# Do galaxy global relationships emerge from local ones?
The SDSS IV MaNGA surface mass density – metallicity relation

Jorge K. Barrera-Ballesteros1, Timothy M. Heckman1, Guangtun B. Zhu1 E-mail:
<EMAIL_ADDRESS>Fellow Nadia L. Zakamska1,2, Sebastian F. Sánchez3,
David Law4, David. Wake5,6 Jenny E. Green7, Dmitry Bizyaev8,9, Daniel
Oravetz8, Audrey Simmons8 Elena Malanushenko8, Kaike Pan8, Alexandre Roman
Lopes10, Richard R. Lane11
1Department of Physics & Astronomy, Johns Hopkins University, Bloomberg
Center, 3400 N. Charles St., Baltimore, MD 21218, USA
2Deborah Lunder and Alan Ezekowitz Founders’ Circle Member, Institute for
Advanced Study, Einstein Dr., Princeton, NJ 08540, USA
3Instituto de Astronomía, Universidad Nacional Autónoma de México, A.P.
70-264, 04510 México, D.F., México
4Space Telescope Science Institute, 3700 San Martin Drive, Baltimore, MD
21218, USA
5Department of Physical Sciences, The Open University, Milton Keynes, MK7 6AA,
UK.
6Department of Astronomy, University of Wisconsin-Madison, Madison, WI 53706,
USA.
7Princeton University, Department of Astrophysical Sciences Princeton, NJ
08544, USA
8Apache Point Observatory and New Mexico State University, P.O. Box 59,
Sunspot, NM, 88349-0059, USA
9Sternberg Astronomical Institute, Moscow State University, Moscow, 119992,
Russia.
10Departamento de Física, Facultad de Ciencias, Universidad de La Serena,
Cisternas 1200, La Serena, Chile
11Instituto de Astrofísica, Pontificia Universidad Católica de Chile, Av.
Vicuna Mackenna 4860, 782-0436 Macul, Santiago, Chile

(Accepted XXX. Received YYY; in original form ZZZ)

###### Abstract

We present the stellar surface mass density vs. gas metallicity
($\Sigma_{*}-Z$) relation for more than 500,000 spatially-resolved star-
forming resolution elements (spaxels) from a sample of 653 disk galaxies
included in the SDSS IV MaNGA survey. We find a tight relation between these
local properties, with higher metallicities as the surface density increases.
This relation extends over three orders of magnitude in the surface mass
density and a factor of four in metallicity. We show that this local
relationship can simultaneously reproduce two well-known properties of disk
galaxies: their global mass-metallicity relationship and their radial
metallicity gradients. We also find that the $\Sigma_{*}-Z$ relation is
largely independent of the galaxy’s total stellar mass and specific star-
formation rate (sSFR), except at low stellar mass and high sSFR. These results
suggest that in the present-day universe local properties play a key role in
determining the gas-phase metallicity in typical disk galaxies.

###### keywords:

galaxies: abundances – galaxies: ISM – galaxies: fundamental parameters –
techniques: imaging spectroscopy

††pubyear: 2016††pagerange: Do galaxy global relationships emerge from local
ones?  The SDSS IV MaNGA surface mass density – metallicity relation–Do galaxy
global relationships emerge from local ones?  The SDSS IV MaNGA surface mass
density – metallicity relation

##  1 Introduction

The observed oxygen abundance in the interstellar medium and the stellar mass
of a galaxy are the result of galaxy evolution. The metallicity measured from
the ionized gas emission lines reflects the metal content produced in previous
generations of stars, while the stellar mass traces the previous gas available
for star formation. Therefore, the analysis of how these properties correlate
is fundamental to our understanding of the assembly of galaxies across cosmic
time. The physical mechanisms explaining the connection between these two
fundamental galactic features are a matter of debate. An important clue would
be to establish whether these relations are related primarily to the global
properties of the galaxy vs. the local ones.

