Cybersecurity leaders call for independent review of any COVID-19 contact tracing apps

Privacy and cybersecurity experts from across Canada have called on all levels of government to ensure strict security and privacy measures before deploying contact tracing apps to monitor the spread of COVID-19.

Researchers across Canada, led by the National Cybersecurity Consortium (NCC) – an organization coordinating experts from 32 Canadian universities – issued a joint statement on best practices for protecting Canadians’ online privacy in light of the proliferation of these apps and of government interest in using them to help curb the spread of the COVID-19 virus.

“Contact tracing apps have a great potential to support tracking and managing the pandemic moving forward – they are a great example of the way governments can use technology to help handle challenges,” said Florian Kerschbaum, Director of the Waterloo Cybersecurity and Privacy Institute and co-founder of NCC. “We should absolutely use these apps, but we need to ensure that our privacy is respected at the same time.”

The statement represents the consensus views of nearly 100 experts across the country and builds on advice from the NCC that focuses on key challenges in cybersecurity and privacy. It emphasizes that any deployed contact tracer must meet certain privacy criteria and must be verified with independent external review by cybersecurity experts. Criteria include a simple and easy to understand app design and requirements for minimal data collection and a ‘sunset clause’ that would require the destruction of any data collected after an appropriate amount of time.

“Canadians should have a right to privacy in the online world; it’s an issue that should be talked about and debated publicly even in the face of this pandemic so that we ensure this right is balanced with other societal needs," said Kerschbaum. “Data protection and cybersecurity can be challenging at the best of times; ensuring governments in Canada agree on and follow best practices will be crucial to protecting Canadians during this crisis and in a post-pandemic world.”

Kerschbaum has also brought together a group of colleagues in the Waterloo Cybersecurity and Privacy Institute, members from faculties across the University of Waterloo to participate in a COVID-19 app task force to better inform the public debate on this issue.