Checking Contact Tracing App Implementations with Bespoke Static Analysis

Robert Flood, Sheung Chi Chan, Wei Chen, David Aspinall

Research output: Contribution to journalArticlepeer-review

40 Downloads (Pure)


In the wake of the COVID-19 pandemic, contact tracing apps have been developed based on digital contact tracing frameworks. These allow developers to build privacy-conscious apps that detect whether an infected individual is in close proximity with others. Given the urgency of the problem, these apps have been developed at an accelerated rate with a brief testing period. Such quick development may have led to mistakes in the apps' implementations, resulting in problems with their functionality, privacy and security. To mitigate these concerns, we develop and apply a methodology for evaluating the functionality, privacy and security of Android apps using the Google/Apple Exposure Notification API. This is a three-pronged approach consisting of a manual analysis, general static analysis and a bespoke static analysis, using a tool we have developed, dubbed MonSTER. As a result, we have found that, although most apps met the basic standards outlined by Google/Apple, there are issues with the functionality of some of these apps that could impact user safety.

Original languageEnglish
Article number496
JournalSN Computer Science
Issue number6
Early online date28 Sept 2022
Publication statusPublished - Nov 2022


  • Android
  • COVID-19
  • Contact tracing
  • MonSTER
  • Static analysis

ASJC Scopus subject areas

  • Computational Theory and Mathematics
  • Computer Networks and Communications
  • Computer Science Applications
  • General Computer Science
  • Artificial Intelligence
  • Computer Graphics and Computer-Aided Design


Dive into the research topics of 'Checking Contact Tracing App Implementations with Bespoke Static Analysis'. Together they form a unique fingerprint.

Cite this