{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,9,26]],"date-time":"2025-09-26T08:18:49Z","timestamp":1758874729431},"reference-count":24,"publisher":"Springer Science and Business Media LLC","issue":"4","license":[{"start":{"date-parts":[[2023,8,1]],"date-time":"2023-08-01T00:00:00Z","timestamp":1690848000000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2023,9,5]],"date-time":"2023-09-05T00:00:00Z","timestamp":1693872000000},"content-version":"vor","delay-in-days":35,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"University of Dublin, Trinity College"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Mobile Netw Appl"],"published-print":{"date-parts":[[2023,8]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>We describe the data transmitted to backend servers by the contact tracing apps now deployed in France (TousAntiCovid), Australia (CovidSafe), Singapore (TraceTogether), US\/Florida (CombatCovid), Israel (HaMagen), India (Aarogya Setu) with the aim of evaluating the privacy of these contact tracing apps as actually deployed. To the best of our knowledge, the measurements we present are the first public data of this sort for the French, Australian, Israeli, Indian and Florida apps. We find that TousAntiCovid and CovidSafe are generally well-behaved with regard to privacy. TraceTogether and CombatCovid make extensive use of Google Firebase services which means that that there are two main parties involved in handling data transmitted from these apsp, namely Google and the health authority operating the app itself. HaMagen is well-behaved for uninfected users of the app but GPS location data associated with infected is publicly published on the HaMagen server. Aarogya Setu, with &gt;160M users, is found to have a number of serious privacy issues, including silent upload of logged location data.<\/jats:p>","DOI":"10.1007\/s11036-023-02136-4","type":"journal-article","created":{"date-parts":[[2023,9,5]],"date-time":"2023-09-05T08:01:47Z","timestamp":1693900907000},"page":"1460-1472","update-policy":"http:\/\/dx.doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Contact Tracing App Privacy: What Data is Shared by Non-GAEN Contact Tracing Apps"],"prefix":"10.1007","volume":"28","author":[{"given":"Douglas J.","family":"Leith","sequence":"first","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2023,9,5]]},"reference":[{"key":"2136_CR1","unstructured":"TousAntiCovid App (Accessed 15 Dec, 2020). www.bonjour.tousanticovid.gouv.fr"},{"key":"2136_CR2","unstructured":"CovidSafe App (Accessed 15 Dec, 2020). www.covidsafe.gov.au"},{"key":"2136_CR3","unstructured":"TraceTogether App (Accessed 15 Dec, 2020). www.tracetogether.gov.sg"},{"key":"2136_CR4","unstructured":"CombatCovid App (Accessed 15 Dec, 2020). www.combatcovidapp.com\/pbc\/"},{"key":"2136_CR5","unstructured":"HaMagen App (Accessed 15 Dec, 2020). www.govextra.gov.il\/ministry-of-health\/hamagen-app\/download-en\/"},{"key":"2136_CR6","unstructured":"Aarogya Setu App (Accessed 15 Dec, 2020). www.aarogyasetu.gov.in"},{"key":"2136_CR7","unstructured":"Exposure Notifications: Android API Documentation (accessed 6 June 2020). www.static.googleusercontent.com\/media\/www.google.com\/en\/www.covid19\/exposurenotifications\/pdfs\/Android-Exposure-Notification-API-documentation-v1.3.2.pdf"},{"key":"2136_CR8","doi-asserted-by":"crossref","unstructured":"Leith D, Farrell S (2021) GAEN Due Diligence: Verifying The Google\/Apple Covid Exposure Notification API Proc Corona Defcon21, NDSS","DOI":"10.14722\/coronadef.2021.23005"},{"key":"2136_CR9","unstructured":"Firebase Help: Automatically collected user properties (Accessed 26 April 2020). www.support.google.com\/firebase\/answer\/6317486"},{"key":"2136_CR10","unstructured":"Leith DJ, Farrell S (2021) A Measurement-Based Study of the Privacy of Europe\u2019s Covid-19 Contact Tracing Apps. In: Proc IEEE INFOCOM"},{"key":"2136_CR11","doi-asserted-by":"crossref","unstructured":"Dehaye P,Reardon J (2020) Dehaye P,Reardon J (2020) Proximity Tracing in an Ecosystem of Surveillance