start	end	text
2850	10060	Hello, and thank you for this opportunity to speak at the Crypto Village at DEF CON this year.
10060	15060	My name is Megan DeBlois, and I'm going to be talking to you today about some of the privacy problems
15060	19240	with COVID-19 apps that have been emerging across the globe.
19240	23640	Our session is called, Who Needs Spyware When You Have COVID-19 Apps?
23640	29200	A few caveats. We truly aren't saying all COVID-19 apps are spyware.
29200	35620	We're trying to allude or describe the privacy problem that we feel very strongly
35620	38020	and very passionate about as a group.
38420	42600	A couple other caveats. We're not lawyers, and we're not professional researchers.
42600	48040	We build things. We're a group of engineers and designers and project managers
48040	52040	who really wanted to create something that could be useful to better understand
52040	57240	the COVID-19 applications that have been popping up around the globe.
58340	61940	So today, we're going to be just touching, scratching the surface.
61980	67580	There's tons of information that we could get into.
67840	71320	We really encourage others to check out our data set.
71320	73760	It's an open data set that we've created.
74220	80960	All of the data that we're going to be talking about today is really only updated since August 1st.
80960	85180	And we know that things move and shift really quickly, but just keep that in mind.
85180	90640	We're really only going to be looking at the graphs and the data between the beginning of the pandemic
90640	95340	when we started collecting the data into August 1st, 2020.
96220	100600	So today, we're going to be talking a little bit about the project, the people, the goals.
100600	104240	We're going to jump down into sort of the problem.
104240	109540	We have a few problems in the COVID-19 application space, as I'm sure many of you know.
109760	113040	And we'll kind of touch base a little bit on the timeline,
113040	116500	just remind ourselves sort of where we came from.
116500	122940	And then we'll get into the ecosystem and really understand some of the trends that we've been able to deduce
122940	125960	based on the data that we've been able to collect.
126240	129820	And then we'll kind of end with some opportunities that we see.
130560	133460	Our team, as I mentioned, my name is Megan DeBlois.
133500	137140	I'm the volunteer product manager for this particular project.
137720	145600	We are a completely volunteer-based team with Carlos Micas-Nadal, who's our back-end engineer,
145600	150600	Zach Anderson, our front-end engineer, as well as Justin DeBlois, our UX designer.
150720	156660	If you want to learn more about our team, please check it out at our website, covid19apptracker.org.
156660	160720	And you can find a lot more information about us there.
160780	165420	Get in touch at info at covid19apptracker.org.
165420	168140	All right, so let's jump into the project.
168600	174400	This particular project started back around March at the beginning of the pandemic
174400	177750	when we first really saw a lot of applications popping up.
178440	186480	Between then and August 1st, we have been able to detect around 120 applications
186480	190820	related to COVID-19 around the world.
190820	195980	Again, that number is last updated on August 1st, so we have a few more since then.
196340	203220	But the main categories of COVID-19 applications that we are detecting here
203640	208020	are contact tracing, of course. That's been a hot topic as of late.
208020	213840	But we're also looking at symptom tracking applications and informational applications.
213980	220480	Just quickly, to make sure folks understand where the data is coming from and how this works,
220480	224160	we have a few different components of the application.
224280	228500	We have a detection engine, and this is really something that we prioritize in this project
228500	233460	is automated detection of the applications that are popping up on the Google Play Store.
233820	238860	We really wanted to ensure that there was also a clean front end and we created an open data set.
238860	241720	Those were sort of design decisions that we made at the very beginning
241720	248440	to ensure that the data in the project would be potentially useful for researchers and others.
248440	253100	So we have this app detection engine that automates scanning Google Play.
253100	259060	It updates the database and it enriches a lot of the data that's collected there,
259060	262900	funnels that through our database, and then pushes it out and deploys it
262900	266220	to our front end web application over on GitHub pages,
266220	272980	as well as dumps that data set into an open Google Sheet so that anyone can go there,
272980	280340	go to our website and click the About page, and you will very easily be connected to that open data set.
282160	287560	I'm not going to go into too much depth here, but a few constraints worth mentioning.
287560	292260	We are a volunteer-based team, as many side projects are.
292260	294400	We don't have funding. We have limited time.
294400	298220	And so a lot of, again, the design decisions that we made throughout this process
298220	301120	were based off of those two big constraints.
301120	307760	Our main goal for this project from the very beginning was really to just understand the ecosystem.
307760	309500	Things were popping up so quickly.
