1 00:00:02,850 --> 00:00:10,060 Hello, and thank you for this opportunity to speak at the Crypto Village at DEF CON this year. 2 00:00:10,060 --> 00:00:19,240 My name is Megan DeBlois, and I'm going to be talking to you today about some of the privacy problems with COVID-19 apps that have been emerging across the globe. 3 00:00:19,240 --> 00:00:23,640 Our session is called, Who Needs Spyware When You Have COVID-19 Apps? 4 00:00:23,640 --> 00:00:25,440 A few caveats. 5 00:00:25,440 --> 00:00:29,200 We truly aren't saying all COVID-19 apps are spyware. 6 00:00:29,200 --> 00:00:38,020 We're trying to allude or describe the privacy problem that we feel very strongly and very passionate about as a group. 7 00:00:38,420 --> 00:00:39,980 A couple other caveats. 8 00:00:39,980 --> 00:00:42,600 We're not lawyers, and we're not professional researchers. 9 00:00:42,600 --> 00:00:44,080 We build things. 10 00:00:44,400 --> 00:00:57,240 We're a group of engineers and designers and project managers who really wanted to create something that could be useful to better understand the COVID-19 applications that have been popping up around the globe. 11 00:00:58,340 --> 00:01:01,940 So today, we're going to be just touching, scratching the surface. 12 00:01:01,980 --> 00:01:07,580 There's tons of information that we could get into. 13 00:01:07,840 --> 00:01:11,320 We really encourage others to check out our data set. 14 00:01:11,320 --> 00:01:13,760 It's an open data set that we've created. 15 00:01:14,220 --> 00:01:20,960 All of the data that we're going to be talking about today is really only updated since August 1st. 16 00:01:20,960 --> 00:01:25,180 And we know that things move and shift really quickly, but just keep that in mind. 17 00:01:25,180 --> 00:01:35,340 We're really only going to be looking at the graphs and the data between the beginning of the pandemic when we started collecting the data into August 1st, 2020. 18 00:01:36,220 --> 00:01:40,600 So today, we're going to be talking a little bit about the project, the people, the goals. 19 00:01:40,600 --> 00:01:44,240 We're going to jump down into sort of the problem. 20 00:01:44,240 --> 00:01:49,540 We have a few problems in the COVID-19 application space, as I'm sure many of you know. 21 00:01:49,760 --> 00:01:56,500 And we'll kind of touch base a little bit on the timeline, just remind ourselves sort of where we came from. 22 00:01:56,500 --> 00:02:05,960 And then we'll get into the ecosystem and really understand some of the trends that we've been able to deduce based on the data that we've been able to collect. 23 00:02:06,240 --> 00:02:09,820 And then we'll kind of end with some opportunities that we see. 24 00:02:10,560 --> 00:02:13,460 Our team, as I mentioned, my name is Megan DeBlois. 25 00:02:13,500 --> 00:02:17,140 I'm the volunteer product manager for this particular project. 26 00:02:17,720 --> 00:02:30,600 We are a completely volunteer-based team with Carlos Micas-Nadal, who's our back-end engineer, Zach Anderson, our front-end engineer, as well as Justin DeBlois, our UX designer. 27 00:02:30,720 --> 00:02:36,660 If you want to learn more about our team, please check it out at our website, covid19apptracker.org. 28 00:02:36,660 --> 00:02:40,720 And you can find a lot more information about us there. 29 00:02:40,780 --> 00:02:45,420 Get in touch at info at covid19apptracker.org. 30 00:02:45,420 --> 00:02:48,140 All right, so let's jump into the project. 31 00:02:48,600 --> 00:02:57,750 This particular project started back around March at the beginning of the pandemic when we first really saw a lot of applications popping up. 32 00:02:58,440 --> 00:03:10,820 Between then and August 1st, we have been able to detect around 120 applications related to COVID-19 around the world. 33 00:03:10,820 --> 00:03:15,980 Again, that number is last updated on August 1st, so we have a few more since then. 34 00:03:16,340 --> 00:03:25,600 But the main categories of COVID-19 applications that we are detecting here are contact tracing, of course. 35 00:03:25,600 --> 00:03:28,020 That's been a hot topic as of late. 36 00:03:28,020 --> 00:03:33,840 But we're also looking at symptom tracking applications and informational applications. 37 00:03:33,980 --> 00:03:44,160 Just quickly, to make sure folks understand where the data is coming from and how this works, we have a few different components of the application. 