Factors including changing population density, behavioral patterns, and infection pathways alter niches for pathogenic organisms which evolve under new conditions. AIDS is an example of a disease which has dramatized the availability of a new niche. Seale and Medvedev (1987) argue that the AIDS epidemic could not have started without the availability of multi-use hypodermics. An important characteristic of this disease is inapparent infection that inhibits its control. Effective control presumes the ability to visualize the infectious agent and take appropriate action to avoid further transmission. Cost effective medical testing alone cannot reliable visualize HIV, due to delayed seroconversion resulting from the virus remaining hidden inside cells, failures in seroconversion, and even loss of antibody response. Transmission can apparently not be reliably blocked by physical barriers. Related organisms pose an even greater threat prior to identification (Cancer virus, 1987). These limitations demand a new control strategy suitable to new conditions of disease transmission.

The control strategy suggested here permits an approach to disease management independent of medical capabilities. It has the potential of being both effective and economical. Infection risk is visualized entirely through information handling. Thus, the technique can be applied without detailed knowledge of the infectious agent. Avoidance of infection is an integrated function of the information handling strategy, as is the motivational structure needed to promote cooperation. A most important aspect of the strategy is that it is a preventative approach. Brecher (1975) concluded that the three major strategies for control of sexually transmitted diseases, treatment of symptomatic cases, contact tracing, and routine screening are ineffective compared to simple preventative measures. He argues for health education and effective prophylaxis as likely to lead to reduced incidence. In the case of HIV, prophylaxis is the only strategy currently available, and thus it is crucial that informational as well as physical barriers be used to inhibit the spread of the virus.

This is perhaps even more important when we consider the long term dynamics of disease. Often diseases evolve in the direction of reduced virulence, making them less apparent and often more prevalent (Seale & Medvedev, 1987). In the case of HIV, it is likely that the first successful medical countermeasures will consist of methods to extend the latent period of the disease. Thus, while currently, a person can remain symptom free for 5 to 7 years, a person receiving this first type of treatment for HIV may remain symptom free for 20 years or more. The key premise of this strategy asserts that HIV infection and AIDS are chronic, manageable conditions (Smith, 1989). During this time persons may pose a continuing infection risk. If these persons are to remain contributing members of society the informational barriers suggested here may be crucial.

A wide range of compulsory measures directed towards individuals have been suggested and in some cases implemented, even though their negative side effects have been recognized. However, voluntary ones which could be equally effective have not been exploited. The potential of voluntary measures has been recognized by the public. The news report, "Blodgivarnaal blir 'friskhetsintyg'?", was occasioned by a sharp increase in blood donors in Malmo and reports that blood donor pins were being used at a dance hall as health certificates (Fredriksson, 1987). A corresponding increase was noted to not have occurred in Goteborg. In Malmo the pins are given out after the first blood donation, while in Goteborg they are given out after ten donations. So the difference in public response is hardly surprising, it results from a natural experiment on the control of sexually transmissible diseases.

3. Background

3.1. Informational precursors in social medicine

The epidemiological approach taken here is similar to the highly effective public health measures taken in 18th and 19th century to control infectious diseases. Up until that time cities (e.g., Copenhagen and Stockholm) most often had no effective sewage or garbage disposal services. This led to a situation in many cities where maximum population levels were reached, with deaths due to infection balancing population inputs. Having recognized that many diseases were transmitted (by microorganisms) in wastes, public works programs were undertaken in order to segregate fluids carrying wastes from fluids used for consumption and for food preparation. These measures were taken well before effective medical procedures for dealing with many diseases were developed, and in most cases before the actual causative agents were identified. A key point is that knowledge about transmission of infectious agents preceeded their control. This control was implemented by a physical restructuring of fluid management through sanitary engineering.

The fluids dealt with here are distinguished by the source individual. Due to higher population densities, changes in attitudes about sex, increases in uses of invasive procedures (use of blood and other bodily products in medicine, and use of injectable drugs) persons are now much "closer" in a physiological sense then in earlier times (Seale & Medvedev, 1987). It is not only recommended to avoid certain classes of fluids that are in general known to contain infectious agents, but to avoid contact with body fluids from classes of persons in risk groups (Prostitutes asked, 1987). The approach discussed here goes one step further in this line of development, it introduces measures permitting one to routinely avoid contact with fluids from specific individuals who are at risk or known to be carriers of an infectious agent. This requires the routine use of prior knowledge about these agents. That is, the availability of informational precursors associated with these agents.