There are two key systematic properties that have been uncovered. The first is
the close relation between total stellar mass and metallicity. This has been
explored for almost 40 years. In a seminal study, Lequeux et al. (1979) found
a positive correlation between the oxygen abundance and the luminosity (a
proxy for the stellar mass) in a sample of irregular and compact galaxies.
Later studies found similar trends for samples of different Hubble types,
including a wide range of luminosities and metallicities (e.g, Skillman et
al., 1989; Zaritsky et al., 1994). With the development of large spectroscopic
surveys such as the single-fiber Sloan Digital Sky Survey (SDSS), Tremonti et
al. (2004) confirmed the mass-metallicity relation (MZR) for a sample of
$\sim$ 53,000 galaxies at $z\sim$ 0.1 spanning over 3 orders of magnitude in
stellar mass and a factor of 10 in metallicity (see an update for star forming
galaxies in Wu et al., 2016). The MZR has been established at different
redshifts (e.g., Savaglio et al., 2005; Erb et al., 2006; Maiolino et al.,
2008) and different environments (e.g., Mouhcine et al., 2007; Hughes et al.,
2013).

Several scenarios have been invoked to explain the MZR from variations in the
initial mass function with mass (Köppen et al., 2007), metal-poor gas infall
(Finlator & Davé, 2008), outflows or accretion of gas (Tremonti et al., 2004;
Gallazzi et al., 2005; Kobayashi et al., 2007) , selective increase of the
star-formation efficiency with the stellar mass (also known as _downsizing_ ,
Brooks et al., 2007; Ellison et al., 2008; Calura et al., 2009; Vale Asari et
al., 2009), or a combination of these scenarios.

The second key property is the existence of radial gradients in the gas-phase
metallicity in star-forming galaxies. This too is a long-known and often-
studied problem (e.g., Zaritsky et al., 1994; Moustakas et al., 2010; Moran et
al., 2012; Bresolin & Kennicutt, 2015; Carton et al., 2015; Sánchez et al.,
2014; Sánchez-Menguiano et al., 2016).

The MZR and radial metallicity gradients are usually analyzed separately, even
though the physical and dynamical processes that have established them could
be strongly related. In the present paper we are exploring the possibility
that both the MZR and the radial metallicity gradients have a common origin
that arises from a local empirical relationship between the metallicity and
the local stellar surface mass density in the disk. This possibility is
suggested by the strong positive correlation between the effective surface
mass density and stellar mass (e.g., Kauffmann et al., 2003a) and a strong
systematic decrease in the stellar surface mass density with increasing radius
(e.g., Zheng et al., 2015).

The relationship between local metallicity and local surface mass density has
been studied before. These studies reported that HII regions with larger
stellar densities are more metal rich in comparison to those with lower
densities (Vila-Costas & Edmunds, 1992; Edmunds & Pagel, 1984). Later, Moran
et al. (2012) showed a trend between the surface mass density and the
metallicity in their sample of 174 star-forming galaxies using long-slit
spectroscopy. This was further considered and verified by Carton et al. (2015)
for a sample of HI-rich galaxies. Recently, the integral-field spectroscopy
(IFS) technique has become possible, allowing the analysis of the spatially
resolved properties in relatively large samples of disk galaxies. Rosales-
Ortega et al. (2012) demonstrated the local existence of the surface-mass
density vs. metallicity relation using IFS data from HII regions in 38 spiral
galaxies. Sánchez et al. (2013) confirmed this local relation using a sample
of 150 star forming galaxies included in the CALIFA survey (Sánchez et al.,
2012). The above IFS studies also find a relation between the surface mass
density and the specific star formation rate.

Despite these efforts, the samples of these IFS surveys are rather small in
size and cover a limited range of global galaxy properties. For instance, the
stellar mass coverage of the CALIFA survey is complete for nearby galaxies
with 9.5 < $\log(\mathrm{M}_{*}/M_{\odot})$ < 11.0 (Walcher et al., 2014). A
larger sample of galaxies covering a wider range of physical parameters will
allow us to understand whether the relations derived locally are independent
of physical parameters that can affect a galaxy as a whole. The MaNGA survey
(Mapping Nearby Galaxies at APO, Bundy et al., 2015) is ideal for probing the
impact of global parameters on the local relations. This on-going survey aims
to observe in the next 5 years around 10000 galaxies using the IFS technique.
Currently more than 1300 galaxies have been observed, allowing us to explore
spatially resolved information for a sample of disk galaxies that covers a
wide range of stellar masses and star formation rates.