38 00:03:44,280 --> 00:03:53,460 We have a detection engine, and this is really something that we prioritize in this project is automated detection of the applications that are popping up on the Google Play Store. 39 00:03:53,820 --> 00:03:58,860 We really wanted to ensure that there was also a clean front end and we created an open data set. 40 00:03:58,860 --> 00:04:08,440 Those were sort of design decisions that we made at the very beginning to ensure that the data in the project would be potentially useful for researchers and others. 41 00:04:08,440 --> 00:04:13,100 So we have this app detection engine that automates scanning Google Play. 42 00:04:13,100 --> 00:04:32,980 It updates the database and it enriches a lot of the data that's collected there, funnels that through our database, and then pushes it out and deploys it to our front end web application over on GitHub pages, as well as dumps that data set into an open Google Sheet so that anyone can go there, 43 00:04:32,980 --> 00:04:40,340 go to our website and click the About page, and you will very easily be connected to that open data set. 44 00:04:42,160 --> 00:04:47,560 I'm not going to go into too much depth here, but a few constraints worth mentioning. 45 00:04:47,560 --> 00:04:52,260 We are a volunteer-based team, as many side projects are. 46 00:04:52,260 --> 00:04:53,160 We don't have funding. 47 00:04:53,160 --> 00:04:54,400 We have limited time. 48 00:04:54,400 --> 00:05:01,120 And so a lot of, again, the design decisions that we made throughout this process were based off of those two big constraints. 49 00:05:01,120 --> 00:05:07,760 Our main goal for this project from the very beginning was really to just understand the ecosystem. 50 00:05:07,760 --> 00:05:09,500 Things were popping up so quickly. 51 00:05:09,500 --> 00:05:25,080 It was to try to get a better sense of what exactly the ecosystem of applications being produced across the globe really look like across those three core areas, contact tracing, symptom tracking, and informational applications. 52 00:05:25,200 --> 00:05:27,200 Another goal was creating that open data set. 53 00:05:27,200 --> 00:05:30,440 And, of course, we all were doing this as a side project. 54 00:05:30,440 --> 00:05:34,680 We had our own personal learning goals throughout this project as well. 55 00:05:35,960 --> 00:05:41,700 So, we are probably all pretty familiar with this particular problem. 56 00:05:41,700 --> 00:05:48,620 Problem number one is that there has been this rapid deployment of this technology across the globe. 57 00:05:49,020 --> 00:05:58,920 Rapid deployment of technology often leads to more bugs, often leads to more vulnerabilities, with the potential for those vulnerabilities to be exploited. 58 00:05:58,920 --> 00:06:01,540 And we've seen this across several applications. 59 00:06:01,540 --> 00:06:09,860 This is one based in the United States that got in trouble for violating its own privacy policy because it was sharing information with a third party. 60 00:06:10,060 --> 00:06:18,980 The Qatar application, Amnesty International, did some great research and identified some security vulnerabilities that exposed personal details of more than a million users. 61 00:06:19,400 --> 00:06:21,100 And the list goes on. 62 00:06:21,540 --> 00:06:35,440 Norway had a lot of privacy issues with its application and decided to just stop deployment, to stop working on this particular application for now until it can really address the privacy concerns that were happening. 63 00:06:36,560 --> 00:06:38,340 And again, the list goes on and on. 64 00:06:38,340 --> 00:06:39,340 So, we all know this. 65 00:06:39,340 --> 00:06:40,560 That's problem number one. 66 00:06:40,560 --> 00:06:44,300 We're really not going to touch so much on that particular problem in this session. 67 00:06:44,340 --> 00:06:46,720 But problem number two is really where we're going to live. 68 00:06:46,720 --> 00:06:55,180 The data collection and permissions problem, which is sort of the privacy issues that are surrounding these COVID-19 applications. 69 00:06:55,180 --> 00:07:10,620 And the lack of transparency that really we don't have a lot of information around how governments are treating this data, what they're collecting, how they're using it, what the functional purpose is for the data that they are using or requesting. 