Next Article in Journal
Modeling Intruder Reconnaissance Behavior through State Diagrams to Support Defensive Deception
Next Article in Special Issue
Assessing the Security and Privacy of Baby Monitor Apps
Previous Article in Journal
Deep Learning and Machine Learning, Better Together Than Apart: A Review on Biometrics Mobile Authentication
 
 
Font Type:
Arial Georgia Verdana
Font Size:
Aa Aa Aa
Line Spacing:
Column Width:
Background:
Article

A Lesson for the Future: Will You Let Me Violate Your Privacy to Save Your Life?

Department of Mathematics and Computing, Faculty of Science and Technology, Mount Royal University, Calgary, AB T3E 6K6, Canada
*
Author to whom correspondence should be addressed.
J. Cybersecur. Priv. 2023, 3(2), 259-274; https://doi.org/10.3390/jcp3020014
Submission received: 18 May 2023 / Revised: 11 June 2023 / Accepted: 12 June 2023 / Published: 14 June 2023

Abstract

:
COVID-19 was an unprecedented pandemic that changed the lives of everyone. To handle the virus’s rapid spread, governments and big tech companies, such as Google and Apple, implemented Contact Tracing Applications (CTAs). However, the response by the public was different in each country. While some countries mandated downloading the application for their citizens, others made it optional, revealing contrasting patterns to the spread of COVID-19. In this study, in addition to investigating the privacy and security of the Canadian CTA, COVID Alert, we aim to disclose the public’s perception of these varying patterns. Additionally, if known of the results of other nations, would Canadians sacrifice their freedoms to prevent the spread of a future pandemic? Hence, a survey was conducted, gathering responses from 154 participants across Canada. Next, we questioned the participants regarding the COVID-19 pandemic and their knowledge and opinion of CTAs before presenting our findings regarding other countries. After showing our results, we then asked the participants their views of CTAs again. The arrangement of the preceding questions, the findings, and succeeding questions to identify whether Canadians’ opinions on CTAs would change, after presenting the proper evidence, were performed. Among all of our findings, there is a clear difference between before and after the findings regarding whether CTAs should be mandatory, with 34% of participants agreeing before and 56% agreeing afterward. This hints that all the public needed was information to decide whether or not to participate. In addition, this exposes the value of transparency and communication when persuading the public to collaborate. Finally, we offer three recommendations on how governments and health authorities can respond effectively in a future pandemic and increase the adoption rate for CTAs to save more lives.

1. Introduction

COVID-19 hit Canada in Toronto on 25 January 2020, and it continued to spread and claim many lives. To slow down the spread of the virus, the Canadian government implemented several measures, such as mask mandates, social distancing, shields, limits on gatherings, COVID screening, and vaccinations. These measures were mandatory for businesses and citizens to follow.
However, the personal usage of CTAs was optional. In other words, Canada’s approach to CTAs allowed for the decision to be left up to its citizens on whether to download the application. While only 16% of Canadians installed Canada’s national CTA, COVID Alert [1], studies show adoption rates of at least 60% For CTAs to be effective [2]. If only a minority downloads the application, positive COVID-19 cases can be missed, and other people within the vicinity during the same time window cannot be traced, which makes the app ineffective.
As a result, CTAs were never effective as expected in Canada. It was not because of technical issues or poor development practices, but privacy concerns discouraged individuals from utilizing these technologies. These concerns became more pervasive when many security experts raised security and privacy concerns over CTAs in May 2020 [3]. As this was the case in Canada and mostly in Western countries, a few other countries made it mandatory for citizens to download a CTA on their smartphones to track their geolocation and notify them when a positive case of COVID-19 is reported in their vicinity recently. Although this would violate the citizens’ rights to privacy, this approach would allow the health authorities to effectively monitor the spread and containment of the virus. For example, in South Korea, downloading the CTA was mandatory. Due to this and other forceful measures, the country has seen significantly fewer cases and deaths caused by COVID-19 than Canada.
This comparison between the outcomes of COVID-19 in Canada and South Korea becomes much more staggering when we consider that South Korea has around 14 million more people (~35%) and a population density of 527 people per km2 compared to Canada’s four people per km2. It then comes to the question that, if Canada made CTAs mandatory, would the cases and deaths have been similar to those of South Korea? Additionally, if citizens of Canada were aware of the positive influences that a CTA could introduce, would they have downloaded it to their smartphone and contributed to their country’s safety?
To answer these questions, we surveyed the citizens of Canada to determine whether the lack of CTA participants was due to a lack of information. We conducted a study that focused on three main questions: what is your current knowledge of CTAs? Did you know that their implementation has effectively saved many lives in South Korea? Knowing this, would you use a CTA in a future pandemic? Moreover, we acquired the participants’ demographic information and concerns during the pandemic (no questions regarding personal losses or infections from COVID-19).
Following the initial questions, we gathered the participants’ general experience with the pandemic. This involved if they were concerned for their wellbeing and the government’s handling of the situation. Additionally, we asked whether the participants had received at least one vaccination. This section determined any correlation between participants’ experience with the pandemic and their stance on CTAs.
We then gathered the participants’ knowledge of CTAs. This focused on whether they were aware of their existence, specific applications they had heard of, and if they downloaded any. It is possible that, if the participant had not heard of CTAs or their usefulness, they would less likely be willing to participate.
The next set of questions gathered the participants’ opinions of CTAs. This focused on if the participant believed in their importance in preventing the spread of a virus, their concerns when using the application, and if they would be open to sharing their personal information for contact tracing purposes. Next, we asked if they believed CTAs should be mandatory and whether or not they would trust governing agencies with their personal data. This was used to base the general public’s opinion of CTAs. This section’s results will be compared to the last section after we present the participants with our findings.
After questioning the participants, we presented them with our findings (see Section 4) on South Korea’s handling of the pandemic and that their mandatory implementation of CTAs (as well as other mandatory measures) resulted in a significantly less infection and death toll than Canada. This section included graphical representations of the direct comparisons between Canada’s and South Korea’s COVID-19 cases and death tolls.
Finally, we again questioned the participants’ opinions on CTAs to detect if there would be any deviations from their original stance. We asked if they would use a CTA in a future pandemic and if they would trust a government or a recognized third party with their personal information. We then asked again if the participant believed that, in a future pandemic, CTAs should be mandatory and if they would recommend their peers to download them.
While previous studies [4,5,6,7,8,9,10] have examined the privacy and security aspects of contact tracing apps during the COVID-19 pandemic, our research aims to go beyond these investigations. In addition to evaluating the existing concerns, we place special emphasis on the impact of educating the public regarding these issues. Our research takes a comprehensive approach by exploring the positive impact of educating the public about the benefits of these apps in halting the spread of viruses and reducing mortality rates in other countries. By highlighting success stories and demonstrating how contact tracing apps have been effective in curbing the transmission of infectious diseases, we aim to foster a deeper understanding among individuals about the potential of these apps in mitigating future pandemics. We believe that, by emphasizing the positive outcomes achieved through contact tracing apps, we can inspire and motivate the public to adopt and utilize these tools in future pandemic scenarios, further strengthening global efforts to prevent the rapid spread of infectious diseases and to minimize the associated health risks. This unique aspect of our research sets our work apart from previous studies.
The main contributions of this work are as follows.
  • First, we study and investigate the security and privacy techniques employed in Canada’s Contact Tracing Applications and assess the validity of the public privacy concerns about CTAs.
  • We then compare Canada’s and South Korea’s COVID-19 restriction policies and protocols. We also provide a thorough demographic and environmental comparison that may influence and impact the number of COVID-19 cases, those hospitalized, and deaths across both countries.
  • We conduct a survey gathering participants’ demographic information, opinions, and knowledge of CTAs before and after presenting our findings. We then conduct an in-depth analysis of the collected data from participants across Canada.
  • We use this data collection and our findings to provide three suggestions\recommendations on how governments and health authorities can respond effectively in a future pandemic and increase the adoption rate for CTAs to save more lives.
The rest of this paper is organized as follows: Section 2 presents the related work, and, in Section 3, we investigate the Canadian contact tracing application, COVID Alert. Section 4 studies and explains Canada’s performance during the COVID-19 pandemic and compares it with other countries, such as South Korea. Section 6 describes our methodology and presents our findings. We discuss our findings in more detail in Section 7 and provide three suggestions. Finally, Section 8 summarizes our conclusions.

