shanev / tracing-apps

A list of COVID-19 contact-tracing systems

COVID-19 Contact-Tracing Apps Tracker

Tracing apps are proliferating; this repo is trying to keep track of them, with an eye on privacy implications.

Contact-Tracing App Projects

• CoEpi | Community Epidemiology In Action

  Status: In development

  Technical synopsis

  The CoEpi app uses Bluetooth to record an anonymized list of close-proximity Interactions with other users.

  • In an Interaction, apps exchange temporary Contact-Event-Numbers (CEN). The other user's CEN is stored along with a timestamp for when the interaction occurred. Temporary CENs are deterministically generated from a cryptographic Key, which is private by default.
  • User can choose to upload their Key, along with symptoms, to a public database
  • The app downloads Keys and their associated Symptoms from the public database and searches local Interactions records to determine if any of the User's interactions were with symptomatic users
  • No location data is captured

• Private Kit: Safe Paths

  Status: Apps are live, backends and agency integrations in development

  Technical synopsis

  The Safe Paths app saves the user's GPS location data to a local encrypted store.

  • When a user tests positive, they can choose to give their location records to a health professional, who then manually redacts personally-identifiable information and publishes the redacted data to a public database.

  • The app downloads location data of infected cases from the public database to search against locally-stored location history

  • Privacy questions:

    • Does Safe Paths have requirements for organizations/agencies/governments that it is integrating with? If so, how are the entities audited against those requirements?
    • How does the manual redaction process work?

• TraceTogether (Singapore)

  By using time-varying tokens, the app does keep the users private from each other. A user has no way of knowing who the tokens stored in their app belong to, except by linking them to the time the token was received. However, the app provides little to no privacy for infected individuals; after an infected individual is compelled to release their data, the Singaporean government can build a list of all the other people they have been in contact with. (https://arxiv.org/abs/2003.11511)

  Open source version announced 2020/03/25: https://www.cnbc.com/2020/03/25/coronavirus-singapore-to-make-contact-tracing-tech-open-source.html

• covidnearyou.org

  Status: Live, ~2000 reported symptoms/test-results

  Self-reported symptoms/test-results aggregated by zipcode

Need more info:

• Hamagen: Israel's Ministry of Health's COVID-19 exposure prevention app
• enigmampc/SafeTrace
• corona-trace
• github.com/memiah/contact-tracer
• https://stopcorona.me/
• crowdcovid.com: github.com/olieidel/corona-tracker
• Corona Kavach: India Govt's tracing app
  • Corona Kavach on Google Play
• coronamadrid.com
  • newtral.es privacy FAQ
• ...and lots more — you can help track the tracers by making a PR for one that's missing, or adding info to any of the above.

Research, Analysis, and Design proposals

• Anonymous Retrospective Broadcasts (Henry de Valence)
• Contact Tracing Mobile Apps for COVID-19: Privacy Considerations and Related Trade-offs (Hyunghoon Cho, Daphne Ippolito, Yun William Yu)

Related resources

• Privacy International: Tracking the Global Response to COVID-19
• Electronic Frontier Foundation: COVID-19 and Digital Rights
• Top10VPN COVID-19 Digital Rights Tracker
• https://www.digitalvaccine.net/

Are you developing a Tracing App?

Please PR an overview of your system into this repo!

Meta

We're pondering the clearest way to present the above information, and how to aggregate and present community concerns and discussion about the individual projects.

I want to contribute to covid-apps-tracker

Great! It's easy:

1. Agree with our Code of Conduct
2. Post an Issue or PR to this repository