PSLotto: A Privacy-Enhanced COVID Lottery System

In March 2020, the World Health Organization (WHO) declared the novel coronavirus (COVID-19) a global pandemic. Globally the rapid spread of COVID-19 ground economies to a halt with stay at home orders and took the lives of millions of people. Therefore when vaccines became available as a tool to slow the spread of the COVID-19 virus, governments world-wide were looking to incentivize their populations to get vaccinated. Included in this effort, the government of Georgia created a lottery initiative to monetarily reward citizens who were vaccinated and encourage participation from those who were hesitant to get vaccinated. The Georgian lottery system that developed out of this initiative included a website displaying lottery winner data leading to serious privacy leakage. In this paper, we develop of an attack framework that allows adversaries with minimal background knowledge to re-identify STOPCOV Lottery winners and deploying our system against a subpopulation vulnerable to attack. We then propose our privacy-enhanced alternative, PSLotto, which simultaneously preserves the functionalities of the existing STOPCOV Lottery system and protects the privacy of lottery winners.