Report on the Privacy Risks of COVID-19 Software
Report on the privacy risks of COVID-19 software December 2020 This report was commissioned by AWO and undertaken by external technical consultants. 2 Executive Summary This report provides a technical analysis of seven smartphone applications deployed in six countries (Brazil, Colombia, India, Iran, Lebanon, and South Africa) to be used by citizens as part of their country’s national response strategy to fight the COVID-19 pandemic. All are official apps, in the sense that they have been developed by (or with the approval of) competent organizational units in their respective governments, including health authorities. The focus of this technical analysis is on the potential privacy risks of using such apps for citizens. Specifically, the report provides an assessment of the following elements: (i) the architecture used for contact tracing, if any; (ii) the presence of elements that can impact on users’ privacy negatively (use of dangerous permissions, presence of software development kits (SDKs), potential dissemination of personal data, and consistency of observed behaviors and statements of the privacy policy); and (iii) components and design choices that can affect the security of the app, such as the presence of potentially harmful behaviors oran incorrect use of hosting and communication capabilities. The main findings of this report are: • All the examined apps implement a functionality for contact tracing / exposure notification. Two of them—Coronavirus SUS (Brazil) and COVID Alert SA (South Africa)—rely on the Google-Apple Exposure Notification (GAEN) API, which enforces some privacy guarantees. The remaining apps use centralized approaches that are potentially more privacy harmful, including custom implementations—Aarogya Setu (India), COVA (India), and Mask (Iran)—or based on Singapore’s BlueTrace technology—CoronaApp (Colombia) and MA3AN (Lebanon).
[Show full text]