3.1.1. Biological agents

A clear understanding of the approach requires distinction between biological agents, informational agents making demands upon attention, and informational agents that require only processing by machines. If each person was to inform a potential contact of all infectious agents carried by that person, then we could say that an informational precursor existed for each infectious agent. This would give persons the option of avoiding contact with fluids containing infectious agents.

3.1.2. Informational demands upon attention

Aside from the privacy problems and diagnostic uncertainties which would reduce the effectiveness of such a procedure, there are major informational demands upon attention associated with it. Particularly in the case where there is a reasonable prevalence of an infectious agent in a population, the simple communication of diagnostic information would be inadequate. With sexually transmitted diseases, in most cases, at least one new person has been infected by the time a given individual has been diagnosed as carrying the infectious agent. Thus, a person would have to communicate not only their own diagnostic information, but also the diagnostic information from previous contacts. Some of information concerning a given contact would only become available much after that contact had take place, thus inducing unrealistic informational demands upon communicators.

3.1.3. Information processible by machine

A solution to this problem is to structure diagnostic data in standardized machine readable forms, thus permitting precursor information (both from direct diagnosis and from diagnostic information transmitted by contact tracing) to be exchanged by computers prior to an anticipated contact. This strategy also permits the introduction of an effective solution to the privacy problem. The idea is to make use of the information without revealing that information except when it is no longer sensitive (Stodolsky, in prep.). It also compensates to some degree for diagnostic uncertainties, since what is transmitted by automated contact tracing is information about risk, as opposed to direct diagnostic information. The automated contact tracing mechanism can also be implemented in a manner protecting personal integrity (Stodolsky, 1979a; 1979b; 1979c; 1983; 1986)

3.2. Theory of operation

The system outlined here is most simply explained if we assume that each person has a personal computer capable of directly exchanging information with those of other persons. These computers can, in the simplest case, generate random numbers that are used to label transactions. A transaction is defined as an interaction capable of transmitting the infectious agent. After each transaction, therefore, a person has a unique label or code for that transaction.

In the event that a person becomes ill or is identified as carrying an infectious agent, the transaction codes which represent transactions during which that agent could have been transmitted are then broadcast to all other computers. If a receiver's computer has a matching code, then that person is alerted to the possibility of the agent's presence, and can report to a medical center for testing and treatment. This iterates the process, thus identifying all carriers eventually. The effect is to model the epidemiological process, thereby identifying all (potential) carriers through forward and backward contact tracing.

In order to clarify the procedure, consider a scenario in which there are two types of actors, persons (Pi) and doctors (Di) (Figure 1). Doctors operate only within a health center (HC). There are also two types of agents, biological and informational, that can be transmitted during a transaction. Informational agents are always transmitted with physical agents. Each actor has a computer that can exchange information with another actor's computer. A doctor's computer can also broadcast messages to all actors at once by sending them through a more powerful computer at the health center. Contact tracing is illustrated by the sequence in Figure 2. At time T1 person A (Pa) and person B (Pb) engage in a transaction. Their computers label this transaction with a number N1 and store the number. Pb then physically moves into contact with person C (Pc), this transaction is labeled N2 and recorded at time T2. At time T3, Pb becomes ill and reports to a doctor (Da). The doctor verifies the infectious nature of the illness and then reads the transaction codes, N1 and N2, out of Pb's computer. These are broadcast to all other computers at time T4. When Pa's computer receives the broadcast, the transaction code N1 matches the number stored in memory. This alerts Pa to the fact that s/he is in the chain of transmission of the infection ( in this case Pa was the initial carrier of the infectious agent). When Pc's computer receives the broadcast, the transaction code N2 matches the number stored in memory. This alerts Pc to the fact that s/he may have been infected (at T2). The alerting of Pa is an example of backward tracing from Pb. The alerting of Pc is an example of forward tracing. We assume in this simplest case, that when an alert is received, the affected person voluntarily reports to a doctor. In a more secure system, a person's computer would not be capable of generating new transaction codes if a matching code had been received. This would indicate to potential new contacts that contact with this person was risky. (Actually, the more secure procedure would require the exchange of updated health certificates.)