2. Related Work

This paper investigates the security and privacy of Canada’s CTAs and Canadians’ opinions on CTAs. Hence, in this section, we first briefly introduce the state-of-the-art CTA approaches. We then review related work that studies public opinion on contact tracing applications.

2.1. Contact Tracing Protocols and Applications

In the last few years, several contact tracing applications have been developed to stop the spread of the coronavirus [4,9,10,11]. From the software architectural view, CTAs employ either “centralized” or “decentralized” architecture solutions. While centralized apps store anonymized data on a central server, decentralized apps keep the data on the users’ devices, providing more control over data. However, there is also a third model, the hybrid model, that benefits from both centralized and decentralized worlds [12,13].
In particular, DP-3T [13] is a decentralized privacy-preserving proximity tracing protocol designed by researchers from European institutes and universities. The protocol leverages Bluetooth technology and symmetric encryption techniques, such as SHA-256 and AES-128. The contact history logs are stored on the users’ devices and will not be transmitted to a central authority unless a user tests positive.
TraceTogether was one of the first CTAs that was developed and released by Singapore’s government [12]. TraceTogether employs a privacy-preserving protocol called BlueTrace. BlueTrace adopts Bluetooth technology, in which devices exchange digital beacons (i.e., digital IDs) and store all encounters in their history logs. Although BlueTrace employs decentralized architecture, identifying and notifying the exposed individuals are performed in a centralized center. Hence, BlueTrace is considered a hybrid protocol. Moreover, it leverages a symmetric key encryption scheme (AES-256-GCM) for efficiency considerations.
Google and Apple [14] also made a joint effort to help health and government agencies to reduce the spread of the COVID-19 virus. Both companies agreed on a decentralized approach using Bluetooth technology. In their approach, users’ ephemeral IDs are stored on the users’ devices and are generated using AES-128 and HMAC-SHA-256. However, their introduced protocol is an Application Programming Interface (API) that can be leveraged by public health authorities to develop their own mobile applications. SwissCOVID app, Protect Scotland app, and Immune are just a few CTA examples that are developed using Apple and Google API in Swiss, Scotland, and Italy, respectively.
Alipay Health Code is the CTA app that was developed in China. It leverages a centralized architecture and Global Positioning System (GPS) technology. The GPS-based system collects and stores individuals’ geographic locations on a 24/7 basis. South Korea also employed the centralized architecture to develop their contact tracing app, Corona 100 m (Co100). Besides GPS technology, the app uses government-collected data, such as surveillance camera footage and credit card transactions. The app alerts users when they are in a close vicinity, 100 m, of a location visited by an infected person.
Thus far, 120 contact tracing applications have been developed worldwide [15]. Table 1 shows a short list of CTAs, including the employed technology and software architectures.

