# Contact Tracing: Ensuring Privacy and Security
## 5 Framework Evaluation
For CoronaMelder, source code is accessible from [[https://github.com/minvws/nl-covid19-notification-app-ios](https://github.com/minvws/nl-covid19-notification-app-ios)]([https://github.com/minvws/nl-covid19-notification-app-ios](https://github.com/minvws/nl-covid19-notification-app-ios)) accessed on 22 September 2021 and [[https://github.com/minvws/nl-covid19-notification-app-android](https://github.com/minvws/nl-covid19-notification-app-android)]([https://github.com/minvws/nl-covid19-notification-app-android](https://github.com/minvws/nl-covid19-notification-app-android)) accessed on 22 September 2021. For CoronaWarn App, it is accessible via [[https://github.com/corona-warm-app/cwa-app-ios](https://github.com/corona-warm-app/cwa-app-ios)]([https://github.com/corona-warm-app/cwa-app-ios](https://github.com/corona-warm-app/cwa-app-ios)) accessed on 22 September 2021 and [[https://github.com/corona-warm-app/cwa-app-android](https://github.com/corona-warm-app/cwa-app-android)]([https://github.com/corona-warm-app/cwa-app-android](https://github.com/corona-warm-app/cwa-app-android)) accessed on 22 September 2021. For SwissCovid, one can view the source code from [[https://github.com/DP-3T/dp3t-app-ios-ch](https://github.com/DP-3T/dp3t-app-ios-ch)]([https://github.com/DP-3T/dp3t-app-ios-ch](https://github.com/DP-3T/dp3t-app-ios-ch)) accessed on 22 September 2021 and [[https://github.com/DP-3T/dp3t-app-android-ch](https://github.com/DP-3T/dp3t-app-android-ch)]([https://github.com/DP-3T/dp3t-app-android-ch](https://github.com/DP-3T/dp3t-app-android-ch)) accessed on 22 September 2021. Does the downloadable app match the source code published? Even though the software designers publish the source code online, that does not mean it matches the version of the app that is available for download in the App Store and Play Store. For instance, at the time of writing, the version of CoronaMelder at GitHub is 1.0.12, while the version on our phone is 1.0.11. Thus, how can one verify the app indeed matches the one published on GitHub? The Dutch and German App developers use an external security organisation to verify this is indeed the case [27]. Generally, this criterion is therefore valid and solvable, with a proper implementation. Can GAEN API be reviewed? Neither Apple nor Google released the full, implemented source code of their APIs. Google did publish a \"reference design\" on GitHub ([[https://github.com/google/exposure-notifications-android](https://github.com/google/exposure-notifications-android)]([https://github.com/google/exposure-notifications-android](https://github.com/google/exposure-notifications-android)) accessed on 22 September 2021, [[https://developer.apple.com/exposure-notification/](https://developer.apple.com/exposure-notification/)]([https://developer.apple.com/exposure-notification/](https://developer.apple.com/exposure-notification/)) accessed on 22 September 2021). The objective of both releases is not to allow external parties to review the code and participate in finding flaws, but to give developers an idea of how the internals of the GAEN API work. This problem is quite apparent in the literature. Many authors point out the inability to review the design choices, security and privacy of the GAEN-API [9; 27; 29]. The question is if there are other possibilities to review the source code. An external party could be contracted to review the code, on behalf of the health authorities. Are replay attacks possible? Given a decentralised design, the work in [19] proved that a relay-based worm-hole attack is possible, generating false contact on a target's device. They performed their experiment in reaction to the SwissCovid app. The Swiss NCSC (2020) The attack is confirmed by the work in [9; 26; 28; 32]. An important realisation of all these articles is that the authors replayed the RPI, not the TEK. This proves that, at least in decentralised designs, replay attacks remain possible and real danger.