An Empirical Assessment of Global COVID-19 Contact Tracing Applications
arXiv:2006.10933
Abstract
The rapid spread of COVID-19 has made manual contact tracing difficult. Thus, various public health authorities have experimented with automatic contact tracing using mobile applications (or "apps"). These apps, however, have raised security and privacy concerns. In this paper, we propose an automated security and privacy assessment tool, COVIDGUARDIAN, which combines identification and analysis of Personal Identification Information (PII), static program analysis and data flow analysis, to determine security and privacy weaknesses. Furthermore, in light of our findings, we undertake a user study to investigate concerns regarding contact tracing apps. We hope that COVIDGUARDIAN, and the issues raised through responsible disclosure to vendors, can contribute to the safe deployment of mobile contact tracing. As part of this, we offer concrete guidelines, and highlight gaps between user requirements and app performance.
References in corpus (8)
- Contact Tracing Mobile Apps for COVID-19: Privacy Considerations and Related Trade-offs
- PACT: Privacy Sensitive Protocols and Mechanisms for Mobile Contact Tracing
- COVID-19 Contact-tracing Apps: a Survey on the Global Deployment and Challenges
- Apps Gone Rogue: Maintaining Personal Privacy in an Epidemic
- COVID-19 Contact Tracing and Privacy: Studying Opinion and Preferences
- Decentralized is not risk-free: Understanding public perceptions of privacy-utility trade-offs in COVID-19 contact-tracing apps
- Beyond the Virus: A First Look at Coronavirus-themed Mobile Malware
- Market-level Analysis of Government-backed COVID-19 Contact Tracing Apps
Cited by in corpus (5)
- SpreadMeNot: A Provably Secure and Privacy-Preserving Contact Tracing Protocol
- On the Privacy and Integrity Risks of Contact-Tracing Applications
- Market-level Analysis of Government-backed COVID-19 Contact Tracing Apps
- SARiSsa -- A Mobile Application for the Proactive Control of SARS-CoV-2 Spread
- PURE: A Framework for Analyzing Proximity-based Contact Tracing Protocols