70 00:07:11,480 --> 00:07:23,940 So, to jump back a little bit into the timeline to remind ourselves where we came from, around February of this year, this is when we started seeing a lot of COVID-19 related applications popping up all over. 71 00:07:23,940 --> 00:07:26,000 In my day job, I work for a nonprofit. 72 00:07:26,000 --> 00:07:32,740 I was being approached by a lot of journalists and a lot of human rights groups and activists asking about these applications. 73 00:07:32,760 --> 00:07:35,080 And should they be concerned about their privacy? 74 00:07:35,900 --> 00:07:37,700 The answer, obviously, was absolutely. 75 00:07:37,700 --> 00:07:38,880 I would be concerned. 76 00:07:38,880 --> 00:07:42,940 But there wasn't a whole lot of information around these applications at the time. 77 00:07:43,300 --> 00:07:45,460 Fast forward a month, we get into March. 78 00:07:45,500 --> 00:07:48,800 Google and Apple actually implement a crackdown on their app stores. 79 00:07:48,800 --> 00:07:59,040 And they say, look, you have to be a government or you have to be an official health authority to even produce and publish an application on our app stores. 80 00:07:59,260 --> 00:08:14,540 So, they did a little bit of cleaning house to try to make it a bit clearer what these applications are, make sure they have a better handle on the types of applications being downloaded and being produced on their app store. 81 00:08:14,540 --> 00:08:27,740 Then we get to April, where Google and Apple again announced their partnership to collaborate on this more privacy-respecting contact tracing technology called their Exposure Notification Framework. 82 00:08:27,740 --> 00:08:31,420 And privacy-respecting in the sense that it's not using geolocation. 83 00:08:31,420 --> 00:08:37,120 It's using Bluetooth proximity-based contact tracing, a contact tracing model. 84 00:08:37,120 --> 00:08:40,040 EFF has a great resource that y'all should check out. 85 00:08:40,040 --> 00:08:41,680 We're not going to get into it here. 86 00:08:41,680 --> 00:08:44,420 We're not experts on Apple and Google's technology. 87 00:08:44,420 --> 00:08:51,040 We really encourage you to look and take a look at the documentation from those who are more expert in that field. 88 00:08:51,040 --> 00:08:56,700 But it is worth mentioning because it's a topic of interest and it has a lot to do with privacy. 89 00:08:57,100 --> 00:09:10,700 In May 2020, kind of related to our project, MIT released a data set around contact tracing applications that they were tracking to better understand the ecosystem. 90 00:09:10,700 --> 00:09:15,880 And again, as I mentioned, we are really focused on automating the detection of the applications. 91 00:09:15,960 --> 00:09:24,520 But of course, we have to supplement some manual review and some manual entry or loading applications that our engine maybe didn't detect. 92 00:09:24,520 --> 00:09:32,880 And this was a great resource for us to pull some of their data into our data set to make sure that our data set is as robust as we can make it. 93 00:09:33,460 --> 00:09:39,340 We get into June, July, and August this summer, and we still have this data collection problem. 94 00:09:39,340 --> 00:09:41,140 We still have this privacy problem. 95 00:09:41,140 --> 00:09:43,520 And that's kind of where we end today. 96 00:09:43,520 --> 00:09:47,860 And that's kind of where we'll kind of really focus on in this particular presentation. 97 00:09:48,260 --> 00:09:55,400 So to look quickly at the ecosystem, how many apps are actually out there on the Google Play Store? 98 00:09:56,460 --> 00:10:07,620 Well, for our detection engine, we have detected, you know, on August 1st, we had detected 121 applications, which feels like a lot. 99 00:10:07,700 --> 00:10:10,420 We had those three different categories. 100 00:10:10,420 --> 00:10:11,620 They're not just contact tracing. 101 00:10:11,620 --> 00:10:14,460 They're also symptom tracking and informational applications. 102 00:10:14,460 --> 00:10:16,000 A couple things to note. 103 00:10:16,580 --> 00:10:20,460 The first data point we have is on May 10th. 104 00:10:20,460 --> 00:10:23,500 That is when we started tracking our first scene date. 105 00:10:23,500 --> 00:10:26,920 And that is our first scene date for our project and our engine. 