309500	316580	It was to try to get a better sense of what exactly the ecosystem of applications
316580	320980	being produced across the globe really look like across those three core areas,
320980	325080	contact tracing, symptom tracking, and informational applications.
325200	327200	Another goal was creating that open data set.
327200	330440	And, of course, we all were doing this as a side project.
330440	334680	We had our own personal learning goals throughout this project as well.
335960	341700	So, we are probably all pretty familiar with this particular problem.
341700	348620	Problem number one is that there has been this rapid deployment of this technology across the globe.
349020	354580	Rapid deployment of technology often leads to more bugs, often leads to more vulnerabilities,
354580	358920	with the potential for those vulnerabilities to be exploited.
358920	361540	And we've seen this across several applications.
361540	365700	This is one based in the United States that got in trouble for violating its own privacy policy
365700	369860	because it was sharing information with a third party.
370060	373420	The Qatar application, Amnesty International, did some great research
373420	378980	and identified some security vulnerabilities that exposed personal details of more than a million users.
379400	381100	And the list goes on.
381540	388460	Norway had a lot of privacy issues with its application and decided to just stop deployment,
388460	395440	to stop working on this particular application for now until it can really address the privacy concerns that were happening.
396560	398340	And again, the list goes on and on.
398340	400560	So, we all know this. That's problem number one.
400560	404300	We're really not going to touch so much on that particular problem in this session.
404340	406720	But problem number two is really where we're going to live.
406720	409720	The data collection and permissions problem,
409720	415180	which is sort of the privacy issues that are surrounding these COVID-19 applications.
415180	423640	And the lack of transparency that really we don't have a lot of information around how governments are treating this data,
423640	425780	what they're collecting, how they're using it,
425780	430620	what the functional purpose is for the data that they are using or requesting.
431480	436460	So, to jump back a little bit into the timeline to remind ourselves where we came from,
436460	443940	around February of this year, this is when we started seeing a lot of COVID-19 related applications popping up all over.
443940	446000	In my day job, I work for a nonprofit.
446000	452740	I was being approached by a lot of journalists and a lot of human rights groups and activists asking about these applications.
452760	455080	And should they be concerned about their privacy?
455900	458880	The answer, obviously, was absolutely. I would be concerned.
458880	462940	But there wasn't a whole lot of information around these applications at the time.
463300	465460	Fast forward a month, we get into March.
465500	468800	Google and Apple actually implement a crackdown on their app stores.
468800	479040	And they say, look, you have to be a government or you have to be an official health authority to even produce and publish an application on our app stores.
479260	485640	So, they did a little bit of cleaning house to try to make it a bit clearer what these applications are,
485640	494540	make sure they have a better handle on the types of applications being downloaded and being produced on their app store.
494540	507740	Then we get to April, where Google and Apple again announced their partnership to collaborate on this more privacy-respecting contact tracing technology called their Exposure Notification Framework.
507740	511420	And privacy-respecting in the sense that it's not using geolocation.
511420	517120	It's using Bluetooth proximity-based contact tracing, a contact tracing model.
517120	520040	EFF has a great resource that y'all should check out.
520040	521680	We're not going to get into it here.
521680	524420	We're not experts on Apple and Google's technology.
524420	531040	We really encourage you to look and take a look at the documentation from those who are more expert in that field.
531040	536700	But it is worth mentioning because it's a topic of interest and it has a lot to do with privacy.
537100	550700	In May 2020, kind of related to our project, MIT released a data set around contact tracing applications that they were tracking to better understand the ecosystem.
550700	555880	And again, as I mentioned, we are really focused on automating the detection of the applications.
555960	564520	But of course, we have to supplement some manual review and some manual entry or loading applications that our engine maybe didn't detect.
564520	572880	And this was a great resource for us to pull some of their data into our data set to make sure that our data set is as robust as we can make it.
573460	579340	We get into June, July, and August this summer, and we still have this data collection problem.
579340	583520	We still have this privacy problem. And that's kind of where we end today.
583520	587860	And that's kind of where we'll kind of really focus on in this particular presentation.
588260	595400	So to look quickly at the ecosystem, how many apps are actually out there on the Google Play Store?
596460	607620	Well, for our detection engine, we have detected, you know, on August 1st, we had detected 121 applications, which feels like a lot.
607700	614460	We had those three different categories. They're not just contact tracing. They're also symptom tracking and informational applications.
614460	623500	A couple things to note. The first data point we have is on May 10th. That is when we started tracking our first scene date.
623500	626920	And that is our first scene date for our project and our engine.
626920	633940	So it wasn't like there didn't exist applications before May 10th. Of course, applications existed before that date.