Capitalism. www.arxiv.org\/pdf\/2009.06077.pdf","DOI":"10.1145\/3411497.3420219"},{"key":"2136_CR12","unstructured":"Cuebiq Mobility Insights (Accessed 15 Dec, 2020). www.cuebiq.com\/visitation-insights-covid19\/"},{"key":"2136_CR13","unstructured":"Decentralised Privacy-Preserving Proximity Tracing (DP-3T) Documents (Accessed 26 April, 2020). www.github.com\/DP-3T\/documents"},{"key":"2136_CR14","unstructured":"ROBust and privacy-presERving proximity Tracing protocol (Accessed 17 Dec, 2020). www.github.com\/ROBERT-proximity-tracing\/documents"},{"key":"2136_CR15","unstructured":"BlueTrace: A privacy\u2013preserving protocol for community\u2013driven contact tracing across borders (9 April, 2020). www.bluetrace.io\/static\/bluetrace_whitepaper-938063656596c104632def383eb33b3c.pdf"},{"key":"2136_CR16","doi-asserted-by":"crossref","unstructured":"Wen H, Zhao Q, Lin Z, DoXuan,Shrof N (2020) A Study of the Privacy of COVID-19 Contact Tracing Apps. In: Proc SECURECOMM","DOI":"10.1007\/978-3-030-63086-7_17"},{"key":"2136_CR17","doi-asserted-by":"crossref","unstructured":"Sun R, Wang W, Xue M, Tyson G, Camtepe S, Ranasinghe DC (2020) An Empirical Assessment of Global COVID-19Contact Tracing Applications. www.arxiv.org\/pdf\/2006.10933.pdf","DOI":"10.1109\/ICSE43902.2021.00101"},{"key":"2136_CR18","doi-asserted-by":"crossref","unstructured":"Leith D, Farrell S (2020) Coronavirus Contact Tracing App Privacy: What Data Is Shared By The Singapore OpenTrace App? In: Proc SECURECOMM","DOI":"10.1007\/978-3-030-63086-7_6"},{"issue":"05","key":"2136_CR19","doi-asserted-by":"publisher","first-page":"557","DOI":"10.1142\/S0218488502001648","volume":"10","author":"L Sweeney","year":"2002","unstructured":"Sweeney L (2002) k-anonymity: A model for protecting privacy. International Journal of Uncertainty. Fuzziness and Knowledge-Based System 10(05):557","journal-title":"Fuzziness and Knowledge-Based System"},{"issue":"1","key":"2136_CR20","doi-asserted-by":"publisher","first-page":"3","DOI":"10.1145\/1217299.1217302","volume":"1","author":"A Machanavajjhala","year":"2007","unstructured":"Machanavajjhala A, Kifer D, Gehrke J, Venkitasubramaniam M (2007) ACM Transactions on Knowledge Discovery from Data (TKDD) 1(1):3","journal-title":"ACM Transactions on Knowledge Discovery from Data (TKDD)"},{"key":"2136_CR21","doi-asserted-by":"crossref","unstructured":"Golle P, Partridge K (2009) On the Anonymity of Home\/Work Location Pairs Pervasive Computing","DOI":"10.1007\/978-3-642-01516-8_26"},{"key":"2136_CR22","doi-asserted-by":"crossref","unstructured":"Srivatsa M, Hicks M (2012) Deanonymizing mobility traces: Using social network as a side-channel. In: Proc CCS. pp. 628\u2013637","DOI":"10.1145\/2382196.2382262"},{"key":"2136_CR23","unstructured":"Cortesi A, Hils M, Kriechbaumer T, contributors (2020) mitmproxy: A free and open source interactive HTTPS proxy (v5.01). www.mitmproxy.org"},{"key":"2136_CR24","unstructured":"Frida: Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers (Accessed 26 April 2020). www.frida.re"}],"container-title":["Mobile Networks and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11036-023-02136-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11036-023-02136-4\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11036-023-02136-4.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,8,19]],"date-time":"2024-08-19T17:09:05Z","timestamp":1724087345000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11036-023-02136-4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,8]]},"references-count":24,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2023,8]]}},"alternative-id":["2136"],"URL":"https:\/\/doi.org\/10.1007\/s11036-023-02136-4","relation":{},"ISSN":["1383-469X","1572-8153"],"issn-type":[{"type":"print","value":"1383-469X"},{"type":"electronic","value":"1572-8153"}],"subject":[],"published":{"date-parts":[[2023,8]]},"assertion":[{"value":"13 May 2021","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"5 September 2023","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}