By utilizing this large sample and the wide range it covers in galaxy
properties, the present paper is aimed at testing a simple hypothesis: the
local gas-phase metallicity at a given location in a disk galaxy is determined
mainly by the local stellar surface mass density, irrespective of the mass or
the star-formation rate of the galaxy in which it resides. If so, this would
imply that at least some global scaling relations in galaxies can have a local
origin.

This article is organized as follows. In Sec. 2 we describe the main
properties of the sample of disk galaxies as well as the data used in this
study. In Sec. 3 we present the derivation of the surface mass density,
metallicity, and the selection of the star-forming spaxels to be analyzed. We
will then present the _local_ surface mass density vs. metallicity relation
for the MaNGA disk galaxies and compare it to previous IFS surveys. We will
examine the residuals in this relation as a function of the total stellar mass
and sSFR (Secs. 3.4) as well as the metallicity profiles derived from this
relation 3.5). In Sec. 4 we discuss the results of this study. Our main
results and conclusions are presented in Sec.5. We adopt $H_{0}$ = 70 km s-1
Mpc-1, $\Omega_{M}$ = 0.3 and $\Omega_{\Lambda}$ = 0.7.

##  2 Sample and MaNGA data cubes

###  2.1 Sample Selection

The targets in this study have been selected from the galaxies observed in the
MaNGA survey as of June 2015 (1350 unique galaxies). These galaxies are
included in the fourth internal data release of the survey (MPL-4). The
ongoing MaNGA survey (Bundy et al., 2015) has been designed to acquire
integral-field spectroscopic information for 10,000 galaxies in the Local
Universe. The main parameters for the selection are described in Bundy et al.
(2015). A detailed description is presented in Wake (2016). A large fraction
of the MaNGA sample is drawn from the SDSS Main Galaxy Sample. The luminosity-
dependent volume-limited MaNGA sample is defined by the following properties:
(i) $\log(M_{*}/M_{\odot}$) > 9.0; (ii) similar number of galaxies at
different stellar mass bins (i.e, a uniform coverage in the stellar mass
regime); (iii) uniform radial coverage for the sample. The half-light radius
($\mathrm{R}_{e}$) of each galaxy is used to determine its extension. To
accomplish different science goals, two subsamples have been defined. The
Primary subsample is aimed to cover the region interior to 1.5
$\mathrm{R}_{e}$ in at least 80% of this sample ($\sim$ 5000 galaxies with
$z\sim$ 0.03). A Secondary Sample is designed to cover the region interior to
2.5 $\mathrm{R}_{e}$ ($\sim$ 3000 galaxies with $z\sim$ 0.045). The remaining
10% of the total number of targets is devoted to ancillary observations.
Estimates project that a total of $\sim$ 10,400 galaxies will be observed over
the next 5 years.

Figure 1: Distribution of our disks sample (blue circles) compared with the
total sample of MaNGA observed galaxies (MPL-4, black dots) in the redshift-
stellar mass plane. Note that due to our selection criteria (see details in
Sec 2.1), our disk sample is biased towards lower mass/redshift values
compared to the MPL-4 sample. The inset shows that total sSFR is similar for
galaxies in the MPL-4 sample with fracDeV < 0.7 (Zheng et al., 2015,
thereshold for disk galaxies, see), at larger values the sSFR drops and the
scatter increases.

We focus here on the analysis of spatially resolved properties in late-type
galaxies in which the gas-phase metallicity can be mapped using emission-lines
from star-forming regions. Accordingly, we select from the observed MaNGA
sample by means of the morphology estimator fracDeV, defined in Abazajian et
al. (2005). This parameter quantifies if the light distribution of the galaxy
is similar to either an exponential profile (low fracDeV) or to a de
Vaucouleurs profile (high fracDeV). We select as disk galaxies those with a
fracDeV < 0.7, following Zheng et al. (2015). Note that similar values have
been used to discriminate between spiral and elliptical in morphological
studies (e.g., Padilla & Strauss, 2008; Rodríguez & Padilla, 2013).

