key: cord-0933386-wuma3imy authors: Min-Allah, Nasro; Alahmed, Bashayer Abdullah; Albreek, Elaf Mohammed; Alghamdi, Lina Shabab; Alawad, Doaa Abdullah; Alharbi, Abeer Salem; Al-Akkas, Noor; Ali Musleh, Dhiaa Abdulrab; Alrashed, Saleh title: A Survey of COVID-19 Contact-Tracing Apps date: 2021-08-21 journal: Comput Biol Med DOI: 10.1016/j.compbiomed.2021.104787 sha: 4fe98ab7a1923e3acdaece74e004220f78a1584f doc_id: 933386 cord_uid: wuma3imy Recently, the sudden outbreak of the COVID-19 virus caused a major health crisis by affecting masses around the world. The virus, which is known to be highly contagious, has forced the research community and governments to fight the disease and take prompt actions by applying various strategies to keep the numbers under control. These strategies range from imposing strict social distancing measures, isolating infected cases, and enforcing either a partial or a full lockdown, to mathematical modeling and contact-tracing applications. In this work, we survey the current contact-tracing apps and organize them based on underlying technologies such as Bluetooth, Wi-Fi, GPS, geofencing, and Quick Response (QR) codes. We compare the main features of 22 existing applications and highlight each of the pros and cons associated with these different technologies. China [1] . It is mainly transmitted through droplets generated when an infected person coughs, sneezes, or exhales. The outbreak of COVID-19 is affecting communities, businesses, organizations, and the global economy, resulting in shortages of many goods in markets around the world. According to World Health Organization (WHO) reports, this pandemic has triggered an unprecedented need for digital health technology solutions for population screening, tracking the infection, prioritizing the use and allocation of resources, and designing targeted responses [2, 3] . COVID-19 had immense effects on society's health and everyday life. Tasks like attending the workplace or meeting friends somewhere were once unremarkable, but suddenly became difficult without applying precautions advised by WHO, such as social distancing, frequent hand washing, and wearing masks regularly [4] . Contact tracing emerged as a public health tool to battle and control the spread of infectious disease by identifying and monitoring people who were in close contact with an infected person. Contact means to be within 1 meter of a confirmed COVID-19 case for more than 15 minutes, to have physical contact with an infected person, or to provide care for COVID-19 patients without protective equipment within 2 days before the onset of disease and 14 days afterward [5] . In the case of COVID-19, confirmed contacts are required to quarantine for 14 days from the last point of exposure and to be monitored by health officials [6] . It is estimated that a person infected with COVID-19 can transmit the disease to two other people who were in contact for SARS-CoV-2 [7] , however the Delta variant is more contagious and spreads 50% faster than the original strain in US [38] . A recent study shows that about 17% of delta cases are in vaccinated people and patients stay in hospital slightly longer than did people infected with other variants [39] . Contact tracing should be conducted for all confirmed and probable cases where testing is not available. The goal is to reduce transmission and contain the disease. Contact tracing requires the collection and storing of contacts' personal and private data, including name, address, date of birth, relationship with the source case, and contact frequency J o u r n a l P r e -p r o o f and duration. Data protection is an essential part of this process. People's information must be protected during data collection, storage, and management. As life has gone on, people have needed to communicate and engage with other people in different areas for various reasons throughout their day. In those circumstances, preventing the spread of COVID-19 by only applying manual contact tracing and protection measures was not enough to mitigate the virus. Therefore, numerous contact-tracing apps were developed to identify people who may have been in contact with an infected individual for a certain amount of time, using various techniques such as Bluetooth, Global Positioning System (GPS), Quick Response (QR), and Wi-Fi; but are these apps and methods trustworthy? In this paper, some of the apps and their methods are reviewed, along with their merits and demerits. Table 1 and Table 2 provide a statistical summary of some COVID-19 contact-tracing applications for Android, HarmonyOS, and iOS in various regions. As shown in Table 1 , many factors may influence whether or not people download an application, such as the age rating or the version availability. The technology used could also be one of the major factors, as people who own a HarmonyOS based mobile might not be able to use contact-tracing apps that are based on Google services. Though Huawei is considered to be the second-largest smartphone manufacturer globally, since May 2019 it has been declared that Huawei would no longer have access to Google services in its upcoming products [8] . Other factors might be that some applications are not mandatory to download, such as Alhosn UA; but if an individual fails to install Alhosn UAE and contracts the virus, the individual will be at risk of AED 10,000 fines. On the other hand, instead of developing a new application, the Chinese government cooperated with technology firms to utilize an application that already existed for other purposes to fight COVID-19. Apps such as Alipay, which is a Chinese application with more than five million users that was developed for online payments, assign the user a colored QR health code after the J o u r n a l P r e -p r o o f user provides a national ID, name, and other personal information. Alipay health codes were first used in Hangzhou and then spread to more Chinese cities. WeChat app also