106 00:10:26,920 --> 00:10:30,880 So it wasn't like there didn't exist applications before May 10th. 107 00:10:30,880 --> 00:10:33,940 Of course, applications existed before that date. 108 00:10:33,940 --> 00:10:38,620 But this is the first day that we started tracking that metric and deploying it. 109 00:10:39,360 --> 00:10:42,060 And we've seen an increase since then, clearly. 110 00:10:43,640 --> 00:10:46,180 Number of applications by country. 111 00:10:46,180 --> 00:10:51,600 For us, we were curious if there were certain countries producing or creating more applications than other countries. 112 00:10:51,900 --> 00:10:55,820 And what we found was indeed there are. 113 00:10:55,940 --> 00:10:57,820 So, excuse me. 114 00:10:57,860 --> 00:11:01,400 So we're going to zoom in a little bit to see that a little bit better. 115 00:11:01,400 --> 00:11:14,860 You can see from this graph, India is really leading, at least by August 1st, it was really leading the charge in creating applications across different municipalities in the country. 116 00:11:14,860 --> 00:11:16,080 India is very interesting. 117 00:11:16,080 --> 00:11:22,180 They have one very sort of nationwide application and a lot of different regional applications. 118 00:11:22,620 --> 00:11:32,720 The United States, not surprisingly for those who are familiar with with the United States, a lot of states have created their own applications. 119 00:11:32,720 --> 00:11:35,680 In the United States, there's not one single application for the nation. 120 00:11:35,940 --> 00:11:39,060 It's been hyper localized to the different states. 121 00:11:39,060 --> 00:11:41,880 And we can kind of see this across other countries as well. 122 00:11:42,040 --> 00:11:43,860 And so we found this quite interesting. 123 00:11:43,860 --> 00:11:45,840 Here's a couple examples in the US. 124 00:11:46,080 --> 00:11:53,940 This is one that was created, started in North Dakota and is being used right now in South Dakota and Wyoming, according to the description. 125 00:11:53,940 --> 00:11:57,080 We've also got, you know, Rhode Island has their own. 126 00:11:57,080 --> 00:11:58,660 Sonoma County, I think, has their own. 127 00:11:58,660 --> 00:12:00,520 Florida has their own application. 128 00:12:00,880 --> 00:12:02,800 And this is what we wanted to highlight this week. 129 00:12:02,800 --> 00:12:03,920 It was just released. 130 00:12:03,920 --> 00:12:06,080 It's the Virginia Department of Health application. 131 00:12:06,080 --> 00:12:13,840 It's the first application in the United States to implement the Apple and Google exposure notification framework. 132 00:12:15,140 --> 00:12:19,620 Which is that Bluetooth proximity contact tracing model. 133 00:12:21,160 --> 00:12:25,520 So, of course, we wanted to know also what is the impact on people. 134 00:12:25,840 --> 00:12:43,900 And our proxy for understanding that was really to kind of look at the scale of application usage and using downloads as sort of a metric that we could potentially see how scaled this This problem kind of is. 135 00:12:43,960 --> 00:12:47,820 So India, again, they've got more than a billion people in the country. 136 00:12:47,900 --> 00:12:54,360 They've got over 100 million downloads, according to Google Play, for their nationwide application. 137 00:12:54,360 --> 00:12:56,580 They sort of blow everyone else out of the water. 138 00:12:56,580 --> 00:13:04,280 They have the numbers and they have, you know, some interesting ways to sort of deploy that technology. 139 00:13:04,280 --> 00:13:07,660 So they're clearly winning in terms of raw numbers here. 140 00:13:07,660 --> 00:13:18,820 But if you look at the next greatest number of downloads that we could that we could see through our data set, we have this Colombian application called Corona Colombia. 141 00:13:19,600 --> 00:13:28,540 They have around 10 million downloads, which is pretty significant given the country is, you know, Google told me the country is 50 million people in Colombia. 142 00:13:28,540 --> 00:13:35,300 So that's a very interesting percentage of folks in the country that have downloaded the application. 143 00:13:35,880 --> 00:13:45,380 And, you know, we have this next grouping of around, you know, 5 million plus downloads across places like Turkey, Argentina, Malaysia, and Germany. 