2.2. Public Opinion on Contact Tracing Applications

Although many contact tracing applications were implemented to facilitate and expedite the case investigation process, the adoption was considerably low. Studies [2] show that the adoption rate is a significant measure to contain the spread of COVID-19. However, several discouragements, including privacy and security risks, dissuaded individuals from utilizing these technologies.
Li et al. [16] studied Americans’ willingness to install CTAs after informing them about primary CTAs’ architectural designs (e.g., centralized and decentralized). Contrary to previous studies, their results demonstrate that most participants preferred installing centralized CTAs apps. Furthermore, their results indicate that contact tracing apps that use a centralized architecture with solid security protection and provide users with other helpful information, such as hotspots of infection in public places, may achieve a high adoption rate in the U.S.
O’Callaghan et al. [17] also conducted the same study in Ireland. They explored public opinion about the Irish CTA, “COVID Tracker”. The study shows a willingness to put up with a certain amount of inconvenience for the greater good. To improve adoption rate and usefulness, they suggest providing evidence and informing the public about the impact of contact tracing applications.
Simko et al. [4] also studied public opinion regarding contact tracing applications in another study. They focused on the privacy aspect of the CTAs and ran a seven-month online survey. They argued that public opinion is largely stable over time, and users have significant and diverse privacy concerns about CTAs. They suggest considering user values and concerns in the CTA development process to achieve a higher level of user cooperation.
Kostka et al. [5] examines public perceptions and acceptance of COVID-19 Contact Tracing Apps (CTAs) in China, Germany, and the United States. The study finds that acceptance rates vary among the countries, with China having the highest acceptance rate and Germany and the United States having lower rates. Factors influencing acceptance include perceived effectiveness of the apps, previous experience with CTAs and health apps, privacy concerns, and trust in the state. The study suggests that, while China’s high acceptance can be attributed to the mandatory nature of CTAs, acceptance in Germany and the US is influenced by the perceived usefulness and concerns about privacy and surveillance.
Williams et al. [6] also believe that the CTA adoption rate is heavily influenced by moral reasoning. Their results indicated insufficient knowledge about contact tracing apps, and privacy concerns were the most significant reasons preventing individuals from adopting CTAs.
Most of the conducted studies [4,5,6,7,8,18] show that privacy concerns and lack of knowledge about contact tracing apps were the primary reasons that discouraged individuals from adopting CTAs.

3. Canada’s Contact Tracing Application

A few months after the beginning of the pandemic, most provinces in Canada acknowledged that the virus was here to stay. The first two years, however, have been a very different story, as each month garnered a new spike in COVID-19 cases and further restrictions to prevent its spread. One of these prevention methods was CTAs, which, although not widely adopted within Canada, did exist to lessen the spread of COVID-19. We now go into more detail on the methodology behind the Canadian CTA and its resourcefulness during the pandemic.
Originally, contact tracing was conducted by a team of public health experts, tracking individuals that have been infected by the virus or have been in contact with those that have been infected. Automated CTAs attempt to replicate this by using geolocation to track an individual’s whereabouts while they were within public spaces while infected and using notifications to alert others to avoid these spaces. CTAs replace the intensive manual labor required to track millions of people. To accomplish this, however, they require the active participation of the majority of the population to effectively track those infected with the virus.
“COVID Alert” is Canada’s contact tracing application that the federal government of Canada launched on 31 July 2020. Participation was voluntary, and the collection of personal data was governed by Canada’s Privacy Act [19]. The app leverages Bluetooth technology and employs Apple\Google API, which is a decentralized architecture. Each user receives and broadcasts randomly generated IDs from and to the other users within the user’s vicinity. Users who test positive for COVID-19 can anonymously notify other users of possible exposure.
The app collects and stores randomly generated IDs on users’ phones for 14 days. In addition, IDs of other app users’ phones within a certain distance will also be stored to identify potentially infected users in the future. These random IDs are stored only on users’ phones and not with any governmental authorities. Moreover, the app does not collect or store data about a user’s identity, location, name, address, phone contact, or health information. All random IDs collected by COVID Alert are deleted after 14 days. In addition, users can delete the app from their phones and wait for 14 days until the data be automatically deleted. Users can also choose to delete the Exposure Logs manually [20].
Moreover, the user’s consent is required to disclose information about a positive COVID-19 case. Once the consent is collected, the COVID Alert app immediately notifies potentially exposed users. In other words, the app sends out alerts to users that have spent a minimum of fifteen minutes within a two-meter distance of an infected user.
However, COVID Alert has been downloaded about 6.86 million times and reported about 57 thousand cases [1], which are about 18 percent of Canada’s population and less than 2 percent of total positive COVID-19 cases in Canada.

4. Canada’s COVID-19 Performance

The first known COVID-19 case in Canada was diagnosed in Ontario province on 25 January 2020 [20]. Since the pandemic’s start, 4.4 million COVID-19 cases and 47,087 deaths have been reported in Canada. In addition, more than 63 million tests and 93 million doses of vaccine have been administrated up to this moment.
Compared to other countries, such as Germany, Italy, the United Kingdom, and France, Canada has performed better in many criteria. For example, Canada’s cumulative per-capita rate of COVID-19 cases was less than half of cases in Italy and approximately one-third of cases in the United Kingdom (see Figure 1). Moreover, more than eighty percent of Canadians were fully vaccinated by March 2022, while it was considerably less in other countries, such as the United Kingdom, United States, and Germany (see Figure 2).
However, Canada’s performance, especially during the first and second waves, was not as good as in a few other countries, such as South Korea. For example, the first COVID-19 case in South Korea was diagnosed on 20 January 2020. On 1 March, South Korea had the highest number of COVID-19 cases, with 3736 confirmed cases, among other peer countries, such as Canada, which only had 38 cases then. However, everything completely changed at the end of the same month, 31 March. The number of COVID-19 cases in South Korea became the lowest, with 9786 positive cases among the peer countries, such as France, with 52,229, and Canada, with 10,711 COVID-19 cases. Table 2 provides more details about the number of confirmed COVID-19 cases among peer countries in our research.
In this study, we also considered that many other factors, such as population, population density, size of the vulnerable population, and strength of the healthcare system, play a significant role in confining and eradicating the virus [22]. Hence, in the next step, we studied and investigated these factors between Canada and South Korea. Compared with South Korea, the population of Canada is about 27% smaller. Moreover, South Korea’s population density is more than 100 times bigger than Canada’s. Even the most densely populated city in South Korea, Seoul, is about three times bigger than the most densely populated city in Canada, Vancouver. Table 3 shows our findings in more detail.
Considering this data, Canada should have performed much better than South Korea; however, as we demonstrated in Table 2, that was not the case. As a result, 47,661 Canadians have died since the beginning of COVID-19, while 29,925 deaths have been reported in South Korea. This means that, if we only consider the population size and ignore other factors, such as population density and vulnerable population, Canada could have experienced 12,869 fewer deaths (27%) if Canada had applied the same policies and protocols that South Korea employed. Note that this number increases when we consider the other factors shown in Table 3 (e.g., more lives could have been saved).
Hence, in the next section, we study and compare safety policies and protocols employed in Canada and South Korea to find the reasons that caused this significant difference in the number of confirmed cases and deaths between these two countries.

