Government agencies and private organizations that are developing contact-tracing applications to help citizens keep informed about their potential risk of infection have failed to provide adequate protections against compromise and hacking, mobile-application security firm Guardsquare stated in a report published on Thursday.
The company analyzed 17 Android applications, looking for six different types of security countermeasures that the company deems necessary to protect user privacy and prevent the data collected by the contact app from being used for unforeseen purposes. Only one of the applications included full encryption and obfuscation of sensitive data, according to the report.
Despite the need to quickly get contract-tracing capabilities into the hands of citizens, countries need to get privacy right, says Grant Goodes, chief scientist with Guardsquare.
"In the current day and age, with people's somewhat understandable mistrust of government, if you try to roll out something — for a legitimate purpose and a well-intentioned purpose — but you make a giant security mistake, as North Dakota's app did, you will destroy public trust," he says. "And you really only get one shot at these things."
Contact tracing is widely considered to be a necessary step for countries to take to continue to open up their economies while reducing the transmission of infectious diseases. Manual contact tracing — the only effective method in the past — requires a massive workforce. Before the epidemic, state, and local health departments employed fewer than 2,000 contact tracers, but anywhere between 100,000 and 300,000 may be necessary.
"Prompt identifi ..
Support the originator by clicking the read the rest link below.
