Covid-19 App Project
Assessment of Covid-19 Response in Brazil, Colombia, India, Iran, Lebanon and South Africa
The Covid App project is a civil society initiative that stemmed from a research interest in Covid-specific interventions in various countries outside across the globe. The project is divided into two phases (Phase 1 and Phase 2) and pays particular attention to Covid-19 tech interventions, notably contact tracing apps and immunity passports.
Phase 1 of the project drew together six civil society organisations: ALT Advisory (South Africa), Internet Democracy Project (India), InternetLAB (Brazil), Karisma (Colombia), SMEX (Lebanon), and United for Iran (Iran). AWO, a data rights agency, provided coordination support. Over a 7-month period, the group reviewed contact tracing apps and assessed their interaction with public health, human rights, privacy, and data protection in the six countries of focus. We conducted interviews, filed freedom of information requests, and extensively reviewed public documentation to produce in-depth country reports. Contact tracing apps cannot be evaluated in a vacuum: the research considers alternative measures, technological and others, that were deployed in response to the pandemic, and often interacted with the design and deployment of contact tracing apps themselves.
The report presents a consolidated version of the six in-depth country reports and identifies key insights and recommendations alongside an expert technical review of seven contact tracing apps from our countries of focus.
We hope this contribution will support the critical evaluation of contact tracing apps and other pandemic response measures. In addition, we hope to foster a discussion of safeguards – including recourse and oversight – that will better protect marginalised and vulnerable groups during public health crises, bolster human rights, democracy, and rule of law, and strengthen future pandemic response.
Report on the privacy risks of COVID-19 software
As part of the Covid App initiative, independent experts conducted a technical assessment of seven Covid-19 contact tracing apps which were deployed in our countries of focus (South Africa, India, Brazil, Colombia, Lebanon and Iran). The assessment focuses on technical characteristics and capabilities of these contract tracing apps in order to evaluate potential privacy risks for individuals. The three elements covered more specifically are the 1) architectures used for contract tracing, 2) the presence of elements that can impact users’ privacy negatively, including the use of dangerous permissions, presence of software development kits (SDKs), potential dissemination of personal data, and consistency of observed behaviors and statements of the privacy policy, and 3) components and design choices that can affect the security of the app, such as the presence of potentially harmful behaviors or an incorrect use of hosting and communication capabilities.
The findings of this review constitute a description of technical elements found in the apps and their potential impact on users’ privacy, supporting the broader research of the Covid app project.
We hope this contribution will support the critical evaluation of contact tracing apps and other pandemic response measures.