633940	638620	But this is the first day that we started tracking that metric and deploying it.
639360	642060	And we've seen an increase since then, clearly.
643640	651600	Number of applications by country. For us, we were curious if there were certain countries producing or creating more applications than other countries.
651900	661400	And what we found was indeed there are. So, excuse me. So we're going to zoom in a little bit to see that a little bit better.
661400	674860	You can see from this graph, India is really leading, at least by August 1st, it was really leading the charge in creating applications across different municipalities in the country.
674860	682180	India is very interesting. They have one very sort of nationwide application and a lot of different regional applications.
682620	686600	The United States, not surprisingly for those who are familiar with
687820	695680	with the United States, a lot of states have created their own applications. In the United States, there's not one single application for the nation.
695940	705840	It's been hyper localized to the different states. And we can kind of see this across other countries as well. And so we found this quite interesting. Here's a couple examples in the US.
706080	713940	This is one that was created, started in North Dakota and is being used right now in South Dakota and Wyoming, according to the description.
713940	720520	We've also got, you know, Rhode Island has their own. Sonoma County, I think, has their own. Florida has their own application.
720880	733840	And this is what we wanted to highlight this week. It was just released. It's the Virginia Department of Health application. It's the first application in the United States to implement the Apple and Google exposure notification framework.
735140	739620	Which is that Bluetooth proximity contact tracing model.
741160	745520	So, of course, we wanted to know also what is the impact on people.
745840	760660	And our proxy for understanding that was really to kind of look at the scale of application usage and using downloads as sort of a metric that we could potentially see how scaled this
761640	774360	This problem kind of is. So India, again, they've got more than a billion people in the country. They've got over 100 million downloads, according to Google Play, for their nationwide application.
774360	781440	They sort of blow everyone else out of the water. They have the numbers and they have, you know, some interesting ways to
782160	798820	sort of deploy that technology. So they're clearly winning in terms of raw numbers here. But if you look at the next greatest number of downloads that we could that we could see through our data set, we have this Colombian application called Corona Colombia.
799600	810240	They have around 10 million downloads, which is pretty significant given the country is, you know, Google told me the country is 50 million people in Colombia. So that's a very interesting
811440	815300	percentage of folks in the country that have downloaded the application.
815880	825380	And, you know, we have this next grouping of around, you know, 5 million plus downloads across places like Turkey, Argentina, Malaysia, and Germany.
825380	837300	And then we have this cluster in sort of the 1 million category here. So we can kind of get a sense of how many folks are actually downloading and potentially using these applications.
838920	842160	Next we'll hop into privacy and permissions.
843040	855400	We decided to do a bit of initial analysis on the open data set that we've collected using permissions again as this proxy to understand how privacy respecting some apps are over others.
855780	857520	While understanding that
858520	868720	Also, some of the specific privacy problem areas in these applications. So we decided to look at the top 10 permissions requested by applications.
869360	883940	And right away for us, sort of the location problem jumped out. We have a lot of folks requesting a lot of applications requesting precise location or approximate location within the data set.
885240	893740	This we're going to jump into. We're going to kind of talk a little bit more detail around location problems in a second, but that was very interesting for us.
894100	906540	We also wanted to know who requested the most permissions out of our data and we had the highest number of permissions requested was 23. So that was our max permissions requested.
907520	920240	And we had a few applications that all requested 23 different permissions and those were Lithuanian application, a regional Indian application. So it's not the hundred million
920240	930900	download application. This is a specific municipality in India that's requesting this this number of permissions called TCOVID-19 app.
931720	941140	And then we have Italy as well, who also requested the SM-COVID-19 application in Italy that requested 23 permissions. So we found this interesting.
941940	956400	We also wanted to know who requested the least. So who's sort of not asking for anything. We had one application that didn't request a single thing. And that was the Pakistan National Action Plan for COVID-19 strictly informational application.
956400	959520	And then we had a few that just requested one.
959860	965560	A couple from Spain, one from Vietnam, another from Pakistan.
966960	974760	So let's kind of revisit a little bit quickly the geolocation problems we sort of alluded to.
974760	986880	Now, this is interesting because more applications actually requested precise location over approximate location. So we found this sort of to be also an interesting metric.
987320	993980	Reminding us all that not all of the applications in our data set here are contact tracing applications.
993980	1000220	That is a model that certain countries are using in their applications is requesting location
1000830	1009480	in their contact tracing efforts and their contact tracing mechanism that they've deployed across the country or across their specific region.
