I cryptography. Here is another great read. It's the joint Google + Apple cryptography specification for Contact Tracing. Pity no one ponied up to put their name on it. There is a 24hr window of opportunity where people can be re-identified. Is that by design? The Rolling Proximity Identifiers are "privacy-preserving" identifiers that are sent in Bluetooth Advertisements. What is the probability of "collisions" on a Rolling Proximity Identifier? Security researchers, where are you?
Upon a positive test of a user for COVID-19, their Diagnosis Keys and associated DayNumbers are uploaded to the Diagnosis Server. A Diagnosis Server is a server that aggregates the Diagnosis Keys from the users who tested positive and distributes them to all the user clients who are using contact tracing.