assigns a health code for its users. Shown in Google Play, WeChat is a social media messaging application that has more than 100 million users. The health code dictates the movement of the user and the places they may enter. J o u r n a l P r e -p r o o f 5 We provide the background work in Section 2, where we discuss existing solutions under five subsections: Bluetooth-, Wi-Fi-, location-, geofencing-, and QR code-based. In Section 3, we evaluate various applications under each category and highlight associated limitations. The paper is concluded in Section 4. In this section, we present the key technologies that assist in developing contact-tracing solutions. Currently, many applications, such as Tabaud, Alhosn UAE, and BeAware, use Bluetooth technologies. Bluetooth-based contact-tracing apps use a wireless technique to detect the smartphones of nearby positive diagnosed cases that have Bluetooth activated in their app. The technology emits Bluetooth Low Energy (BLE) "chirps" and sustains a database exchange mechanism by recording a pseudorandom bit sequence emitted by the chirping smartphones, along with the estimated power of the chirp's delivery [9] . The BLE protocol allows the app to exchange a small amount of data with peers regularly, but communication with the server relies on traditional secure application protocols, e.g., Hypertext Transfer Protocols Secure (HTTPS). The impact on battery utilization for these protocols is related to the number of information exchanges [10] .  Bluetooth is already built into smartphones, allowing proximity detection with nearby Bluetooth-activated smartphones. However, there is a need to reengineer some features, as it affects the reliability of Bluetooth.  Bluetooth Low Energy records "contacts" between smartphones, rather than their location constantly, and is more precise [11] . J o u r n a l P r e -p r o o f  Using a bit sequence rather than the user's personal information helps to protect the user's privacy.  Users will receive a real-time notification whenever they are in the same location as an infected user.  Not everyone has Bluetooth turned on in their devices, due to privacy reasons and to improve battery life.  It depends on the user's honesty. The mechanism for allowing users to report themselves as positive will be decided by the relevant public health authority. In Google and Apple contacttracing technology collaboration, it was mentioned that mechanisms vary across regions; some public health authorities may allow users to verify a test result using a pin code, while others may provide different mechanisms for verification [12] .  High false-positive and false-negative rates. Obstructions between two smartphones can reduce the strength of received signals, so it might increase the calculated distance. COVID-19 can be spread through normal exhaled breath, speaking, shouting, or singing [13] . People usually stand face to face while talking, often with phones in their back pockets. David Labrique's study illustrates that human bodies drastically reduce Bluetooth signals and thus risk confounding apps that are trying to automatically detect close-proximity encounters between individuals. Furthermore, the fact that drywall does not adequately diminish the Bluetooth signal is likely to lead to high numbers of false positives [14] .  Potential man-in-the-middle attacks (including phishing attacks).  Unethical wireless device tracking, using the BLE information broadcast by the tracing app. This approach is based on Wi-Fi and whatever data influence, such as system logs ("syslogs"), that can be captured by the enterprise from the Wi-Fi networks of every contact tracing. This way, when the user gets tested for COVID-19 and then proceeds to enter the Media Access Control (MAC) address of J o u r n a l P r e -p r o o f the phone into the contact-tracing tool, these tools analyze Wi-Fi logs that are generated by the network and, specifically, association and disassociation log messages for this device [15] for different locations that the user has visited before. As the user walks from one location to another, the phone usually gets As observed from Table 3 , below are the advantages and disadvantages of the Wi-Fi-based technologies.  Wi-Fi is generally considered faster than Bluetooth, so the process of getting information is faster and easier due to the high amount of power caused by the high data rate.  Better coverage ranges from the base station that can reach to a hundred meters.  Can get better security if configured properly, which can help with some private information.  High availability: Wi-Fi is more available nowadays and can be accessed anywhere.  Wi-Fi cannot be accurate enough to get an exact measurement of the distance, especially outside of the access point range, so it can be considered coarse grained.  This method does not work in areas where Wi-Fi coverage is not available or strong enough, like outdoor areas, unlike Bluetooth, which is available everywhere "indoors and outdoors."  Privacy issues: The tool used is intended for tracing infected users, so putting in data for contact tracing can risk leaking users' personal information.  It is more complex to configure the hardware and software compared to other methods, so it can be more expensive to maintain.  Power usage: Wi-Fi can drain power due to a higher power consumption. A solution for privacy concerns is using hashed usernames and device MAC addresses that are anonymized, which means all private and personal information about the users is stored separately from the rest of the tools in a hashed identity, and not by their names, which only a small group of authorized people can access. J o u r n a l P r e -p r o o f GPS is a location-passed tracing tool. This tool is used to locate or trace people to identify individuals who have been exposed to or infected with COVID-19. Using GPS signals, an application will collect and record user movements as coordinates with a timestamp. The application looks for matches in a multidimensional grid of longitude, latitude, and time [16] . The system is composed of a user device that sends the location and a server that stores and encrypts the data. GPS is mostly used to enforce a quarantine on COVID-19 patients with an application that would highlight areas where a high number of COVID-19 cases are located. GPS location tracking requires the users to always have their phone charged and working, with location tracking enabled [17] .  