1009920	1022460	So functionally, I think if you're a contact tracing application, you might not be using the most privacy respecting model, but we can at least logically potentially understand why you would request location.
1022460	1034100	But for these symptom tracking and informational applications, I think there's a huge mismatch between what the function of the application is and then the permissions that are actually being requested.
1035240	1044660	Obviously, the other really concerning bit here with geolocation is that most of these applications are government managed, government developed.
1044660	1053700	This is a lot of sensitive data to just be giving up to the government and there are obvious surveillance and privacy problems around this.
1054540	1065400	Many privacy experts have warned against contract tracing applications using GPS due to these privacy violations. And so this is something that I think is definitely worth
1065400	1072100	delving deeper into who exactly are the applications requesting this information.
1074660	1083360	So we mentioned the Google and Apple exposure notification framework, once again, because we see this as a potential area of opportunity.
1083360	1093140	If we recall in the timeline, this was announced in April, Google and Apple released that joint announcement to collaborate on this interoperable
1093140	1104240	contact tracing, proximity based contact tracing framework using Bluetooth. It does not use geolocation and there's a potential, we see potential here for
1105110	1112060	helping some applications transition over to something that doesn't use geolocation.
1112180	1118260	We took a quick look at the developer documents to just understand again a little bit more what
1118860	1129480	what exactly is required. And it is really important to note that if you were to implement this Google and Apple technology, you actually cannot include requesting anything
1130780	1141400	like course location, which is your approximate location, or find location, which is your precise location. And we've seen from the data. This is highly problematic. We have
1142220	1153940	around 75% of our entire data set, entire applications in our data set requesting some form of location. So there's some very interesting potentially
1155140	1165340	transitional problems here. It's not a whole lot of applications right now are implementing this Google Apple exposure notification framework.
1165340	1172780	But you can potentially see some some problems here if they were to do a transition and to understand, you know,
1172780	1189180	what non technological mechanisms do they have in these different regions in different countries that potentially are right now utilizing or leveraging location data that they're getting from applications. So it's, it's a big problem. We know this.
1189760	1196520	What we wanted to do was really share and kind of a better understand some of the problems around this.
1198180	1207680	As we all know, not all permissions are equally concerning in terms of privacy. And so we wanted to take a look at something Google
1207680	1222060	and Android developers call the dangerous permissions. And dangerous permissions, according to Google, are permissions that could potentially affect the user's privacy or the device's normal operation.
1222060	1232140	And the user must explicitly agree to grant those permissions if they're requested. And that's taken directly from the Android developer documentation.
1232140	1239560	So what are the top dangerous permissions that we found were being requested within our data set?
1239960	1248360	Not surprisingly, location is clearly a dangerous permission. We're not going to really talk about that much more because I think we've covered it.
1248360	1257400	But we also see that storage, both reading the contents of the storage, as well as modifying and deleting the contents of your USB storage, are both considered dangerous
1258020	1268660	permissions and we have around 50% requesting read access and we have around 46% of the data set requesting modifying access.
1269060	1274180	Now this is where we feel like it gets more interesting. We're going to take a deeper dive on
1274180	1286320	sort of the last two dangerous permissions listed here. And that's because if you're requesting this particular permission, you are no longer in the norm. You are an anomaly if you're requesting this.
1286320	1296000	And so we thought it would be interesting to take a deeper look to see who actually is requesting this information. So who's requesting microphone access? There are a couple
1297980	1306700	apps that we found quite interesting. There's this interesting US Department of Veteran Affairs COVID Coach application in the United States that requests this.
1306700	1315220	The UAE has a few applications that request this, but really it's a mishmash of countries around the globe requesting this.
1315800	1328840	Who's requesting reading your contacts? Now this also, again, we see that COVID Coach, this Department of Veteran Affairs application, makes another appearance. It's very odd to see that it's requesting this.
1329180	1337660	But we also see is that the Corona Colombia shows up. And as we talked about before, this is an application that has a broad
1337660	1347060	user base. You have over 10 million downloads, according to the Google Play Store, of this particular application. So a lot of people are using it.
1347160	1350300	We also see that there are
1352060	1367440	a couple other concerning applications. Turkey has around 5 million, at least 5 million downloads of that application. So the scale and reach and impact that this particular application, these particular applications have is pretty great.
1368940	1378980	We also were curious about regional differences and we're just giving one example. You could take our data and look at specific regions you're interested in. We thought we would just take a quick look at
1379540	1395620	are there any differences in dangerous permission requests between apps in the EU and apps out of the EU. And out of our data set, we have a quarter of the applications in there in that data set are EU countries.
