Thread by @fs0c131y

1/ THREAD: 3 days ago, the @washingtonpost wrote about the North and South Dakota's Care19 #Covid19 app: "One of the first contact-tracing apps violates its own privacy policy".

I'm curious to see if this app respects the user privacy (spoiler: no)

washingtonpost.com/technology/202…

2/ On the South Dakota gov website we can read: "Your information is 100% anonymous and will be used in an aggregated form"

covid.sd.gov/care19app.aspx

3/ The 1st thing done by the app is to initialize @bugfenderapp. Their official description is "Remote Logger, Crash Reporter and In-App User Feedback"

4/ In an interview to MediaPost, Tim Brookins, explained his use of BugFender:
"For example, a user contacts support -- me -- and says "I went to place XYZ yesterday and Care19 didn’t work." I go to the Bugfender and look at their diagnostics [..]"

mediapost.com/publications/a…

5/ If you use BugFender in your app, you can send a key / value to the endpoint /device/keyvalue.

Care19 sends to BugFender:
- The package name
- The Android ID
- The user citizen code

6/ A citizen code, really? What is this code and where this code is used?

7/ The 1st time you open the app, you can choose between 3 studies:
- North Dakota
- South Dakota
- Other states

Yes, this is stupid. Whatever your choice, the same backend is used. The only difference is the citizen code.

8/ After clicking on 1 of the 3 choices, the app sends your choice to the server and the server is assigning you a citizen code: ND-XXX for North Dakota, SD-XXX for South Dakota.

Worth saying: If you choose "Other US States" the citizen code will be set to null.

9/ The app sends this citizen code to BugFender another time. During the device status update, the app sends:
- udid
- name
- language
- device type
- storage size
- storage available
- android id
- package id
- citizen code
- ...

10/ I almost forget, when you visit a place, the app sends the coordinates of the place but also your citizen code...

11/ To summarize:
1) The server assigned an unique citizen code to the user
2) The app sends this info among others unique and personal info about the user to BugFender
3) The app sends the citizen code with the place description you visit

12/ This is absolutely not anonymous at all.

13/ Bonus: The 1st time you use the app they ask you if your current location is your home location