Low cost: Most smartphones are GPS-enabled, are considered low cost, and can be easily deployed.  Security: GPS location tracing is vulnerable to attacks such as spoofing, where someone can use a false GPS signal to send incorrect location and time. Jamming attacks occur when preventing the GPS-enabled device from determining its position by interfering with the signal using radio signals of the same frequencies [16] .  Range: The range of GPS can be from 5 to 10 meters. GPS performs poorly indoors and in bad weather such as thunderstorms and when the user is surrounded by tall buildings [18] . Multistory buildings raise a problem where the GPS cannot recognize that two people are in different stories and not in close contact, which could also be considered an accuracy problem.  Privacy: Using GPS for location tracking raises some privacy concerns by storing user location, identity and related information in a database without encryption. Location tracking applications store device information such as system version and device model [19] . There is also a concern of an unlawful use or abuse of the data collected, or unauthorized access to other files saved in the mobile device [20] .  Power consumption: Applications that use GPS require location services to be always enabled, which drains the device battery. GPS has a higher power consumption than Bluetooth. Geofencing is a location-based technology that works by surrounding a specific geographical area with a virtual fence from the center of its location points by setting a latitude, longitude, and radius. This technology provides device detection when crossing the boundaries of the surrounded geographical area, which can help to trigger the device's information and can also alert its user when crossing the area's virtual fence [21] . The Application Programming Interface (API) of geofencing uses the device's sensors to monitor its movement, such as tilting, entering or exiting the area, and whether it is still or moving (by foot or a vehicle). It then generates activity events that consist of location coordinates and the recognized activity that can be updated continuously or regularly, depending on the need, and can be saved to a digital diary for future use [22] . Geofencing can be implemented in three different ways: Global Positioning System (GPS), Wi-Fi, and Bluetooth, each with its own methods and systems. To implement geofencing by using GPS services, the program has to access the GPS chip that exists in each device. The chip works as a receiver for radio signals from orbiting GPS satellites to acquire location data. After GPS services are accessed, the program made can then track the device's movement as required [22] . Another way to implement geofencing is by using Wi-Fi. Wireless enhanced services enable any device that is connected to the Internet, either Wi-Fi or cellular service, to be located geographically using radio location techniques (angle of arrival, time difference of arrival, and location signature) to determine the distance, time slots, and position of the device. Both GPS and Wi-Fi services can be used together as a hybrid positioning system [23] . An alternative way to implement geofencing is to use Bluetooth or BLE. BLE can broadcast radio frequency signals, including the position coordinates, along with other positions as it creates the borders of the geographical area. These signals J o u r n a l P r e -p r o o f can be recognized by nearby devices via Bluetooth or BLE. To reduce usage of mobile power, BLE is very preferable to regular Bluetooth because it consumes less energy [24] . All the mentioned ways to implement geofencing are used in the device operating system layer that is integrated directly with hardware and can be accessed easily to obtain location data services, but they each use different hardware. USD monthly, which is considered a reasonable price [25] .  Monitors device movement: This technology can recognize various movements of a device, for example, when it enters or exits a specific area, which is very helpful for tracking systems [22] .  Area coverage: Geofencing can cover a bigger land area than any other technology, which is a beneficial feature.  Virtual fencing: Unlike other technologies, geofencing can create virtual bounds to any area defined by the programmer, which allows the creation of specific areas depending on the need of an application.  Continuous consumption of mobile power: Most tracking applications, in particular, require background tracing of the device to track its movement, which can drain the device's energy. This problem can be solved either by implementing geofencing with BLE instead of GPS, in order to consume less power, or by using trigger services that are defined by an external J o u r n a l P r e -p r o o f application server to update the device's position periodically or when a triggering event (such as movement) occurs [26] .  Lack of privacy: As the application performs background tracing, it keeps track of the user's recently visited places, such as workplace, medical appointments, or other personal places, and that may seem nonthreatening, because data is kept and stored anonymously. However, when an attacker gains access to this data, it violates privacy and poses threats to the user. A solution to this issue is to give users a choice to choose the locations they are traced to, like public places, so no harm will be done if an attacker accesses their information. But that can be an obstacle when creating an application to track infected people. An alternative is to encipher the location data multiple times in different ways, or to add blurring to the positioning [26] .  