144 00:13:45,380 --> 00:13:50,060 And then we have this cluster in sort of the 1 million category here. 145 00:13:50,060 --> 00:13:57,300 So we can kind of get a sense of how many folks are actually downloading and potentially using these applications. 146 00:13:58,920 --> 00:14:02,160 Next we'll hop into privacy and permissions. 147 00:14:03,040 --> 00:14:15,400 We decided to do a bit of initial analysis on the open data set that we've collected using permissions again as this proxy to understand how privacy respecting some apps are over others. 148 00:14:15,780 --> 00:14:23,840 While understanding that Also, some of the specific privacy problem areas in these applications. 149 00:14:23,980 --> 00:14:28,720 So we decided to look at the top 10 permissions requested by applications. 150 00:14:29,360 --> 00:14:33,860 And right away for us, sort of the location problem jumped out. 151 00:14:33,860 --> 00:14:43,940 We have a lot of folks requesting a lot of applications requesting precise location or approximate location within the data set. 152 00:14:45,240 --> 00:14:46,540 This we're going to jump into. 153 00:14:46,540 --> 00:14:53,740 We're going to kind of talk a little bit more detail around location problems in a second, but that was very interesting for us. 154 00:14:54,100 --> 00:15:04,120 We also wanted to know who requested the most permissions out of our data and we had the highest number of permissions requested was 23. 155 00:15:04,120 --> 00:15:06,540 So that was our max permissions requested. 156 00:15:07,520 --> 00:15:18,920 And we had a few applications that all requested 23 different permissions and those were Lithuanian application, a regional Indian application. 157 00:15:18,920 --> 00:15:22,400 So it's not the hundred million download application. 158 00:15:22,400 --> 00:15:30,900 This is a specific municipality in India that's requesting this this number of permissions called TCOVID-19 app. 159 00:15:31,720 --> 00:15:39,660 And then we have Italy as well, who also requested the SM-COVID-19 application in Italy that requested 23 permissions. 160 00:15:39,660 --> 00:15:41,140 So we found this interesting. 161 00:15:41,940 --> 00:15:44,600 We also wanted to know who requested the least. 162 00:15:44,600 --> 00:15:47,320 So who's sort of not asking for anything. 163 00:15:47,580 --> 00:15:50,980 We had one application that didn't request a single thing. 164 00:15:50,980 --> 00:15:56,400 And that was the Pakistan National Action Plan for COVID-19 strictly informational application. 165 00:15:56,400 --> 00:15:59,520 And then we had a few that just requested one. 166 00:15:59,860 --> 00:16:05,560 A couple from Spain, one from Vietnam, another from Pakistan. 167 00:16:06,960 --> 00:16:14,760 So let's kind of revisit a little bit quickly the geolocation problems we sort of alluded to. 168 00:16:14,760 --> 00:16:23,760 Now, this is interesting because more applications actually requested precise location over approximate location. 169 00:16:23,760 --> 00:16:26,880 So we found this sort of to be also an interesting metric. 170 00:16:27,320 --> 00:16:33,980 Reminding us all that not all of the applications in our data set here are contact tracing applications. 171 00:16:33,980 --> 00:16:49,480 That is a model that certain countries are using in their applications is requesting location in their contact tracing efforts and their contact tracing mechanism that they've deployed across the country or across their specific region. 172 00:16:49,920 --> 00:17:02,460 So functionally, I think if you're a contact tracing application, you might not be using the most privacy respecting model, but we can at least logically potentially understand why you would request location. 173 00:17:02,460 --> 00:17:14,100 But for these symptom tracking and informational applications, I think there's a huge mismatch between what the function of the application is and then the permissions that are actually being requested. 174 00:17:15,240 --> 00:17:24,660 Obviously, the other really concerning bit here with geolocation is that most of these applications are government managed, government developed. 175 00:17:24,660 --> 00:17:33,700 This is a lot of sensitive data to just be giving up to the government and there are obvious surveillance and privacy problems around this. 176 00:17:34,540 --> 00:17:42,520 Many privacy experts have warned against contract tracing applications using GPS due to these privacy violations. 