  Digital contact tracing is being used by many countries to help contain
COVID-19's spread in a post-lockdown world. Among the various available
techniques, decentralized contact tracing that uses Bluetooth received signal
strength indication (RSSI) to detect proximity is considered less of a privacy
risk than approaches that rely on collecting absolute locations via GPS,
cellular-tower history, or QR-code scanning. As of October 2020, there have
been millions of downloads of such Bluetooth-based contract-tracing apps, as
more and more countries officially adopt them. However, the effectiveness of
these apps in the real world remains unclear due to a lack of empirical
research that includes realistic crowd sizes and densities. This study aims to
fill that gap, by empirically investigating the effectiveness of
Bluetooth-based contact tracing in crowd environments with a total of 80
participants, emulating classrooms, moving lines, and other types of real-world
gatherings. The results confirm that Bluetooth RSSI is unreliable for detecting
proximity, and that this inaccuracy worsens in environments that are especially
crowded. In other words, this technique may be least useful when it is most in
need, and that it is fragile when confronted by low-cost jamming. Moreover,
technical problems such as high energy consumption and phone overheating caused
by the contact-tracing app were found to negatively influence users'
willingness to adopt it. On the bright side, however, Bluetooth RSSI may still
be useful for detecting coarse-grained contact events, for example, proximity
of up to 20m lasting for an hour. Based on our findings, we recommend that
existing contact-tracing apps can be re-purposed to focus on coarse-grained
proximity detection, and that future ones calibrate distance estimates and
adjust broadcast frequencies based on auxiliary information.
