A Security and Privacy Scoring System for Contact Tracing Apps

Abstract

Contact tracing applications have flooded the marketplace, as governments worldwide have been working to release apps for their citizens. These apps use a variety of protocols to perform contact tracing, resulting in widely differing security and privacy assurances. Governments and users have been left without a standard metric to weigh these protocols and compare their assurances to know which are more private and secure. Although there are many ways to approach a quantitative metric for privacy and security, one natural way is to draw on the methodology used by the well-known common vulnerability scoring system (CVSS). For privacy, we applied consensus principles for contract tracing as a basis for comparing their relative privacy practices. For security, we performed attack modeling to develop a rubric to compare the security of respective apps. Our analysis shows that centralized Bluetooth with added location functionality has low privacy and security, while non-streaming GPS scored high in security and medium in privacy. Based on our methodology, only two apps were given a high ranking of privacy: Canada’s Covid Alert and Germany’s Corona Warn-App. They both used the Google/Apple Notification Framework as the basis for their design. To achieve comparable privacy, we recommend that future projects follow their examples in the following ways: minimizing the amount of data they collect and holding it for the shortest possible length of time; only having features necessary for the app’s main function; and releasing design details so that users can make informed decisions.

Governing digital crisis responses: platform standards and the dilemma of COVID-19 contact tracing

“…By supplying the technological foundation for DCT apps as a boundary resource, the platform owners enabled DCT for public health authorities while gaining control over DCT and minimizing the risk of adverse consequences for their ecosystems. On the one hand, it can be argued that Google and Apple have quickly resolved the standards war within Europe through their intervention and thus enabled a fast and privacy-preserving digital response to the pandemic (Krehling and Essex 2021). On the other hand, as argued in the introduction of this study, the consequences of such "platform owner-based" (Marhold and Fell 2021, p. 367) standardizations in the context of an international crisis need to be critically examined.…”

“…The French app is not interoperable with any of the other European apps (European Commission 2021). In contrast to France, the German app managed to reach high user numbers sooner (Rowe et al 2020) and is furthermore considered to be highly privacy-preserving, as initial studies suggest (e.g., Krehling and Essex 2021). While France failed to provide users with adequate information concerning the privacy and security of their app (Rowe et al 2020), Germany's app and its adoption rates seemed to profit from the close exchange with privacy and security experts:…”

“…4 The multi-layered decision situation of DCT. Own illustration based on Selander et al (2010) might be less effective due to the lack of available user data (Albergotti and Harwell 2020), yet privacy experts publicly welcomed the approach taken by Google and Apple (Sharon 2020;Krehling and Essex 2021). If we now consider that the primary drawback of the GAEN protocol can be mitigated to some extent by voluntary data donations, then it seems reasonable to argue that decentralized approaches such as the GAEN balance the paradoxical tensions of the DCT dilemma in a more effective manner.…”

“…However, it should not be ignored that although it would have been of crucial importance to build trust with users, especially when using a centralized design, France failed to educate their citizens about the privacy and security of its app (Rowe et al 2020). In contrast, Germany invited privacy experts (e.g., Chaos Computer Club) to review its app and leveraged an open source approach (Krehling and Essex 2021), potentially contributing to citizens' trust and acceptance. Adopting what the public perceives as the inferior approach in terms of privacy in favor of public health further carries the risk of being misused as a precedent by future governmental authorities to soften privacy laws under the pretext of crises threats (Urbaczewski and Lee 2020; Rowe 2020).…”

“…Fourth, a security and privacy analysis in relation to centralized and decentralized approaches is beyond the scope of this study. Therefore, we would like to direct readers to Krehling and Essex (2021). Fifth, since we focus on Europe, we only address the voluntary adoption of DCT apps.…”