3.3. Operational alternatives

An ideal system would ensure that all contacts were mediated by computer. Since the most appropriate technology, powerful wristwatch like computers with communication capabilities, is not available for the moment (though key components have become available [Ivey, Cox, , Harbridge, & Oldfield (1989)]), development will proceed on standard personal computers. While these machines are available in a hand held format, people can not be expected to carry them at all times. In many cases, people can organize their contacts using a personal computer from an office, public computer center, or their home, but clearly other options must be available. A voice-message system that duplicates all function of the personal computer, but with voice output and telephone key-pad input is an attractive option. It permits planned organization of contact opportunities with limited, but, for most persons, more than adequate security.

In the case of chance meetings, persons would be required to make an inquiry prior to proceeding with a contact. The common magnetic strip credit card offers an adequate level of security, but requires a readily accessible teller machine. Such a verification system assumes cooperation of appropriate financial institutions. A telephone-based verification system used in a manner similar to credit card verification is another option. The various options will be considered during the first year of the project.

4. Research plan

The overall research plan is based on a 2 factor design with repeated measures. One factor is risk group and the second is availability of an experimental health conferencing system. Dependent measures include health status and health related behaviors. The plan is designed to permit rigorous evaluation of results without interfering with effective service to the subject populations, and to permit rapid scaling up to a larger population if justified by the initial results. If the security needs are met, it is expected that demand for service will exceed supply. The waiting list management strategy will generate the control groups.

The effect of the health conferencing system on infection and risk behaviors is of major interest, thus this effect is measured as a within subject factor. Each group will be compared to itself at a later time. Comparison to cross sectionally matched individuals controls for time effects. The differential effectiveness the experimental intervention on different risk groups is studied as a between subject factor in order to enhance the generalizability of the results. A nested multi-variate analysis of co-variance with repeated measures using matched controls is used for overall data evaluation.

4.1. Method

A secure conferencing system permitting automated interviewing and selection of conversation partners, as well as mail delivery functions will be developed. The software will be installed on two identical systems. One system will be made available to the Organization of Gays and Lesbians in Denmark, the other to the (HIV) Positive Group in Denmark.

Each person expressing interest in participating receives information describing the study and a preliminary self-administered interview. Person applying to the Positive Group must present evidence of seropositivity to be considered further. Persons applying to the Organization of Gays and Lesbians in Denmark must present results of a Polymerase Chain Reaction (PCR) investigation to be considered further. Upon presentation of appropriate medical evidence, the registrar assigns them a pseudonym and password. A comprehensive interview covering health history and health behaviors is then self-administered. Each person receives health education materials and is placed on the waiting list.

When 500 persons are available from each organization they will be formed into matched groups and randomly assigned to either treatment or control conditions. The treatment groups receive a questionnaire for guiding the selection of conversation partners. Controls remain on the waiting list for six months at which time they are integrated into the treatment condition. Depending upon results of a risk assessment interview, serological testing may again be required. Participants are required to give feedback interviews after meeting conversation partners. This serves as a check on self-reported data and as a source of information on opportunities for transmission of infectious agents. Data on interactions with other persons and degree of risk associated with them is also collected routinely. Sexual transmitted infections and other conditions requiring medical intervention are reported routinely. Health behavior interviews are readministered on six month intervals just prior to integration of a new persons into the treatment groups.

4.2. Time frame

The first year is devoted to preparations including software development, finalizing arrangements with participating organizations, and pilot testing (See "Specific tasks for preparation phase (First year)" below). The first six month period of the second year is reserved for training of registrars , and accumulating and interviewing of participants. The second six month period is for comprehensive testing of operational procedures as the first set of participants begins using the experimental system. Cross sectional data analysis techniques will be applied during this period.

The third half-year of the operational phase of the project will be devoted to the integration of the first set of control groups into the treatment condition. After this, all procedures and software will have been finalized. Longitudinal data analysis procedures will be integrated with those already in use. At two additional six month intervals, half of those on the waiting list will be added to the experimental groups using the health conferencing system.

