Trinity researchers have hit out the Irish COVID Tracker app, saying that it does not adequately protect user privacy.
The researchers – Prof Doug Leith and Dr Stephen Farrell of the School of Computer Science and Statistics – said that the Google Play Services component of the tracking apps were “extremely troubling from a privacy viewpoint”.
Leith and Farrell examined contract tracing apps in operation in Germany, Italy, Switzerland, Austria, Denmark, Spain, Poland, Latvia and Ireland to evaluate user privacy.
They found that, while the government component of the app was “quite private”, the Google Play Services component was highly intrusive.
The services contacted Google approximately every 10 to 20 minutes and allowed the company to gather IP addresses, the international mobile equipment identities of phones, hardware serial numbers, SIM serial numbers, handset phone numbers and user email addresses.
In a press statement, Leith said the researchers think that the fact that “the Google/Apple component which does most of the “heavy lifting” in the apps needs to change.
Leith said that the government needed to remove a type of supercookie “that allows connections made by the same phone to be linked together over time” from the app.
When the contracting app is installed, it shares data with Google. “Most of the other European apps don’t do this (the Polish app is the exception)”, Leith said, “and we recommend the HSE app should avoid it too”.
Farrell said: “If there were a European league of COVID tracing apps, Ireland might be near the middle of the table at the moment. Google however deserve a yellow card for the privacy-invasive way in which they seem to have implemented their part of the overall tracing system.”
The School of Computer Science and Statistics is highly regarded, ranking first in Ireland and in the top 100 worldwide.