Comparing COVID-19 and Health Policies between Canada and South Korea

Public health in Canada consists of three oversight levels—federal, provincial, and regional. While the federal government provides healthcare funding for the territories and provinces, Canadian constitute grants jurisdiction to the provincial governments over the administration and delivery of health care services [23]. During the pandemic, all federal, provincial, and regional sections worked closely to implement the required health services, such as contact tracing and testing. In addition, they set policies and recommendations, such as social distancing.
Closing schools, universities, nonessential businesses, and public playgrounds were among the very first steps that the provincial governments took in March 2020 to help the pandemic. The federal government also limited the incoming international flights and eventually closed the borders, including the land border with the US. Later, the COVID Alert app was released. In the beginning, wearing masks were recommended, and then it became mandated. Many provinces established drive-through COVID-19 testing centers that were carrying out thousands of tests in a single day. Potentially infected individuals who were in contact with a patient were being traced and contacted to be tested. A 14-day self-quarantine and isolation plan was put in place to prevent the introduction and spread of the virus.
Similar to many other countries, South Korea also employed a three-step protocol that includes testing, tracing, and isolating to confine and eventually eradicate the spread of the deadly virus. However, contrary to other courtiers, South Korea implemented the most elaborate contact tracing program [24]. Following the MERS outbreak in 2015, which drastically impacted South Korea’s citizens and economy [25], lawmakers reinforced new laws and privacy acts to contain epidemics. In a case of an emergency, authorities are permitted to access and analyze significant types of information, including facility visit records (e.g., pharmacies and medical facilities), cellular GPS data from cell phones, credit card transaction logs, and closed-circuit television [26]. This allowed the public health authorities to effectively and quickly trace and contact the potentially infected citizens, which helped to prevent the further transmission of COVID-19. Moreover, the government’s website published information about all new infection cases to inform people.
South Korea’s deep and elaborate digital contact tracing program was highly effective and certainly contributed to Korea’s effective control of the early spread of the virus [27]. The golden time to respond to an epidemic is the first few weeks, and as it is shown during the last COVID-19 outbreak in South Korea, the digital contact tracing program plays a vital role in managing and controlling the epidemic. Note that once the information is analyzed and the results are provided, proper actions should be taken to achieve the desired goal. For example, COVID-19 tests should be carried out for the potential infected individuals. Since Canada performed very well in this area, we did not place this factor (e.g., having sufficient testing kits and professionals) among Canada’s weak points. Figure 3 shows the number of COVID-19 tests administered during the pandemic.
Hence, employing an elaborate digital contact tracing program was one of the biggest, if not the biggest, differences between Canada’s and South Korea’s COVID-19 action plan. This is an important factor that has also been studied recently in the UK [28], which confirms our point about the importance of digital contact tracing. This study estimates several hundred thousand infections were prevented by widely adopting the NHS COVID-19 app [28]. Note that Canada was in a better condition in every other aspect, from the population size to the number of carried out tests, except in adopting digital contact tracing. Nevertheless, it seems unlikely that South Kore’s digital contact tracing program would prove acceptable in countries, such as Canada, where people are profoundly concerned about the privacy threats of IoT devices and software applications.
The only solution is encouraging individuals to install contact tracing apps voluntarily. However, as we discussed, this requires at least a 60% adoption rate. To achieve this goal, public awareness plays a vital role. Hence, in the next part of our study, we conducted a survey to investigate public opinion about CTAs and whether informing people would encourage them to install and use a CTA voluntarily.

5. Methodology

To collect a rich set of data gathering the public’s opinion regarding CTAs, we constructed an approximately 15-min survey, including both multiple-choice and free-answer questions. The survey was deployed through Google Forms and manually distributed to Canadians online. Our survey was approved by the Office of Research Services and the Office of Research Ethics at Mount Royal University, was anonymous, and all questions were optional, except the one for retrieving consent. In addition, a participant could provide their email to receive an optional Everything Card, valued at $10.