4.3. Specific tasks for preparation phase (First year)

4.3.1. Contact and discussions with organizations.

The wide range of sensitive and important questions raised by the proposed study make it imperative that affected and concerned organizations and persons (Dansk Epidemiologisk Institut, Statens Serum Institut, Registertilsynet, Sundhedsstyrelsen, Landsforeningen for Boesser og Lesbiske, Positivgruppen, Frivillige Bloddonorer, selected journalists and politicians, etc.) have the opportunity to review and comment upon the proposal. This will include, but not be limited to those collaborating in the experiment proper. Invitations to a workshop series will be issued to those selected. The workshops will include lectures, demonstrations (both manual and computer), and discussions. Feedback from participants will be used as input to the experiment design.

4.3.2. Design of experimental trials

The specifics of the design including control procedures will be structured to insure both scientific validity of collected data and acceptability of procedures to participants and their organizations. It is expected there will be conflicts between these two demands and the workshops will be used to anticipate and facilitate their resolution. A specific question to be addressed will be the potential conflict between demands for participation and capacity of organizations to respond to them without sacrificing rigor of the trials. While previously developed questionnaires will serve a base for data collection, specific concerns and interests of different organizations and interests groups will influence the actual data requested from participants.

4.3.3. Design of secure registration procedures

Protection of the participants identity will be in part dependent upon the security of the registration and pseudonym assignment procedures. Abuse of the system that could result from persons obtaining multiple names will also be controlled by the registration system. Both administrative and cryptographic mechanisms will require careful specification. After a description of the cryptographic mechanisms for registration, organizational placement for administrative procedures will be determined.

4.3.4. Software development

The most important factor in protection of the participants is the security of their own computer systems. Both privacy and protection of identity depends upon the integrity of the cryptographic software. The software is also plays an essential role of demonstrating the system so better understanding can be achieved by both users and representatives of organizations considering the adoption of the system. Certain components of the proposed system perform functions that have never been implemented on computer systems or that have not been implemented to perform the functions needed in this application. Preliminary software development will permit a better estimate of the overall effort required to satisfy the security and efficiency requirements in the proposed application. Preliminary development will also permit testing of the user interface to ensure easy operation under strict security requirements.

4.3.5. Simulation modeling

Simulation modeling for predicting effects of the completed system can play both analytic and educational roles. Graphics can effectively illustrate the relative impact of preventative as opposed to treatment- based methods in epidemiology. Such simulations can influence organizational decision makers as well as potential users. Analytic questions concerning the relative impact of limited adoption of the technology on overall population morbidity and mortality can also be answered with simulation methods. This could answer cost effectiveness questions and be used to guide the rate of adoption of the new technology. Considering the very large expenses associated with clinical treatment of AIDS, the simulation models may be useful in estimating appropriate funding for operational stages of the project.

4.3.6. Publication of "Hormones" epidemiological model.

While the general concept of real-time epidemiological modeling has been presented at a conference (Stodolsky, 1983), publication has been limited to an application involving control of electronic infections on computer networks (Stodolsky, 1989). Conference presentation and publication as a human population oriented application will strengthen theoretical review, and directly address specific questions concerning human and legal rights. The secure model was included in a recent conference presentation (Stodolsky, 1986). It would best be mathematized and then subject to a proof of correctness to insure that any flaws are identified before substantial software development efforts are made.

4.3.7. Publication of "Conditional privacy:..."

The paper "Conditional privacy: Protecting expression by one-bit matchmaking" received public exposure in a conference presentation (Stodolsky, 1986). While the method is relatively straight forward cryptographicly, conference presentation and publication would increase the probability that any protocol errors are uncovered and perhaps suggest enhancements that integrate certification with information exchange.

4.3.8. Test data collection

Once data requirements are identified, data collection procedures will be tested in a software environment approximating the final system. This will permit identification of user interface and security problems that could cause problems.

4.3.9. Pilot tests

Test of the completed system, not including cryptographic security, can be conducted with non-sensitive data to insure operational procedures are functional. Participants could include students and interested person attending demonstrations.

5. References

AIDS not gentle on the mind. (1987, March 26). New Scientist, (1153), 38-39.

Brecher, E. M. (1975). Prevention of sexually transmitted diseases. The Journal of Sex Research, 11(4), 318-328.

Cancer virus linked to drug users. (1987, May 21). International Herald Tribune, 8.

Chaum, D. (1985). Security without identification: Transaction systems to make big brother obsolete. Communications of the ACM, 28(10), 1030-1044.

Fredriksson, A. (1987, July, 15). Blodgivarnaal blir "friskhetsintyg"? Goteborgs-Posten, No. 88, 18.