177 00:17:42,520 --> 00:17:52,100 And so this is something that I think is definitely worth delving deeper into who exactly are the applications requesting this information. 178 00:17:54,660 --> 00:18:03,360 So we mentioned the Google and Apple exposure notification framework, once again, because we see this as a potential area of opportunity. 179 00:18:03,360 --> 00:18:19,540 If we recall in the timeline, this was announced in April, Google and Apple released that joint announcement to collaborate on this interoperable contact tracing, proximity based contact tracing framework using Bluetooth. 180 00:18:19,660 --> 00:18:32,060 It does not use geolocation and there's a potential, we see potential here for helping some applications transition over to something that doesn't use geolocation. 181 00:18:32,180 --> 00:18:40,620 We took a quick look at the developer documents to just understand again a little bit more what what exactly is required. 182 00:18:40,620 --> 00:18:57,800 And it is really important to note that if you were to implement this Google and Apple technology, you actually cannot include requesting anything like course location, which is your approximate location, or find location, which is your precise location. 183 00:18:57,800 --> 00:18:59,240 And we've seen from the data. 184 00:18:59,240 --> 00:19:00,880 This is highly problematic. 185 00:19:01,100 --> 00:19:10,560 We have around 75% of our entire data set, entire applications in our data set requesting some form of location. 186 00:19:10,560 --> 00:19:17,660 So there's some very interesting potentially transitional problems here. 187 00:19:17,660 --> 00:19:25,340 It's not a whole lot of applications right now are implementing this Google Apple exposure notification framework. 188 00:19:25,340 --> 00:19:44,900 But you can potentially see some some problems here if they were to do a transition and to understand, you know, what non technological mechanisms do they have in these different regions in different countries that potentially are right now utilizing or leveraging location data that they're getting from applications. 189 00:19:45,140 --> 00:19:47,500 So it's, it's a big problem. 190 00:19:47,500 --> 00:19:49,180 We know this. 191 00:19:49,760 --> 00:19:56,520 What we wanted to do was really share and kind of a better understand some of the problems around this. 192 00:19:58,180 --> 00:20:04,880 As we all know, not all permissions are equally concerning in terms of privacy. 193 00:20:04,900 --> 00:20:13,280 And so we wanted to take a look at something Google and Android developers call the dangerous permissions. 194 00:20:13,280 --> 00:20:22,060 And dangerous permissions, according to Google, are permissions that could potentially affect the user's privacy or the device's normal operation. 195 00:20:22,060 --> 00:20:28,000 And the user must explicitly agree to grant those permissions if they're requested. 196 00:20:28,000 --> 00:20:32,140 And that's taken directly from the Android developer documentation. 197 00:20:32,140 --> 00:20:39,560 So what are the top dangerous permissions that we found were being requested within our data set? 198 00:20:39,960 --> 00:20:44,220 Not surprisingly, location is clearly a dangerous permission. 199 00:20:44,220 --> 00:20:48,360 We're not going to really talk about that much more because I think we've covered it. 200 00:20:48,360 --> 00:21:08,660 But we also see that storage, both reading the contents of the storage, as well as modifying and deleting the contents of your USB storage, are both considered dangerous permissions and we have around 50% requesting read access and we have around 46% of the data set requesting modifying access. 201 00:21:09,060 --> 00:21:12,200 Now this is where we feel like it gets more interesting. 202 00:21:12,200 --> 00:21:17,980 We're going to take a deeper dive on sort of the last two dangerous permissions listed here. 203 00:21:17,980 --> 00:21:23,300 And that's because if you're requesting this particular permission, you are no longer in the norm. 204 00:21:23,300 --> 00:21:26,320 You are an anomaly if you're requesting this. 205 00:21:26,320 --> 00:21:33,320 And so we thought it would be interesting to take a deeper look to see who actually is requesting this information. 206 00:21:33,440 --> 00:21:35,420 So who's requesting microphone access? 