Contact Tracing Apps in the COVID-19 Pandemic: Exploring the Underlying Personal Data Processing

Introduction

The year 2020 has been marked by an unexpected pandemic throughout the world. The new coronavirus, known as COVID-19, is spreading out without facing any borders, constituting a global pandemic, as WHO (World Health Organisation) declared on March 11th, 2020. Under this new humanitarian crisis, governments put much effort on employing appropriate technologies to help striking the virus dissemination (Nabben et al 2020). In this framework, a technology that has been adopted by several countries throughout the world is the so-called contact tracing applications. The main motivation under such smart apps is to ensure an automatic detection of the contacts of an infected individual, thus allowing the competent health authorities to trace the chain of infection and proceed with appropriate actions.

There are several different approaches that can be followed in developing such smarts apps. A main classification rests with the fact of their centralized nature – i.e. some of them are centralized, in the sense that non-permanent identifiers of all smart devices in proximity to the user are stored and further processed on a centralized server operated by the public health authorities, whereas other apps have a de-centralized flavor, since the non-permanent identifiers of all devices in contact are stored and further processed on the user’s device. However, the distinction between the two classes is becoming less and less obvious, since a backend server is actually always present. Another way to classify the contact tracing apps is based on the underlying technology that is being used to find devices in proximity, since there are two main approaches: a Bluetooth-based (i.e. Bluetooth Low Energy – BLE) and a location-based approach.

A major concern that arises in the use of such contact tracing apps is the users’ privacy. This is actually an issue spanning the whole mobile ecosystem for any application, since there exist well-known privacy threats that are related with the lack of transparency (i.e. the users do not have adequate information on which of their personal data are being processed and for what purposes), as well as with the overall permission model of the smart applications (i.e. users are often “forced” to allow permissions to the smart apps even if the necessity of such permissions is questionable, whereas the provision of such a permission actually allows access not only to the smart app provider but also possibly to third-party trackers). All these well-known privacy issues are clearly further accentuated in the context of contact tracing, since they process sensitive health data. Without careful consideration, tracking contacts may become highly intrusive in terms of privacy, thus resulting in high risks for the rights and freedoms of individuals.

In this chapter, an extensive study on the currently most known Android contact tracing apps throughout the world is presented, in terms of their privacy features. The study will be based mainly on examining these apps into a real-time operation, through appropriate software tools that allow for their dynamic analysis, with the aim to determine what these applications do in real time. The outcome of the analysis indicates several discrepancies amongst the solutions adopted by several countries, which actually reflect somehow the corresponding legal framework that is applicable each time. However, even in countries with a unified legal framework, different applications with different characteristics are being employed, with different levels of privacy protection. A main threat that is present in some of them is the use of third party trackers without being transparent to the users, whereas some apps require specific permissions to operate smoothly whose necessity is not justified or clear. Bearing in mind that citizens’ trust is essential to ensure the effectiveness of such apps, whereas personal data protection is indispensable to build trust, it becomes evident that respecting the individuals’ privacy is of utmost importance; to this end, a discussion on how the possible privacy issues could be alleviated is also given.

It should be pointed out that this chapter does not aim to evaluate the effectiveness of apps in terms of addressing the virus dissemination; in the same framework, practical issues such as their usability are out of our scope. Hence, this chapter should not be considered as a comparative study of the contact tracing apps. Our ultimate goal is to examine their privacy features, regardless their type and their underlying technologies, taking into account known privacy issues that span the entire mobile ecosystem.