An important question not considered in this paper is deniability. Could
the government use the presence of a CROCUS app on your phone be used
to implicate a protester? Is there other evidence that the app maintains
after the protest that could be used here? As an example, if a government
deployed a witness at a protest, later, it could ask you to authenticate
to this witness using the same protest ID, and only those who had not
authenticated previously would be able to do so.