207 00:21:35,420 --> 00:21:40,220 There are a couple apps that we found quite interesting. 208 00:21:40,220 --> 00:21:46,700 There's this interesting US Department of Veteran Affairs COVID Coach application in the United States that requests this. 209 00:21:46,700 --> 00:21:55,220 The UAE has a few applications that request this, but really it's a mishmash of countries around the globe requesting this. 210 00:21:55,800 --> 00:21:59,560 Who's requesting reading your contacts? 211 00:21:59,560 --> 00:22:06,020 Now this also, again, we see that COVID Coach, this Department of Veteran Affairs application, makes another appearance. 212 00:22:06,020 --> 00:22:08,840 It's very odd to see that it's requesting this. 213 00:22:09,180 --> 00:22:12,560 But we also see is that the Corona Colombia shows up. 214 00:22:12,560 --> 00:22:19,260 And as we talked about before, this is an application that has a broad user base. 215 00:22:19,260 --> 00:22:24,520 You have over 10 million downloads, according to the Google Play Store, of this particular application. 216 00:22:24,520 --> 00:22:27,060 So a lot of people are using it. 217 00:22:27,160 --> 00:22:35,140 We also see that there are a couple other concerning applications. 218 00:22:35,140 --> 00:22:40,100 Turkey has around 5 million, at least 5 million downloads of that application. 219 00:22:40,100 --> 00:22:47,440 So the scale and reach and impact that this particular application, these particular applications have is pretty great. 220 00:22:48,940 --> 00:22:53,160 We also were curious about regional differences and we're just giving one example. 221 00:22:53,160 --> 00:22:56,800 You could take our data and look at specific regions you're interested in. 222 00:22:56,800 --> 00:23:07,640 We thought we would just take a quick look at are there any differences in dangerous permission requests between apps in the EU and apps out of the EU. 223 00:23:07,640 --> 00:23:15,620 And out of our data set, we have a quarter of the applications in there in that data set are EU countries. 224 00:23:17,660 --> 00:23:19,880 And what we found was quite interesting. 225 00:23:19,880 --> 00:23:34,780 We really see across the board that EU applications or countries based in the EU, if they're producing an application, they typically requested less dangerous permissions than non-EU applications. 226 00:23:34,780 --> 00:23:43,140 And we can see that across the board, looking at location, looking at storage, and even sort of those anomaly permissions at the bottom there. 227 00:23:43,140 --> 00:23:51,380 In some instances, for example, reading your contacts, no EU applications in our data set requested that dangerous permission. 228 00:23:53,480 --> 00:24:08,560 So researchers and advocates we feel are a really important part of this ecosystem of COVID-19 applications and we had a few that we really wanted to mention because they're doing great research and our goal is to create things that are useful for researchers and advocates. 229 00:24:08,560 --> 00:24:12,500 I think Fundación Carisma is one based in Colombia. 230 00:24:12,500 --> 00:24:21,200 They have done some really amazing privacy and security research of the applications and technologies that are being deployed in the country. 231 00:24:21,200 --> 00:24:45,300 And we would love to be able to work with groups like this and groups like others who are focused on privacy evaluations to figure out, you know, how we can better create or support those efforts, in particular, you know, understanding the ecosystem and publishing any sort of research and cross-publishing on our particular platform. 232 00:24:45,300 --> 00:25:06,140 We have groups like Amnesty International who are also doing great work analyzing applications in accordance to sort of who's who and in violating sort of privacy rights across the board across these applications. 233 00:25:06,360 --> 00:25:33,560 We've got EFF who also is doing great work and we've got a really cool project who inspired us to start looking more closely at the dangerous permissions that we really wanted to mention, which is the exodusprivacy.eu.org project where that actually analyzes Android applications to quickly determine how many trackers and how many dangerous permissions are being requested by the application. 