5.1. Survey Protocol

Due to the low adoption rate of CTAs, we designed this survey for both those who have heard of them and those who have not. We purposely avoided any personal questions regarding the participants’ experience with COVID-19 to maintain focus on CTAs, rather than personal losses. The survey was designed to gather the participants’ opinions before and after presenting them with findings regarding positive results from CTAs, as well as whether they would change as a result. The survey had the following main sections to gradually focus on the main topic before presenting the findings, then it reiterated some questions to fully grasp the participants’ opinions on CTAs.
Demographics. First, we asked the participants general demographic questions, such as age range, gender, the highest level of education, and province or territory within Canada. We hypothesized that these questions might correlate with participants’ attitudes toward COVID-19 and CTAs.
Questions related to COVID-19. The questions focused more on the participants’ experience and following of COVID-19, avoiding any details, such as infections and deaths. This section provided a deeper insight into how the participants’ attitudes toward the pandemic could influence their stance on CTAs. It begins with their concern for their wellbeing during the pandemic, how closely they followed the infection rates and death toll, and how well they believed the government handled the pandemic. The last question asked whether the participant received at least one vaccination to discover relationships between their personal choices and opinions. All questions, excluding the vaccination one, were a five-point Likert scale designed to avoid constraining the participant to a simple yes or no.
Knowledge of Contact Tracing Applications. This section was added to discover whether the participants’ opinions on CTAs were due to a lack of knowledge about them. The first question asked if the participant regularly used their smartphone, and if they did not would be a critical factor for why they did not participate in contact tracing, as they are exclusive to such devices. We then continued with specific questions regarding CTAs and the participants’ knowledge of their existence. First was whether they were familiar with CTAs used for the COVID-19 pandemic. The second was if they were familiar with COVID Alert and/or ABTraceTogether, the two Canadian CTAs, the latter being the Alberta-specific app. Lastly, we asked whether they downloaded either application, giving us an idea of the participants’ overall adoption rate.
Opinion of Contact Tracing Applications. The questions were added to gather a deeper insight into the participants’ stances and concerns regarding CTAs. First, to collect their opinion directly, we asked if the participant believed CTAs were important in slowing the spread of COVID-19. Next, we asked if the participant was concerned for their privacy when using a CTA. This would gather if sharing personal information was a deciding factor when choosing whether or not to opt-in to the application. Following this, we asked if they did not mind sharing some of their information for contact tracing purposes. This would create a link between why, although participants were concerned for their privacy, they still opted in to download a CPA. Next, we asked if the government should remove the choice to download CPAs and make them mandatory for all citizens. Finally, we asked if they trust the government or a private company to collect their geolocation data to help with the COVID-19 pandemic. The combination of these questions gathers the complex situation that the pandemic and CTAs put us in. Although we wish to help the general public, our privacy is important.
Findings of COVID-19 Contact Tracing. In this section, there were no questions, just graphs and statements, outlining the significant findings regarding the successful implementation of CTAs within South Korea. The major findings were that, although South Korean citizens’ privacy was being breached using CTAs and other tracking methods, they successfully managed to keep their death toll and infection rates far below Canada’s, despite having a larger population and population density.
Opinions of Contact Tracing Applications. In this section, we reiterated our previous questions to gather whether the participants’ opinions on CTAs would change after seeing the results of our findings. First, we asked if they would opt-in to using a CTA in a potential future pandemic. Next, we asked if they would opt-in to sharing their geolocation data for contact tracing purposes and if they believed they should be mandatory during a possible future pandemic. Finally, we asked the participants whether they would recommend CTAs to others now knowing the information they do. This section also gathers whether the transparent sharing of information to the population could help prevent a slow uptake in CTAs should a future pandemic arise.

5.2. Recruitment

We created a poster, an email template, and an online post template for recruiting participants for our study. We initially sent the poster and emails directly to residents outside Alberta to gather participants outside our province. This was performed to ensure we gathered enough data from a diverse demographic before we targeted those we knew within Alberta. Once we felt that strategy had limited its effectiveness, we then sent our poster and email to people in different age groups in our social circles. Following this, we attempted to use social media groups associated with other provinces in Canada to broaden our geographic reach. Unfortunately, this did not garner any results, as surveys are forbidden within these sites. Following this, we used a social media group associated with Mount Royal University, which provided us with the required number of participants to complete this study.

5.3. Analysis

A base analysis was performed for each question to dictate common trends, majorities, minorities, and averages. Next, an analysis was conducted on the data collected from the survey that referenced participants’ answers before and after the presentation of our findings. These references and their differences were indicators of whether the participants’ opinions changed due to the information provided. Similar questions were used before and after the findings so as to be used for this phase of analysis, and, in addition, other questions were used to indicate a change in opinions.

6. Results

In this section, we present the results of our study, conducted from 1 September 2021 to May 2022, where we gathered the responses of 154 participants for our research. From 1 September to 31 December, we conducted our preliminary phase, where we developed the questions for the survey and gathered the findings we would present to the participants. Moreover, during the initial phase, we requested and received the Human Research Ethics approval and Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans certifications required to conduct this study. From 1 January to 31 January, we prepared promotional materials for the study, such as posters, email templates, and online posts. Additionally, we designed the survey using Google Forms, and we finalized the method we will be issuing for the optional $10 consolation to the participants. From 1 February to the end of May, we began running our study with participants, advertising using all available outlets at our disposal. At the end of May, we successfully gathered the required number of participants to complete the study. We then analyzed the survey results to find the results we will now report.
It is important to acknowledge the limitations of our study. Firstly, our research was conducted with a specific focus on Canadians, limiting the generalizability of our findings to a broader international context. Furthermore, our participant pool was predominantly drawn from Western Canada, with a specific concentration in the province of Alberta. This regional bias may affect the diversity and representativeness of our sample, potentially influencing the outcomes and conclusions of our research. Future studies should aim to include a more diverse and geographically varied participant pool to obtain a comprehensive understanding of the impact of public education on contact tracing app adoption. By addressing these limitations, future research can provide a more comprehensive perspective on the effectiveness of educational initiatives in encouraging the use of contact tracing apps during pandemics on a global scale.

6.1. Demographic

The majority of participants that completed the survey were relatively young, identifying as a person between the ages of 18 and 29 (64.3%). This was likely due to us using the Mount Royal University social media group to gather our remaining participants. Additionally, the majority of our participants were Alberta residents (57.2%), likely due to the same reason as the age range. Moreover, 42.2% of the participants identified themselves as “Male,” 55.8% as “Female,” and 2% preferred not to answer this question (see Figure 4).

6.2. Change in Opinion of Contact Tracing Applications

A change in opinion regarding CTA mandates was detected before and after presenting our findings to the participants. Before the presentation of our findings regarding South Korea’s positive results utilizing CTAs, the results to the question regarding whether Contact Tracing Applications be mandatory or not, 34% of participants agreed, 45.7% disagreed, and 20.3% neither agreed nor disagreed (see Figure 5). After presenting our findings, however, the overall stance of participants changed, and 55.8% agreed, 29.9% disagreed, and 14.3% neither agreed nor disagreed. This sudden change in perspective can most likely be attributed to the presentation of our findings, where before, the majority disagreed that CTAs should be mandatory, and after, the majority agreed that CTAs should be mandatory.
When comparing the general response to the opinionated questions regarding CTAs, there is a drastic shift from mixed and negative to positive (see Figure 6 and Figure 7). Since the questions are generally the same, with minor changes, this switch in perspectives on CTAs can only be attributed to the presentation of the findings from South Korea. Another interesting finding is that before presenting our findings, most participants believed CTAs are essential to slow down the spread of COVID-19 (61%), and only 34% agreed that they should be mandatory. This reveals that, although participants know that lives could be saved by using CTAs, they are unwilling or unable to give up their right to choose whether or not to download them. Following the presentation of our findings on South Korea, however, the contradiction no longer exists, as the majority of participants agreed that CTAs should be mandatory.
Following the presentation of our findings, when the participants were asked if they would share their geolocation data with a trusted party or government during a potential future pandemic, 72.1% agreed (see Figure 7).

