  The 2020 COVID-19 pandemic has led to a global lockdown with severe health
and economical consequences. As a result, authorities around the globe have
expressed their needs for better tools to monitor the spread of the virus and
to support human labor. Researchers and technology companies such as Google and
Apple have offered to develop such tools in the form of contact tracing
applications. The goal of these applications is to continuously track people's
proximity and to make the smartphone users aware if they have ever been in
contact with positively diagnosed people, so that they could self-quarantine
and possibly have an infection test. A fundamental challenge with these
smartphone-based contact tracing technologies is to ensure the security and
privacy of their users. Moving from manual to smartphone-based contact tracing
creates new cyber risks that could suddenly affect the entire population. Major
risks include for example the abuse of the people's private data by companies
and/or authorities, or the spreading of wrong alerts by malicious users in
order to force individuals to go into quarantine. In April 2020, the
Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) was announced with
the goal to develop and evaluate secure solutions for European countries.
However, after a while, several team members left this consortium and created
DP-3T which has led to an international debate among the experts. At this time,
it is confusing for the non-expert to follow this debate; this report aims to
shed light on the various proposed technologies by providing an objective
assessment of the cybersecurity and privacy risks. We first review the
state-of-the-art in digital contact tracing technologies and then explore the
risk-utility trade-offs of the techniques proposed for COVID-19. We focus
specifically on the technologies that are already adopted by certain countries.