1397660	1408020	And what we found was quite interesting. We really see across the board that EU applications or countries based in the EU, if they're producing an application, they
1409540	1423140	typically requested less dangerous permissions than non-EU applications. And we can see that across the board, looking at location, looking at storage, and even sort of those anomaly permissions at the bottom there.
1423140	1431380	In some instances, for example, reading your contacts, no EU applications in our data set requested that dangerous permission.
1433480	1448560	So researchers and advocates we feel are a really important part of this ecosystem of COVID-19 applications and we had a few that we really wanted to mention because they're doing great research and our goal is to create things that are useful for researchers and advocates.
1448560	1461200	I think Fundación Carisma is one based in Colombia. They have done some really amazing privacy and security research of the applications and technologies that are being deployed in the country.
1461200	1474520	And we would love to be able to work with groups like this and groups like others who are focused on privacy evaluations to figure out, you know, how we can better create or support those efforts, in particular,
1474520	1485300	you know, understanding the ecosystem and publishing any sort of research and cross-publishing on our particular platform.
1485300	1498140	We have groups like Amnesty International who are also doing great work analyzing applications in accordance to sort of who's who and
1500120	1506140	in violating sort of privacy rights across the board across these applications.
1506360	1521440	We've got EFF who also is doing great work and we've got a really cool project who inspired us to start looking more closely at the dangerous permissions that we really wanted to mention, which is the exodusprivacy.eu.org project where that actually analyzes
1522760	1533560	Android applications to quickly determine how many trackers and how many dangerous permissions are being requested by the application.
1535740	1538620	So what now?
1539140	1548820	It probably feels a little bit like this. There are a lot of problems when it comes to these COVID-19 applications.
1548820	1553040	There are a lot of privacy issues that we mentioned. So,
1553600	1561900	we wanted to talk a little bit about opportunities here. And I think the first opportunity that we really feel strongly about is more privacy and security audits,
1561900	1570940	more privacy and security evaluations of these applications and publish them. Publish them publicly. If you're a government who wants to build trust and build transparency
1572420	1576680	to get more adoption of an application. This is one way we feel
1577460	1582880	could be really potentially impactful to get that higher adoption rate that's needed.
1584240	1595260	Better understand those adoption barriers to the Google and Apple exposure notification technology. I think this is one that we're particularly, you know, just interested in why there hasn't been more
1595260	1609140	adoption. It sounds like based off of some of the reporting over the last couple weeks that there's going to be some movement there coming up. So we're really excited to, again, make sure that it's clear in our application to users
1610420	1617940	which applications are more privacy respecting, not requesting dangerous permissions, not requesting location data,
1617940	1623540	especially as more governments are getting into the market to develop these technologies.
1623540	1632240	And we have a few other, you know, suggestions, opportunities, advocating for privacy respecting applications. Obviously, there are a lot of folks that are doing this already.
1632440	1645080	We mentioned some of them, but we need more folks doing it. And I think one of the things for advocates, they really need information and it's been hard to get it. And so projects like this, we hope, can be useful to advocates
1645080	1657260	to better inform, better create that narrative, and better create the argument for why privacy needs to be embedded in these applications from the onset, from the design.
1657500	1663140	And of course, I think transparency standards for COVID-19 application are truly needed.
1663560	1673740	Promoting open source technologies, transparent data collection and treatment, understanding and matching the function of the application with what is actually being requested in the application,
1673740	1676580	and thinking critically about that.
1679560	1689060	And sort of just a few final remarks. So, you know, we feel that the design decisions we're making right now really do have the potential for lasting impact on our privacy.
1689300	1694980	And when developing any technology, we should always be thinking about the impact that technology will have long term.
1694980	1705700	In times of crisis, sometimes it's easier to not think about that. And so really, we want to slow things down, make sure that privacy is being
1705700	1714560	considered and there are certain standards and expectations of governments creating these technologies to make sure that we're not creating
1715240	1719160	this lasting surveillance problem down the line.
1719160	1728900	And as we create these technologies, really making sure we're looking at the positive use cases for impact, but also the misuse cases, the negative use cases for deploying this technology
1728900	1735410	without taking the time to really design and embed privacy into these products.
1736200	1743420	And with that, we end there. We'll be taking questions on the DEF CON Crypto Village Discord channel.
1743420	1756920	But if you have any other questions, please contact us at info at covid19apptracker.org and thanks again for allowing us to present this project and giving us the opportunity. We really appreciate it.