6.3. Trust with Personal Information

A recent study [29] shows that US citizens are more likely to trust traditional intuitions than government agencies. Moreover, the survey results show that Americans have far less trust in big tech companies. Hence, we investigated Canadians’ opinions about storing their personal data on third-party or government servers. Therefore, before presenting our results, we asked participants if they trust the government using their geolocation data for the pandemic, and 49.9% agreed. On the other hand, when participants were asked if they trust a private company with their geolocation for the pandemic, the response was less favorable, where only 31.8% agreed (see Figure 8). This shows that, in a future pandemic, Canadians will most likely comply with a CTA administrated and maintained by the government. Note that 72.1% agreed to share their geolocation data with the government following the presentation of our findings (see Figure 7).

7. Discussion and Suggestions

In this study, in addition to investigating the privacy and security of the Canadian CTA, we aim to investigate and disclose the public’s perception of contact tracing apps and their most significant concerns that prevent individuals from adopting and utilizing these apps. Hence, besides the questions discussed in the previous sections, we devoted some questions to users’ concerns during the pandemic.
Our study demonstrates that more than 95% of the participants had received at least one dose of the COVID-19 vaccine. We asked this question to discover relationships between their personal choices and opinions. Furthermore, more than 73% (45.4% agreed and 27.9% strongly agreed) of the participants were highly concerned about their wellbeing. Moreover, more than 65% (44.1% agreed, 21.1% strongly agreed) followed the COVID-19 instructions, infection rates, and death toll closely. Considering the provided statistics, to our surprise, about 40% of the participants indicated that they had NEVER heard about COVID-Alert, the Canadian CTA, before participating in our study. This could be one of the factors that drastically impact the effectiveness of a potential contact tracing application. Recall that, in Section 1, we discussed that an adoption rate of at least 60% is required For CTAs to be effective [2], and considering that about 40% of the participants had not heard about it before will make the 60% adoption rate goal an even more difficult objective to achieve.
Moreover, about 55% of the participants indicated they were concerned about their privacy if they wanted to use a contact tracing app. As a result, about 50% of the participants indicated that they never used or installed any type of CTAs on their personal devices, such as cell phones.

Suggestions

Based on our study’s results and findings, we derived the following suggestions that help the governments, especially the government of Canada and health authorities, to better handle, manage, and administer a future pandemic.
First, our study showed the impact and importance of digital contact tracing in decreasing the spread of infection. Hence, even though contact tracing applications were unsuccessful in their first appearance during the COVID-19, we believe they should be employed again in a future pandemic. However, continuous research and work should be performed to improve the security level and to address privacy concerns.
Second, to achieve the at least 60% adoption rate, the public should be informed about the advantages and benefits of employing digital contact tracing apps. Our study demonstrates how this can positively change public perception towards utilizing these new technologies, such as CTAs, to stop a future pandemic. However, this process requires precise planning and should be an ongoing process over time. Therefore, people become ready to do their part when the next pandemic hits.
Third, in a future pandemic, CTAs should be administrated and maintained by the government rather than third-party companies. On the other hand, the government must re-design and improves the CTAs’ privacy statements to address public concerns. For example, what data will be collected? Where will the data be collected (e.g., in a public area)? Where and how long will the data be stored? What security measures are employed to protect the data? These are just a few of many questions that should be explicitly discussed and answered to positively change public perception.

8. Conclusions

Here, we have presented the results of our study, outlining the changes in public opinion due to the presentation of evidence proving the effectiveness of CTAs during a pandemic. These changes in opinion could prove to governing entities that transparency and informative data have the potential to increase participation with contact tracing in a potential future pandemic. Additionally, it also shows that the public is willing to share geographic information to save others, so long as they are convinced that contact tracking applications are effective and secure enough. Finally, we also proposed three suggestions to improve the adoption rate of contact tracing applications. Hopefully, with these suggestions, the government can respond effectively in a future pandemic and increase the adoption rate for CTAs, saving more lives.

Author Contributions

Conceptualization, K.S.; methodology, K.S.; software, B.A.; formal analysis, K.S. and B.A.; investigation, K.S. and B.A.; resources.; writing—original draft preparation, K.S. and B.A.; writing—K.S.; visualization, K.S. and B.A.; supervision, K.S.; project administration, K.S. All authors have read and agreed to the published version of the manuscript.

Funding

This research received no external funding.

Data Availability Statement

We cannot publicly publish the data.

Conflicts of Interest

The authors declare no conflict of interest.