In Fig. 1 we plot the stellar mass and redshift of galaxies from the MPL-4
sample. These two properties have been taken from the NSA catalog 111NASA-
Sloan Atlas (NSA; Blanton M. http://www.nsatlas.org). The NSA is a catalog of
nearby galaxies within 200 Mpc (z = 0.055) based on the SDSS DR7 MAIN galaxy
sample (Abazajian et al., 2009), but incorporating data from additional
sources and image reprocessing optimized for large galaxies (Blanton et al.,
2011). For MaNGA, the NSA has been extended to z = 0.15., from which the MaNGA
main sample has been selected. Even though the distributions of stellar masses
or redshift for the MPL-4 sample are not homogeneous, the sample does cover a
wider range of these two parameters than previous integral field surveys (e.g.
CALIFA, Walcher et al., 2014). Both distributions peak at
$\log(M_{*}/M_{\odot})\sim 10.8$ and $z\sim$ 0.03, respectively. Our selection
parameter for disk galaxies (fracDeV < 0.7) significantly reduces our sample,
particularly at high stellar masses/redshifts. However it does guarantee that
we are selecting galaxies consider that are star-forming (see inset in Fig.
1). To assure a significant number of galaxies in the different stellar mass
bins we restrict our sample to galaxies with $\log(M_{*}/M_{\odot})$ < 11.0
(see red-star simbols in Fig. 1). Using these criteria our sample of disk
galaxies consists of 653 galaxies.

###  2.2 MaNGA Cubes

Observations from the ManGA survey have been performed using the SDSS 2.5-m
telescope located at the Apache Point Observatory (Gunn et al., 2006). For a
detailed description of the MaNGA instrumentation the reader is referred to
Drory et al. (2015). Here we highlight its main features. It consists of six
cartridges, each with a plate of $\sim$ 3 degree diameter that can be mounted
at the Cassegrain focus of the telescope. Each plate has been predrilled to
plug a set of fiber bundles. Each fiber bundle corresponds to an integral
field unit. These fibers are connected to a twin spectrograph with two arms
(blue and red), allowing a large portion of the optical/near-IR wavelength
regime (3600 Å to 10300 Å) to be observed simultaneously (Smee et al., 2013).
Its spectral resolution ranges from $R\sim$ 1600 to 2600 (for the blue and red
arms, respectively). Each plate has 17 science fiber bundles. For each of
these bundles, the number of fibers ranges from 19 to 127. The diameter of
each fiber is 2 arcsec. The fibers are arranged in each bundle in a hexagonal
shape (see Fig.7 in Drory et al., 2015). To have a total coverage of the
hexagonal field of view, a three point dithering pattern has been adopted,
similar to other IFU surveys (e.g., Sánchez et al., 2012). An extra set of
bundles is used to obtain the night-sky spectra.

The MaNGA survey has been designed to ensure high quality and uniform coverage
across the sample of observed galaxies (for a detailed explanation see Law et
al., 2015). To achieve this, the total exposure time for a given plate is
typically 3 hours. Individual plates are observed until the combined depth
reaches a S/N of 5 Å-1 fiber-1 at a surface brightness of 23 AB arcsec-2 in
the SDSS r-band. These exposures are also required to be obtained in time
windows for which the air mass is less than 1.21. Data reduction as well as
observing strategy are described in detail in (Law et al., 2016). The MaNGA
reduction pipeline includes wavelength calibration, corrections from fiber-to-
fiber transmission, subtraction of the sky spectrum, and flux calibration (Yan
et al., 2016). By combining the set of exposures in each pointing, the spectra
are arranged in a datacube with the $x$ and $y$\- axes corresponding to
spatial location and the $z$\- axis corresponds to wavelength. This final data
cube has a spatial sampling of 0.5 arcsec/spaxel and a spatial resolution of
2.5 arcsec corresponding to mean physical scales of 1.5 and 2.5 kpc for the
Primary or Secondary sample, respectively.

Figure 2: [OIII]/ H$\beta$ and [NII]/ H$\alpha$ diagnositic diagram for all
the spaxel in our sample of disk galaxies. The yellow and red contours
indicate those spaxels where their H$\alpha$ EW is larger and smaller than 6
Å, respectively.

##  3 Analysis and Results

###  3.1 Determination of local properties - PIPE3D

Figure 3: The distribution of the oxygen abundance for more than 507,000 star-
forming spaxels against their stellar mass surface densities. These spaxels
are extracted from 653 MaNGA galaxies considered as disks (see Sec.2.1 for
details). The colorbar shows the number of spaxels per bin in the
$\Sigma_{*}$-Z space. The white outer contour encloses 80% of the sample while
each inner contours enclose $\sim$15% less, consecutively. The yellow circles
represent the median metallicity for spaxels with surface mass density within
a bin width of 0.2 dex between 1.0 < $\Sigma_{*}$ < 3 dex. The blue error bars
represent the standard deviation in metallicity for each of these bins. The
dashed blue line represents the best-fitted curve for the yellow median
circles.