234 00:25:35,740 --> 00:25:38,620 So what now? 235 00:25:39,140 --> 00:25:43,120 It probably feels a little bit like this. 236 00:25:43,120 --> 00:25:48,820 There are a lot of problems when it comes to these COVID-19 applications. 237 00:25:48,820 --> 00:25:52,020 There are a lot of privacy issues that we mentioned. 238 00:25:52,300 --> 00:25:56,640 So, we wanted to talk a little bit about opportunities here. 239 00:25:56,640 --> 00:26:06,480 And I think the first opportunity that we really feel strongly about is more privacy and security audits, more privacy and security evaluations of these applications and publish them. 240 00:26:06,480 --> 00:26:07,540 Publish them publicly. 241 00:26:07,540 --> 00:26:15,460 If you're a government who wants to build trust and build transparency to get more adoption of an application. 242 00:26:15,460 --> 00:26:22,880 This is one way we feel could be really potentially impactful to get that higher adoption rate that's needed. 243 00:26:24,240 --> 00:26:29,200 Better understand those adoption barriers to the Google and Apple exposure notification technology. 244 00:26:29,200 --> 00:26:36,360 I think this is one that we're particularly, you know, just interested in why there hasn't been more adoption. 245 00:26:36,360 --> 00:26:42,900 It sounds like based off of some of the reporting over the last couple weeks that there's going to be some movement there coming up. 246 00:26:42,900 --> 00:27:03,540 So we're really excited to, again, make sure that it's clear in our application to users which applications are more privacy respecting, not requesting dangerous permissions, not requesting location data, especially as more governments are getting into the market to develop these technologies. 247 00:27:03,540 --> 00:27:09,320 And we have a few other, you know, suggestions, opportunities, advocating for privacy respecting applications. 248 00:27:09,320 --> 00:27:12,240 Obviously, there are a lot of folks that are doing this already. 249 00:27:12,440 --> 00:27:16,700 We mentioned some of them, but we need more folks doing it. 250 00:27:16,700 --> 00:27:22,060 And I think one of the things for advocates, they really need information and it's been hard to get it. 251 00:27:22,060 --> 00:27:37,260 And so projects like this, we hope, can be useful to advocates to better inform, better create that narrative, and better create the argument for why privacy needs to be embedded in these applications from the onset, from the design. 252 00:27:37,500 --> 00:27:43,140 And of course, I think transparency standards for COVID-19 application are truly needed. 253 00:27:43,560 --> 00:27:56,580 Promoting open source technologies, transparent data collection and treatment, understanding and matching the function of the application with what is actually being requested in the application, and thinking critically about that. 254 00:27:59,560 --> 00:28:01,580 And sort of just a few final remarks. 255 00:28:01,580 --> 00:28:09,060 So, you know, we feel that the design decisions we're making right now really do have the potential for lasting impact on our privacy. 256 00:28:09,300 --> 00:28:14,980 And when developing any technology, we should always be thinking about the impact that technology will have long term. 257 00:28:14,980 --> 00:28:19,980 In times of crisis, sometimes it's easier to not think about that. 258 00:28:19,980 --> 00:28:39,160 And so really, we want to slow things down, make sure that privacy is being considered and there are certain standards and expectations of governments creating these technologies to make sure that we're not creating this lasting surveillance problem down the line. 259 00:28:39,160 --> 00:28:55,410 And as we create these technologies, really making sure we're looking at the positive use cases for impact, but also the misuse cases, the negative use cases for deploying this technology without taking the time to really design and embed privacy into these products. 260 00:28:56,200 --> 00:28:58,920 And with that, we end there. 261 00:28:58,920 --> 00:29:03,420 We'll be taking questions on the DEF CON Crypto Village Discord channel. 262 00:29:03,420 --> 00:29:15,440 But if you have any other questions, please contact us at info at covid19apptracker.org and thanks again for allowing us to present this project and giving us the opportunity. 263 00:29:15,440 --> 00:29:16,920 We really appreciate it.