References

  1. Ore, J. Where Did Things Go Wrong with Canada’s COVD Alert App? Available online: https://www.cbc.ca/radio/costofliving/from-boycott-to-bust-we-talk-spotify-and-neil-young-and-take-a-look-at-covid-alert-app-1.6339708/where-did-things-go-wrong-with-canada-s-covid-alert-app-1.6342632 (accessed on 26 October 2022).
  2. Kreps, S.; Zhang, B.; McMurry, N. Contact-Tracing Apps Face Serious Adoption Obstacles. Available online: https://www.brookings.edu/techstream/contact-tracing-apps-face-serious-adoption-obstacles/ (accessed on 26 October 2022).
  3. Herring, J. Cybersecurity Experts Raise Privacy Concerns over Contact Tracing Apps. Available online: https://calgaryherald.com/news/cybersecurity-academics-call-for-technical-review-of-contact-tracing-apps (accessed on 26 October 2022).
  4. Simko, L.; Allen, P.G.; Jiang, M.; Calo, R.; Roesner, F.; Kohno, T.; Chang, J.; Kohno, T.; Jiang, M.; Roesner, F.; et al. COVID-19 Contact Tracing and Privacy: A Longitudinal Study of Public Opinion. Digit. Threat. Res. Pract. (DTRAP) 2022, 3, 1–36. [Google Scholar] [CrossRef]
  5. Kostka, G.; Habich-Sobiegalla, S. In Times of Crisis: Public Perceptions Towards COVID-19 Contact Tracing Apps in China, Germany and the US. SSRN Electron. J. 2020. Available online: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3693783 (accessed on 26 October 2022). [CrossRef]
  6. Williams, S.N.; Armitage, C.J.; Tampe, T.; Dienes, K. Public attitudes towards COVID-19 contact tracing apps: A UK-based focus group study. Health Expect. 2021, 24, 377–385. [Google Scholar] [CrossRef] [PubMed]
  7. Wang, Y.; Ngien, A.; Ahmed, S. Nationwide Adoption of a Digital Contact Tracing App: Examining the Role of Privacy Concern, Political Trust, and Technology Literacy. Commun. Stud. 2022, 73, 364–379. [Google Scholar] [CrossRef]
  8. Rekanar, K.; O’Keeffe, I.R.; Buckley, S.; Abbas, M.; Beecham, S.; Chochlov, M.; Fitzgerald, B.; Glynn, L.; Johnson, K.; Laffey, J.; et al. Sentiment analysis of user feedback on the HSE’s COVID-19 contact tracing app. Irish J. 1971, 191, 103–112. [Google Scholar] [CrossRef] [PubMed]
  9. Kouliaridis, V.; Kambourakis, G.; Chatzoglou, E.; Geneiatakis, D.; Wang, H. Dissecting contact tracing apps in the Android platform. PLoS ONE 2021, 16, e0251867. [Google Scholar]
  10. Martin, T.; Karopoulos, G.; Hernández-Ramos, J.L.; Kambourakis, G.; Nai Fovino, I. Demystifying COVID-19 digital contact tracing: A survey on frameworks and mobile apps. Wirel. Commun. Mob. Com. 2020, 2020, 1–29. [Google Scholar] [CrossRef]
  11. Vaudenay, S. Centralized or Decentralized? The Contact Tracing Dilemma. Available online: https://eprint.iacr.org/2020/531 (accessed on 10 September 2021).
  12. Bay, J.; Kek, J.; Tan, A.; Sheng Hau, C.; Yongquan, L.; Tan, J.; Anh Quy, T. BlueTrace: A Privacy-Preserving Protocol for Community-Driven Contact Tracing across Borders. Available online: https://bluetrace.io/static/bluetrace_whitepaper-938063656596c104632def383eb33b3c.pdf (accessed on 12 September 2021).
  13. Troncoso, C.; Payer, M.; Hubaux, J.-P.; Salathé, M.; Larus, J.; Bugnion, E.; Lueks, W.; Stadler, T.; Pyrgelis, A.; Antonioli, D.; et al. De-centralized Privacy-Preserving Proximity Tracing. arXiv 2020, arXiv:2005.12273. [Google Scholar]
  14. Privacy-Preserving Contact Tracing—Apple and Google. Available online: https://covid19.apple.com/contacttracing (accessed on 31 October 2022).
  15. COVID-19 Digital Rights Tracker: 180+ Tracking Apps Analyzed. Available online: https://www.top10vpn.com/research/covid-19-digital-rights-tracker/ (accessed on 3 November 2022).
  16. Li, T.; Jackie, Y.; Faklaris, C.; King, J.; Agarwal, Y.; Dabbish, L.; Hong, J.I. Decentralized is not risk-free: Understanding public perceptions of priva-cy-utility trade-offs in COVID-19 contact-tracing apps. arXiv 2020, arXiv:2005.11957. [Google Scholar]
  17. O’callaghan, M.E.; Abbas, M.; Buckley, J.; Fitzgerald, B.; Johnson, K.; Laffey, J.; Mcnicholas, B.; Nuseibeh, B.; O’keeffe, D.; Beecham, S.; et al. Public opinion of the Irish “COVID Tracker” digital contact tracing App: A national survey. Digit. Health 2022, 8, 1–12. [Google Scholar] [CrossRef] [PubMed]
  18. Altmann, S.; Milsom, L.; Zillessen, H.; Blasone, R.; Gerdon, F.; Bach, R.; Kreuter, F.; Nosenzo, D.; Toussaert, S.; Abeler, J. Acceptability of App-Based Contact Tracing for COVID-19: Cross-Country Survey Study. JMIR Mhealth Uhealth 2020, 8, e19857. [Google Scholar] [CrossRef] [PubMed]
  19. Canada’s Privacy Act. Available online: https://laws-lois.justice.gc.ca/eng/ACTS/P-21/index.html (accessed on 7 November 2022).
  20. Razak, F.; Shin, S.; Naylor, C.D.; Slutsky, A.S. Canada’s response to the initial 2 years of the COVID-19 pandemic: A comparison with peer countries. CMAJ Can. Med. Assoc. J. 2022, 194, E870–E877. [Google Scholar] [CrossRef] [PubMed]
  21. Our World in Data. Available online: https://ourworldindata.org/ (accessed on 9 November 2022).
  22. Wongid, D.W.S.; Liid, Y. Spreading of COVID-19: Density matters. PLoS ONE 2020, 15, e0242398. [Google Scholar] [CrossRef]
  23. Detsky, A.S.; Bogoch, I.I. COVID-19 in Canada: Experience and Response. JAMA 2020, 324, 743–744. [Google Scholar] [CrossRef] [PubMed]
  24. South Korea Crushed COVID-19 by Testing, Contact Tracing, and Isolating—Vox. Available online: https://www.vox.com/22380161/south-korea-covid-19-coronavirus-pandemic-contact-tracing-testing (accessed on 21 November 2022).
