# A Security and Privacy Scoring System for Contact Tracing Apps
## 4 Discussion and Conclusions  
Contact tracing has entered into the public consciousness due to the circumstances of a pandemic. Though it will slowly fade out of the public eye, such as disinfection procedures and personal protective equipment, contact tracing is a tool of modern medicine. In future viral outbreaks, contact tracing will be used to prevent a pandemic, and whether it is used in a town, entire country, or globally, it needs to be private and secure. In this paper, we have created an objective metric of how secure and private contact tracing apps are when compared to each other. From the results of this study, the Canadian Covid Alert app and the German Corona-Warn-App were the only apps to be placed in the ranking of high for privacy. The reason for their high ranking is summarized in a few commonalities found in the choices their design teams made, listed here. * **GAEN framework**: both apps use the Google Apple Exposure Notification Framework, which uses decentralized Bluetooth as the base of their design. * **Minimalism**: although the German app does allow the user to scan a QR code they were given to see the results of a COVID-19 test, both apps otherwise contain no added functionality, collect almost no information about the user, and any data they do hold or send are deleted within 14 days. * **Transparency**: both released the source code for their apps, and Canada also sought out experts to perform a review prior to release. Both have comprehensive privacy statements and policies that clarify all the relevant information. Although our rubric identifies the GAEN framework to be a privacy boon, it is imperfect. It encourages open-source app and server code by providing open-source templates; however, the code of the framework itself is closed. This code is at the OS level, which most companies do not release to the public. The Bluetooth and cryptography specifications [41] are available, but anyone wishing to compare specification to the code cannot do so without Google and Apple's invitation. This leaves users trusting that these companies are acting according to their official statements, and are not collecting or storing data. While code is one way to prevent data leakage, data governance and policy play their part as well and this is considered in the privacy rubric. The app with the best security of the five was the Icelandic Rakning C-19. The reason for this is that the GPS logging system requires no communication between devices. The only time the app communicates with anything external is when sending the GPS data to the contact tracer, leaving few attack vectors. At the same time, the amount of human \begin{table}
\begin{tabular}{c c} \hline \hline
**Ranking** & **Highest Severity of a Vulnerability** \\ \hline
**High** & 0-39 \\ \hline
**Medium** & 4-7.9 \\
**Low** & 8-10 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Contact tracing application security scoring ranges. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Ranking** & **Privacy Score** & **Vulnerability Score** \\ \hline Covid Alert & 8.5 & 7.313 \\ TousAntiCovid & 5.5 & 7.063 \\ Rakning C-19 & 6.5 & 1 \\ Aarogya Setu & 4 & 8.475 \\ TraceTogether & 5.5 & 7.375 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Security and privacy scores of the 5 representative contact tracing applications. intervention required to analyze the GPS data and verify a positive case makes it the least automated of the systems. Therefore, it is the least viable for larger countries to implement. This paper is the first to create an assessment method for the security and privacy of digital contact tracing applications. Other research focused on the security of single apps [1, 13, 14], or performed a review of the security or privacy without creating a metric of comparison [42, 43]. That work can highlight security risks in apps. However, a comparison of the apps can provide actionable information to the people expected to use or develop these apps.