Countries around the world have released mobile apps to help track the spread of the coronavirus, with the apps typically generating considerable concern about the data they capture, and the privacy risks they pose for users.

Research from the University of Illinois at Urbana-Champaign saw 50 Covid-19 related apps analyzed to understand the access to personal data they secure, and the privacy protections they have in place to protect that data.

The analysis reveals that the majority of apps access the personal data of their user, with very few of them stating clearly that this data would be encrypted, anonymized and secured.

“What is disconcerting is that these apps are continuously collecting and processing highly sensitive and personally identifiable information, such as health information, location and direct identifiers (e.g., name, age, email address and voter/national identification),” the researchers explain. “Governments’ use of such tracking technology – and the possibilities for how they might use it after the pandemic – is chilling to many. Notably, surveillance mapping through apps will allow governments to identify people’s travel paths and their entire social networks.”

Track and trace

The functionality of the apps is significant, with features such as live maps of confirmed cases, systems for monitoring home quarantine, location-based alerts, and direct reporting of symptoms to the government commonplace.  Some apps also provide remote monitoring of vital signs, and tele-consultations.

Of the 50 apps assessed by the researchers, 30 required permission from the user to access data from their phone, such as our photos, location data, contact list, call information, network access, and Google service configuration.  Some of the apps also collect the age, email address, location, phone number, mobile IP address and operating system, and the browsers installed on the device.

Just 16 of the apps clearly state that this data will be anonymous, encrypted and reported only in aggregate form.  The analysis found that 20 of the apps were issued by official sources, which usually means either health ministries or the government.

Despite the clear privacy concerns, the researchers confess that such apps may nonetheless be crucial if the spread of the virus is to be curtailed.

“Health care providers must absolutely use whatever means are available to save lives and confine the spread of the virus,” they conclude. “But it is up to the rest, especially those in the field of information privacy and security, to ask the questions needed to protect the right to privacy.”