Hatamian Majid, Wairimu Samuel, Momen Nurul, Fritsch Lothar
Department of Computer and Information Sciences, Northumbria University, Newcastle upon Tyne, UK.
Department of Mathematics and Computer Science, Karlstad University, Karlstad, Sweden.
Empir Softw Eng. 2021;26(3):36. doi: 10.1007/s10664-020-09934-4. Epub 2021 Mar 19.
As this article is being drafted, the SARS-CoV-2/COVID-19 pandemic is causing harm and disruption across the world. Many countries aimed at supporting their contact tracers with the use of digital contact tracing apps in order to manage and control the spread of the virus. Their idea is the automatic registration of meetings between smartphone owners for the quicker processing of infection chains. To date, there are many contact tracing apps that have already been launched and used in 2020. There has been a lot of speculations about the privacy and security aspects of these apps and their potential violation of data protection principles. Therefore, the developers of these apps are constantly criticized because of undermining users' privacy, neglecting essential privacy and security requirements, and developing apps under time pressure without considering privacy- and security-by-design. In this study, we analyze the privacy and security performance of 28 contact tracing apps available on Android platform from various perspectives, including their code's privileges, promises made in their privacy policies, and static and dynamic performances. Our methodology is based on the collection of various types of data concerning these 28 apps, namely permission requests, privacy policy texts, run-time resource accesses, and existing security vulnerabilities. Based on the analysis of these data, we quantify and assess the impact of these apps on users' privacy. We aimed at providing a quick and systematic inspection of the earliest contact tracing apps that have been deployed on multiple continents. Our findings have revealed that the developers of these apps need to take more cautionary steps to ensure code quality and to address security and privacy vulnerabilities. They should more consciously follow legal requirements with respect to apps' permission declarations, privacy principles, and privacy policy contents.
在撰写本文时，严重急性呼吸综合征冠状病毒2（SARS-CoV-2）/冠状病毒病2019（COVID-19）大流行正在全球造成危害和破坏。许多国家旨在通过使用数字接触者追踪应用程序来支持其接触者追踪人员，以管理和控制病毒的传播。他们的想法是自动记录智能手机用户之间的会面，以便更快地处理感染链。截至2020年，已经推出并使用了许多接触者追踪应用程序。关于这些应用程序的隐私和安全方面以及它们可能违反数据保护原则的情况，有很多猜测。因此，这些应用程序的开发者不断受到批评，因为他们破坏了用户隐私，忽视了基本的隐私和安全要求，并且在时间压力下开发应用程序而没有考虑设计时的隐私和安全性。在本研究中，我们从多个角度分析了安卓平台上28款接触者追踪应用程序的隐私和安全性能，包括它们代码的权限、隐私政策中做出的承诺以及静态和动态性能。我们的方法基于收集与这28款应用程序相关的各种类型的数据，即权限请求、隐私政策文本、运行时资源访问以及现有的安全漏洞。基于对这些数据的分析，我们量化并评估了这些应用程序对用户隐私的影响。我们旨在对已在多个大洲部署的最早的接触者追踪应用程序进行快速而系统的检查。我们的研究结果表明，这些应用程序的开发者需要采取更多谨慎措施来确保代码质量，并解决安全和隐私漏洞。他们应该更自觉地遵守关于应用程序权限声明、隐私原则和隐私政策内容的法律要求。