With the observations reduced and the datacubes created, the next step
consists of extracting the physical parameters from each of the spaxels in
each galaxy in the form of two-dimension distributions. In particular, we are
interested in the surface mass density and the emission line fluxes. To
measure these, we use the PIPE3D pipeline (Sánchez et al., 2016). This
pipeline has been intended to be used for different scientific goals (Sánchez
et al., 2013, 2014; Cano-Díaz et al., 2016). For a detailed description on the
fitting procedure, dust attenuation and uncertainties determination see
(Sánchez et al., 2015, 2016). Here we describe the main features of this
analysis.

As a first step, the cube is spatially binned to reach a signal-to-noise ratio
(S/N) of 50 in the stellar continuum. The binning algorithm used in PIPE3D is
based on both a continuity criterion in the surface brightness and a goal in
the S/N. The stellar properties in each bin are derived by fitting a set of
single stellar population (SSP) templates to the stellar continuum. For the
MaNGA data cubes the pipeline uses a grid of templates extracted from the
MIUSCAT SSP library (Vazdekis et al., 2012). The grid covers four stellar ages
(0.06, 0.20, 2.00,and 17.78 Gyr) and three metallicities (0.0004, 0.02,
0.0331). Specifics in the fitting procedure including foreground dust
attenuation, and uncertainties are described in (Sánchez et al., 2016). The
stellar population model for each spaxel is obtained by rescaling the best
fitted model in each bin to the continuum flux intensity corresponding to each
spaxel. The stellar mass is obtained by assuming the same mass to light ratio
and the same attenuation for the spaxels included in each bin. The typical
error for the estimated stellar mass in each spaxel is smaller than 0.15 dex.
The spaxel surface mass density ($\Sigma_{*}$) is thus obtained using the
ratio of the stellar mass within the spaxel and its deprojected area. To
correct each spaxel’s surface mass density from projection effects, we
multiply the observed density by a factor $b/a$, where $a$ and $b$ represent
the projected semi-major and semi-minor axis of the disk galaxy, respectively.
We obtain these photometric parameters from the NSA catalog. This correction
factor comes from assuming an axisymmetric mass distribution (e.g., thick disk
or an oblate spheroidal), the observed total area is $A_{\mathrm{obs}}=\pi
ab$, while the total area of the disk (as seen face on) is $A=\pi a^{2}$. In
average, the surface mass density is given by:

$\Sigma_{*}=\frac{M}{\pi a^{2}}=\frac{M}{A_{\mathrm{obs}}}=\Sigma_{*,obs}b/a$
(1)

where $M$ is the total mass of the disk and $\Sigma_{*,obs}$ is the observed
surface mass density. In the next section we show that the scatter of the
local mass metallicity relation is reduced by considering the deprojected area
for each spaxel.

The ionized gas data-cube is created by subtracting the stellar population
model in each spaxel. The strongest emission lines within the MaNGA wavelength
regime are fitted on a spaxel-by-spaxel basis. The pipeline provides 2-D flux,
intensity, and equivalent width (EW) maps of a large set of emission lines
including H$\alpha$, H$\beta$, [OIII]$\lambda$5007, and [NII]$\lambda$6548\.
We use the flux ratio of these emission line to determine the oxygen abundance
of the star forming spaxels in our sample of disk galaxies.

We select the star forming spaxels in each of the galaxies by comparing their
[OIII]/H$\beta$ and [NII]/H$\alpha$ line ratios in a BPT diagnostic diagram
(Baldwin et al., 1981, see Fig. 2). Following Sánchez et al. (2014), we
classify the star forming spaxels as those with line ratios below the Kewley
demarcation curve (dotted curve in Fig 2 Kewley et al., 2001) and H$\alpha$ EW
larger than 6 Å. We note that the combination of these two criteria is a
reliable method to select star forming spaxels. Even more, a large fraction of
spaxels with EW larger than 6 Å are already below the Kauffmann demarcation
curve (solid curve in Fig 2 Kauffmann et al., 2003b). Most of the spaxels in
our sample of disk galaxies have EW’s larger than 6 Å ($\sim$ 86%).

