# A Security and Privacy Scoring System for Contact Tracing Apps
## 3 Results
### Privacy Review  
The five apps were reviewed for privacy based on the information made available through released documentation. Table 3 shows the breakdown of whether each of the five apps met, did not meet, or partially met each principle, based on the requirements for each criterion we laid out in Table 1. Then, they were placed in initial rankings as explained in the following analysis. **Canada's Covid Alert** released information to users in the form of clear privacy statements, reviews, source-code and FAQs [26, 31]. All of the principles are addressed, though they were not all met. It was built using the GAEN API, and the Office of the Privacy Commissioner of Canada performed a privacy assessment [32]. The server is located within the country; however, the data ownership is unknown. It collects very little data about the user and does not ask for identities or identifying information. For the sunset requirement, there is no defined time. It is stated to be when a health authority declares the pandemic over [32]. The Covid Alert was grouped as High. **France's TousAntiCovid** is Bluetooth and based on their ROBERT protocol [29]. Though they released the source code for the entire system, there is no mention of a review performed before the release of the app [33]. The governance principle is not met, and it is unclear what personal information the app requests from the user to determine if they minimized data. The server's location is unknown, and there are no assurances of data access limitations or oversight. Data are encrypted on the device; however, it is unknown if they are transmitted securely. The app claims to meet the relevant country privacy laws without specifying how it meets each law or which laws are considered relevant. A privacy \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline
**Country** & **App** & **Price** & **Price** & **Price** & **Price** & **Price** & **Price** & **Price** & **Price** & **Price** & **Price** \\ \hline CAN & Covid Alert & & & & & & & & & & & & \\ FRA & TousAntiCovid & & & & & & & & & & & & \\ ISL & Rakning C-19 & & & & & & & & & & & & \\ IND & Aarogya Setu & & & & & & & & & & & & \\ SGP & TraceTogether & & & & & & & & & & & & \\ \hline \hline \end{tabular} \(\bullet\) = met, \(\blacktriangledown\)- partially met, \(\mathcal{O}\) = not met  
\end{table} 
Table 3: Contact tracing application’s privacy principle breakdown of representative apps. policy available online was not found. For the sunset requirement, there was no defined time limit. It is stated to be when a health authority declares the pandemic over [34]. Since it partially meets more principles than it completely meets, TousAntiCovid was grouped as Medium. **Iceland's Raking C-19** meets quite a few of the principles and does not meet three of them. A consideration made in the review is that GPS data are highly personal information, and removing someone's identity from them is difficult. The source code for the app is available but not the server side, and there was no mention of a review performed before the release of the app [30]. They state that the GPS data are held for 14 days and that they collect the user's phone number [27]. A national ID number is requested if a positive test result is input. No information was found about how they treat meta-data or what plans there are to sunset the app. Raking C-19 was given a Low/Medium ranking, meaning either the Low or Medium group would be accepted when the thresholds are determined. **India's Aarogya Setu** only met three of the principles. This app is a Bluetooth system, but it also takes some location data from the user and displays that to other users, showing them how many at-risk people they were near [35]. The system does not ask for additional consent to upload information. Once the app is downloaded, if a user tests positive, their account on the server is flagged, and the next time their device connects to the server, it uploads the information requested [28].