Positioning accuracy: Some implementation methods, like GPS, can be subject to a significant unacceptable margin of error, but some algorithmic techniques can be applied to reduce the margin of error to a reasonable percentage [27] .  Activity event recognition uncertainty: There is a chance that some movement events will be delayed, wrongly identified, or won't be recognized. This can manipulate the events within a time frame and give unreliable results due to faulty movement entries [22] . Recently, many applications have been using QR codes as a feature to contain and reduce the spread of the pandemic and its harms: for instance, NZ COVID tracer (New Zealand), Druk Trace (Bhutan), and Alipay app with a health code feature added. There are two categories of QR code approaches available for contact tracing: location-coupled QR contact tracing and symptom-based QR health code, and there are several concepts for using QR health code techniques in contact-tracing apps. The symptom-based QR health codes, which are released by health authorities, include two colors to identify the health status of individuals. The green code specifies that the person is not infected, while the red code indicates that an individual is either infected or has a high probability of being infected. The color of the QR codes is demonstrated in Figure 1 . The information in the code is read and analyzed J o u r n a l P r e -p r o o f using QR scanners automatically, which reduces errors, improves the credibility of the data, and increases the speed of processing compared to manual operation. The core idea of the design is to ensure users' privacy by avoiding retrieval of the location data of users. Contact tracing, exposure risk, selftriage, health status self-updating, health care appointments, contact-free psychiatric consultation, and QR codes for other family members are all significant features that are integrated in the symptom-based QR health code [28] . codes, which are required for entry into public places [29] . The travel of an individual is tracked based on these records using a big data system [30] . This technique detects whether individuals are healthy or  While controlling highly infectious diseases, the integration of features on one identical platform in a centralized approach can fix the delays in data sharing, instead of the personal self-reporting that is usually used in a decentralized approach.  By providing self-triage for individuals and self-scheduling for institutions, it helps to balance the burden on overburdened health care systems.  It plays an important role in counteracting COVID-19 due to its credibility, traceability, and interoperability.  It accurately identifies individuals who were in close contact with an infected individual.  It ensures users' privacy by avoiding retrieving the location data of users.  Acceptance of this approach by the population: Due to individuals' worry about maintaining privacy, some do not rely on or trust applications that use QR codes, causing a decrease in the number of individuals downloading the application [28] .  Unauthorized and illegal use of healthcare information is detrimental and caused an average financial loss of nearly $9.23 million worldwide in 2021, according to reports [32] . In addition, it can damage the reputation of service providers and negatively impact the confidence and health of patients, which leads to decreased populationadoption rates. Therefore, it is essential to prevent malicious or unauthorized use of QR data.  Data is not accurate enough to identify all the contacts, in contrast to GPS data [33] . J o u r n a l P r e -p r o o f Google and Apple recently collaborated to create the "Coronavirus Exposure Notification System" for contact tracing in both Android-and iOS-operated devices to help governments and communities fight this pandemic and limit the spread of COVID-19. The feature operates by using Bluetooth to keep track of users' nearby devices by detecting their signals in a specific range within 5-minute intervals and storing them in the database. It does not require storing any location data, but it stores the deviceassigned code generated using a cryptographic key that is changed once a day. The cryptographic key and code assignments are done by the applications developed by any health department or government integrated with the "Coronavirus Exposure Notification System" to create a functional and effective application. This system works by constantly broadcasting Bluetooth unique codes from each device and limiting any snooping or eavesdropping on those codes to track a person's movements by switching up the numbers every 10 or 15 minutes. When users are registered as positive, their app should upload the cryptographic keys that were used to generate their devices' codes over the last two weeks into a server. Later on, other device apps should download the used daily keys to recreate the rotating codes that were generated. If there is a match with any of the stored codes, the app will notify any persons with an exposure and show them some precautionary procedures. This "Coronavirus Exposure Notification System" is directly integrated with the operating system and provides higher user privacy than other features because it does not store any physical location [34] [35] [36] . Contact tracing apps are expected to be integral part of smart cities and campuses [37] .  High security and reliability: The built-in system is directly integrated with the operating system; therefore, it is more secure and reliable to use because it works closely with the hardware layer [33] .  