Privacy and Integrity Threats in Contact Tracing Systems and Their Mitigations

Abstract

Several countries adopted the Google and Apple exposure notification system (GAEN) to slow the spread of the SARS-CoV-2 virus down. GAEN promised to guarantee security and privacy through a decentralized approach. In this article, we report several relevant privacy and integrity threats in GAEN, including new attacks. GAEN’s security issues are not inherent risks of contact tracing systems. Indeed, we also propose a system named Pronto-B2, which enjoys a much better resilience with respect to mass surveillance and replay attacks.