Public health professionals are rushing to create tracking apps in all countries around the world. They serve the important purpose of determining who might be exposed to the novel coronavirus in order to be tested and isolated. But the dangers were also clear. Tracking apps have the ability to collect personal data that reflects your movements, activities and relationships.

Potential harm resulting from tracking apps focused on Defcon, an annual hacking conference that takes place online. Two submissions focus on the privacy failure of contact tracking apps. The decision is clear: Apps tend to collect unwanted information.

This data-hungry mindset is not the way governments should be approached in tracking applications, said Eivind Arvesen, a Norwegian security researcher who presented at Defcon. Instead, they should ask themselves, "How little data can I get to try to solve this issue, and not the other way around?"

Arvesen introduced the now inactive Norwegian contact tracking app, which he helped review it as part of a government-sponsored third-party audit. Another presentation, will focus on permissions requested for contact tracking apps, as well as COVID-19 tracking apps and information apps.

Human contact tracers often hunt down the known contacts of a person who is being diagnosed with an infectious disease such as COVID-19. Applications seek to fill in the gaps of where an infected person has exposed a stranger. Since two strangers are standing next to each other, for example, apps record a contact in case one of them is tested in the following days. For apps to work, a high percentage of people have to use them.

As soon as public health agencies turn to applications to speed up the contact tracking process, privacy experts warn of the dangers. Governments should be open about their data, refrain from collecting unnecessary information, and plan to eliminate data collection and deletion when the epidemic passes. Universities, including MIT, and tech companies, such as Apple and Google, are jumping on the door to create privacy-sensitive software that governments can use in their applications.

Norway Contact Tracing App

Arvesen said the Norwegian app collected local and one-time data, a consistent identification code for users, and created a permanent and complete record of their movements that would be stored in the middle of the server. That may sound good to contact tracers, but privacy experts say that collecting location data is unnecessary and should be avoided. It doesn't matter if the two people were there when they met. All that matters is that they met.

And you do not have to provide one user with a single, fixed identifier. Some applications have found ways to avoid this, some protocols change user identifiers several times per minute. This method makes it very difficult for a person to misuse data, using it to track the movements of one person while using the application.

Finally, some applications store data locally on a user's phone and access it only if that person finds it healthy and agrees to share the data.

While Arvesen and his fellow reviewers were preparing a report on the Norwegian app, local data protection regulators also expressed concern. After that, the country shut down the app.

Applications worldwide take location data

Arvesen said he found that the app was worse for privacy than other contact tracking apps in Europe. But data-hungry applications exist elsewhere in the world. The creators of the COVID-19 App Tracker, which presented their findings, automatically tested 136 applications from around the world and found that most of them were asking for permissions they did not need.

In the scanned applications, three quarters requested location data, said Megan DeBlois, a partner on the website. Some apps simply help users keep track of their symptoms, and they have no reason to request location data.

DeBlois has teamed up with his brother and their partners to create an app tracker, and they are all volunteers. The purpose of the project is to capture information about the entire COVID government app in the Google Play store and make it publicly available.

Permissions are only part of the image. To better understand how an app behaves, researchers need to look at the data it sends and discover when it is being used. Security inspectors like Arvesen can do that on behalf of the government.

DeBlois said she would like to see more clarity about the data used in tracking apps. Ideally, governments can make this code an open source, making it easier for privacy investigators to analyze and raise any issues for the general public.

 One of the possible reasons why governments have not done this is because of the speed with which they have implemented programs. The rush would have prompted governments to set aside security updates that would have been possible before the software was used by users. An open source code will then make it easier for bad actors to look for obvious flaws and exploit them.

Without a review, DeBlois and Arvesen both said, users could not trust the government to take only the data it needs, and keep it safe.

"We want people to look at the code," DeBlois said. "You can verify it with code, and build trust."