High privacy: The built-in system traces users by their broadcasted code and not their physical location, making it harder to know the users' identity and information [34] . J o u r n a l P r e -p r o o f  Easier to integrate with applications: Google and Apple made it easier for governments and health organizations to create their own contact-tracing applications by using their unified platform feature in both Android and iOS [34] .  Inaccurate device detection: Because the built-in system is based on Bluetooth services, that can increase the percentage of undetected or erroneously detected devices, which can lead to receiving false notifications about exposure [34] . In this section, the applications are grouped based on the approaches used, and some of their pros and cons are mentioned. -Users must enter their mobile number. The information for the applications above was collected from the reviews in the smartphones' official application stores, as well as the applications' official websites, and from our personal use of them in October 2020. Given the nature of the applications under the scope of this study, there are some limitations to be noted. Access to some of the private data of the applications is very limited due to the privacy restrictions of the covered regions. Another point of data restriction is the dependency on the number of active users per app. The number of active users can give a good estimate of the effectiveness of the app functions regarding the COVID-19 pandemic. However, not everyone opts to activate these applications on their phones, resulting in a low data representation. Finally, those applications are constantly being upgraded. Therefore, the data analysis process may be impacted by constant feature changes. Various contact-tracing apps were reviewed, and it was concluded that a good tracking application to contain the pandemic of COVID-19 requires inclusion of some features like accuracy of positioning and users' privacy for it to be reliable and safe to use. Going over the possible ways to implement contact tracing with their benefits and drawbacks, it was revealed that some of them, like Wi-Fi-based solutions, are impractical due to the unavailability of Internet access at all places to all people. QR codes were considered a good option at first, but the certainty of users' honesty in scanning the codes is not high unless there is an external factor. Also, geofencing was the most inaccurate way to position a device; therefore, QR and geofencing were dismissed from consideration, but they might be used for other functionalities in applications, like scanning results or providing an informative COVID map. The remaining possible technologies, Bluetooth or BLE and GPS, can be considered knowing their associated features and issues. After researching these technologies, GPS and Bluetooth were found to be the most utilized and most practical because they have fewer issues compared to other technologies and are more suitable options for contact-tracing implementation, although GPS has some features that suit our methodology more. Choices J o u r n a l P r e -p r o o f 34 will be evaluated in depth to determine what is the best implementation option with the fewest flaws, with the chance of including the idea of using more than one technology to present a better tracking application. World Health Organization, Coronavirus disease (COVID-19) pandemic Coronavirus in China World Health Organization, Digital technology for COVID-19 response World Health Organization, Advice for the public on COVID-19 World Health Organization, Contact tracing in the context of COVID-19 World Health Organization, Considerations for quarantine of contacts of COVID-19 cases Severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) and coronavirus disease-2019 (COVID-19): the epidemic and the challenges The Huawei ban: everything you need to know Using Bluetooth Low Energy (BLE) signal strength estimation to facilitate contact tracing for COVID-19 A survey of COVID-19 contact tracing apps Can mobile contact-tracing apps help lift lockdown? Exposure notifications: frequently asked questions COVID 19 can spread through breathing, talking, study estimates Quantifying SARS-CoV-2 transmission suggests epidemic control with digital contact tracing WiFiTrace: network-based contact tracing for infectious diseases using passive Wi-Fi sensing Applicability of mobile contact tracing in fighting pandemic (COVID-19): issues, challenges and solutions World Health Organization, Digital tools for COVID-19 contact tracing The limits of location tracking in an epidemic A study of the privacy of COVID-19 contact tracing apps Integrating emerging technologies into COVID-19 contact tracing: opportunities, challenges and pitfalls Destination alarm notification for public transportation passenger using geo-fence in mobile app Mobile crowdsensing of parking space using geofencing and activity recognition Geo fencing system and method Beacon-based geofencing Geofencing and background tracking -the next features in LBS Geofencing on the real-time GPS tracking system and improving GPS accuracy with moving average, Kalman filter and logistic regression analysis A QR code-based contact tracing framework for sustainable containment of COVID-19: evaluation of an approach to assist the return to normal activity In coronavirus fight, China gives citizens a color code Using information technology to manage the COVID-19 pandemic: development of a technical framework based on practical experience in China Digital contact tracing can slow or even stop coronavirus transmission and ease us out of lockdown Cost of a data breach study A new system for surveillance and digital contact tracing for COVID-19: spatiotemporal reporting over network and GPS Exposure notifications: helping fight COVID-19 Deployment of real-time systems in the cloud environment Impact of lockdowns on the spread of COVID-19 in Saudi Arabia Smart campus-A sketch Things To Know About the Delta Variant This section provides a list of existing contact-tracing applications.