COVID-19 one year on: Security and privacy review of contact tracing mobile apps

• Main Authors: ANG, Wei Yang, SHAR, Lwin Khin
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2021
• Subjects: mobile software security; data security; government contact tracing; Covid-19; public health; vaccination; Asian Studies; Information Security; Public Health; Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/6437; https://ink.library.smu.edu.sg/context/sis_research/article/7440/viewcontent/PCSI_2021_03_0019_preprint.pdf
• Institution: Singapore Management University

The ongoing COVID-19 pandemic caused 3.8 million deaths since December 2019. At the current vaccination pace, this global pandemic could persist for several years. Throughout the world, contact tracing (CT) apps were developed, which play a significant role in mitigating the spread of COVID-19. This work examines the current state of security and privacy landscape of mobile CT apps. Our work is the first attempt, to our knowledge, which provides a comprehensive analysis of 70 CT apps used worldwide as of year Q1 2021. Among other findings, we observed that 80% of them may have handled sensitive data without adequate protection, 70% of them uses weak cryptographic algorithms and 35% of them embeds data trackers. We also observed key developments in app privacy protection and security assurance initiatives. Our findings provide useful insights to the design and deployment of more secure and privacy preserving CT apps moving forward.