  25. Ki, M. 2015 MERS Outbreak in Korea: Hospital-to-Hospital Transmission. Available online: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4533026/ (accessed on 12 September 2021).
  26. Emerging COVID-19 Success Story: South Korea Learned the Lessons of MERS—Our World in Data. Available online: https://ourworldindata.org/covid-exemplar-south-korea (accessed on 21 November 2022).
  27. Ryan, M. In defence of digital contact-tracing: Human rights, South Korea and Covid-19. Int. J. Pervasive Comput. Commun. 2020, 16, 383–407. [Google Scholar] [CrossRef]
  28. Wymant, C.; Ferretti, L.; Tsallis, D.; Charalambides, M.; Abeler-Dörner, L.; Bonsall, D.; Hinch, R.; Kendall, M.; Milsom, L.; Ayres, M.; et al. The epidemiological impact of the NHS COVID-19 app. Nature 2021, 594, 408–412. [Google Scholar] [CrossRef] [PubMed]
  29. Armantier, O.; Doerr, S.; Frost, J.; Fuster, A.; Shue, K. Whom Do Consumers Trust with Their Data? US Survey Evidence. 2021. Available online: https://www.bis.org/publ/bisbull42.htm (accessed on 15 September 2021).
Figure 1. Cumulative per-capita rate of COVID-19 cases. Data were extracted from a publicly available source (Our World in Data) [21].
Figure 1. Cumulative per-capita rate of COVID-19 cases. Data were extracted from a publicly available source (Our World in Data) [21].
Jcp 03 00014 g001
Figure 2. Fully Vaccinated People. Data were extracted from a publicly available source (Our World in Data) [21].
Figure 2. Fully Vaccinated People. Data were extracted from a publicly available source (Our World in Data) [21].
Jcp 03 00014 g002
Figure 3. (a). Cumulative COVID-19 tests per 1000 people [21]. (b). Cumulative COVID-19 tests [21].
Figure 3. (a). Cumulative COVID-19 tests per 1000 people [21]. (b). Cumulative COVID-19 tests [21].
Jcp 03 00014 g003
Figure 4. (a) Gender demographic. (b) Age demographic.
Figure 4. (a) Gender demographic. (b) Age demographic.
Jcp 03 00014 g004
Figure 5. Before and after results regarding CTA mandates.
Figure 5. Before and after results regarding CTA mandates.
Jcp 03 00014 g005
Figure 6. Participants’ opinions before the presentation of findings. (A) “I don’t mind sharing some of my information for contact tracing purposes”. (B) “I am concerned for my privacy when using a contact tracing app”.
Figure 6. Participants’ opinions before the presentation of findings. (A) “I don’t mind sharing some of my information for contact tracing purposes”. (B) “I am concerned for my privacy when using a contact tracing app”.
Jcp 03 00014 g006
Figure 7. Participants’ opinions after the presentation of findings. (A) “I wouldn’t mind sharing my geolocation data with a trusted party or government to prevent the spreading of the virus and save more lives”. (B) “I would advise others to download the contact tracing app by sharing this information”.
Figure 7. Participants’ opinions after the presentation of findings. (A) “I wouldn’t mind sharing my geolocation data with a trusted party or government to prevent the spreading of the virus and save more lives”. (B) “I would advise others to download the contact tracing app by sharing this information”.
Jcp 03 00014 g007
Figure 8. Participants’ opinions about sharing their data with the government and third-party companies. (A) “I trust the government to collect my geolocation data”. (B) “I trust a private company to collect my geolocation data”.
Figure 8. Participants’ opinions about sharing their data with the government and third-party companies. (A) “I trust the government to collect my geolocation data”. (B) “I trust a private company to collect my geolocation data”.
Jcp 03 00014 g008
Table 1. A short list of Contact Tracing Apps.
Table 1. A short list of Contact Tracing Apps.
NameCountryArchitectureTechnology
TraceTogetherSingaporeHybridBluetooth
Alipay HealthChinaCentralizedGPS
Corona 100 mS. KoreaCentralizedGPS
Hamagen Israel Decentralized GPS
COVID SafeAustralia Hybrid Bluetooth
Stopp CoronaAustriaDecentralizedBluetooth
COVID WatchUSAHybridBluetooth
Table 2. The number of confirmed COVID-19 cases among peer countries in our research.
Table 2. The number of confirmed COVID-19 cases among peer countries in our research.
CountryFirst Case# Cases 1 March–31 March
Canada25 January38–10,711
S. Korea20 January3737–9786
The U.S.20 January32–192,079
Germany 27 January117–61,913
France24 January130–52,229
The U.K.29 January94–38,484
Table 3. Comparing the population between Canada and South Korea.
Table 3. Comparing the population between Canada and South Korea.
FactorCanadaSouth Korea
Population38,929,90251,373,705
Population density (/Km2)4527
Senior population (>65)~7,000,000~9,000,000
Children Population (<10)3,943,791~3,998,100
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Share and Cite

MDPI and ACS Style

Salmani, K.; Atuh, B. A Lesson for the Future: Will You Let Me Violate Your Privacy to Save Your Life? J. Cybersecur. Priv. 2023, 3, 259-274. https://doi.org/10.3390/jcp3020014

AMA Style

Salmani K, Atuh B. A Lesson for the Future: Will You Let Me Violate Your Privacy to Save Your Life? Journal of Cybersecurity and Privacy. 2023; 3(2):259-274. https://doi.org/10.3390/jcp3020014

Chicago/Turabian Style

Salmani, Khosro, and Brian Atuh. 2023. "A Lesson for the Future: Will You Let Me Violate Your Privacy to Save Your Life?" Journal of Cybersecurity and Privacy 3, no. 2: 259-274. https://doi.org/10.3390/jcp3020014

Article Metrics

Back to TopTop