COVID-19 One Year on – Security and Privacy Review of Contact Tracing Mobile Apps
Vincent Ang, Lwin Khin Shar · IEEE Pervasive Computing · 2021
The ongoing Coronavirus Disease 2019 (COVID-19) pandemic has caused 3.8 million deaths since December 2019. At the current vaccination pace, this global pandemic could persist for several years. Throughout the world, contact tracing (CT) apps were developed, which play a significant role in mitigating the spread of COVID-19. This work examines the current state of security and privacy landscape of mobile CT apps. Our work is the first attempt, to our knowledge, which provides a comprehensive analysis of 70 CT apps used worldwide as of the year Q1 2021. Among other findings, we observed that 80% of them may have handled sensitive data without adequate protection, 70% of them used weak cryptographic algorithms, and 35% of them embedded data trackers. We also observed key developments in app privacy protection and security assurance initiatives. Our findings provide useful insights into the design and deployment of more secure and privacy-preserving CT apps moving forward.