Hellerstedt, L. (1987, June 19). Homosexutredning: Aidstest "frikort" foer loesslaeppt sex. Dagens Nyheter.

Ivey, P. A., Cox, A. L., Harbridge, J. r., & Oldfield, J. K. (1989, August). A single-chip public key encryption subsystem. IEEE Journal of Solid- State Circuits.

Painters and Dockers (Rock musicians). (1988). "Safe Sex", Crocodile (Compact Disk EMA CD1). Export Music Australia.

Prostitutes asked not to give blood. (1987, April 9). New Scientist, (1555), 29.

Seale, J. R. & Medvedev, Z. A. (1987). Origin and transmission of AIDS. Multi-use hypodermics and the threat to the Soviet Union: discussion paper. Journal of the Royal Society of Medicine, 80, 301-304.

Smith, D. (1989, July 14). AZT, Acyclovir, and the case for early treatment. AIDS Treatment News, Issue No. 83.

Stodolsky, D. (1979a, April 9). Personal computers for supporting health behaviors. Stanford, CA: Department of Psychology, Stanford University. (Preliminary proposal)

Stodolsky, D. (1979b, May 21). Social facilitation supporting health behaviors. Stanford, CA: Department of Psychology, Stanford University. (Preliminary proposal)

Stodolsky, D. (1979c, October). Systems approach to the epidemiology and control of sexually transmitted diseases. Louisville, KY: System Science Institute, University of Louisville. (Preliminary project proposal)

Stodolsky, D. (1983, June 15). Health promotion with an advanced information system. Presented at the Lake Tahoe Life Extension Conference. (Summary)

Stodolsky, D. (1986, June). Data security and the control of infectious agents. (Abstracts of the cross disciplinary symposium at the University of Linkoeping, Sweden: Department of Communication Studies).

Stodolsky, D. (1989). Net hormones: Part 1 - Infection control assuming cooperation among computers [Machine-readable file]. Van Wyk, K. R. (1989, March 30). Several reports available via anonymous FTP. Virus- L Digest, 2(77). Abstract republished in van Wyk, K. R. (1989, April 24). Virus papers (finally) available on Lehigh LISTSERV. Virus-L Digest, 2(98). (Available via anonymous file transfer protocol from LLL- WINKEN.LLNL.GOV: File name "~ftp/virus-l/docs/net.hormones" at Livermore, CA: Lawrence Livermore National Laboratory, Nuclear Chemistry Division and IBM1.CC.LEHIGH.EDU: File name "HORMONES NET" at Bethlehem, PA: Lehigh University. And by electronic mail from LISTSERV@LEHIIBM1.BITNET: File name "HORMONES NET" at Lehigh University).

Stodolsky, D. (in prep.). Conditional privacy: Protecting expression by one-bit matchmaking.

=========================================================

/---[] [] | Pa | ---------------[]-------------- \---/ | [] | | | /---[] | /---[] /---[] | | Pb | | | Da | | Db | | \---/ | \---/ \---/ | | | | Health Center | /---[] ------------------------------- | Pc | \---/

----------------------------------------------------------

Explanation of Symbols:

/---\ Persons | Pi | \---/

/---\ Doctors | Di | \---/

Computers []

Figure 1

============================================================

P h ----------- -----[]----- y | N1,N2 | | N1,N2 | s | Pb Da | | Da | i | | | | c ----------- ------------ a Pa Pa l N1 N1=N1 Pb Pa Pa P Pb l N2 N2=N2 a Pc Pc Pc Pc c e Pb

Time -----------------------------------------------> T1 T2 T3 T4

----------------------------------------------------------

Explanation of symbols:

Person i Pi Doctor A Da

Physical and Pi informational Ni Transaction codes Ni exchange Pj ---- Information Ni,Nj Health Center | | transmission Pi ----

Information Ni=Ni Health Center -[]- reception Pi Computer | | and matching Transmitting ----

Time of operation Ti

Figure 2

=========================================================== David S. Stodolsky, PhD Routing: <@uunet.uu.net:stodol@diku.dk> Department of Psychology Internet: <stodol@diku.dk> Copenhagen Univ., Njalsg. 88 Voice + 45 31 58 48 86 DK-2300 Copenhagen S, Denmark Fax. + 45 31 54 32 11