Once we selected our sample of star forming spaxels, we can use the
metallicity calibrators derived from HII regions studies. For this particular
study, we use the metallicity calibrator from Marino et al. (2013) They
determine the metallicity using the $O3N2$ calibrator. This calibrator uses
the logarithmic difference between the line ratios log([OIII]/H$\beta$) and
log([NII]/H$\alpha$) :

$12+\log\mathrm{(O/H)}=8.533[\pm 0.012]-0.214[\pm 0.012]\times O3N2$ (2)

Typical errors for metallicity from the flux ratio calibrator is $\sim$ 0.06
dex.

###  3.2 The MaNGA Surface Mass Density - Metallicity ($\Sigma_{*}$-Z)
relation

In Fig. 3 we plot the distribution of the oxygen abundance for the star
forming spaxels as function of their surface mass density for our sample of
MaNGA disk galaxies. This distribution includes more than 507,000 star forming
spaxels. To our knowledge, this is the largest sample of spatially resolved
elements for disk galaxies to date. The oxygen abundance shows a clear
correlation with the surface mass density that extends over three orders of
magnitude in the latter and a factor of four in metallicity. Higher surface
mass densities exhibit progressively higher metallicity. It is remarkable how
these two local properties correlate in a similar manner as their global
counterparts, as reported in the literature (e.g., Tremonti et al., 2004;
Foster et al., 2012; Wu et al., 2016, see also Sec 3.3). This relation is
tight: metallicity has a scatter smaller than 0.08 dex with respect to its
median value at different mass density bins (see error bars in Fig. 3). We
perform a fitting to the median abundance at different mass densities.
Following Sánchez et al. (2013), we use the following fitting function:

$y=a+b(x-c)\,e^{-(x-c)}$ (3)

where $y$ = 12+$\log$(O/H) and $x$ is the logarithm of the stellar mass
density ($\Sigma_{*}$) in units of $M_{\odot}$/$\mathrm{pc}^{2}$. This
functional form has been selected in order to describe the observed
distribution of the metallicity with respect to the mass density, which seems
to show a saturation in metallicities at the highest densities. The
coefficients corresponding to the best fit of the above function to the MaNGA
galaxies presented in this study are $a$ = 8.55 $\pm$ 0.02, $b$ = 0.014 $\pm$
0.02 and $c$ = 3.14 $\pm$ 1.87.

Figure 4: The $\Sigma_{*}$-Z relation using the inclination corrected $\Sigma$
(black dotted contours) and the observed surface mass density
($\Sigma_{*,obs}$, red solid contours). It is evident that the scatter of the
relation is larger when using the observed surface mass density.

In Fig 4 we compare the relation in Fig. 3 (dotted black contours) with the
relation derived using $\Sigma_{*,obs}$ (red solid contours). The scatter of
the $\Sigma_{*,obs}-Z$ relation is considerable larger than the one presented
previously. Since we use the residuals of this relation to investigate
possible dependence of the global parameters of disk galaxies in the metal
content of spatially resolved regions (see Sec.3.4), it is essential to reduce
potential systematic effects that could alter the metallicity residuals.

Figure 5: Comparison of the $\Sigma_{*}$-Z for different IFS surveys. In order
to compare our measurements with those from previous IFS surveys we use the
metalicity calibrator from Pettini & Pegel (2004). Similar to the Fig. 3,
black contours enclose the same fraction of spaxels. Yellow circles represent
the median metallicity for spaxels with surface mass density binned in 0.2 dex
with the error bars showing their metallicity standard deviation.

The relation between the local surface mass density and metallicity described
here is similar to the one reported from individual HII regions in previous
IFS surveys. In Fig. 5 we compare the distribution of the $\Sigma_{*}$-Z
relation presented in this study and the best fitted-curves from the PINGS
(Rosales-Ortega et al., 2012) and the CALIFA surveys (Sánchez et al., 2013)
with red-dashed and blue-dotted lines, respectively. In order to make a
similar comparison between the relation presented here and those in previous
IFS surveys we use the oxygen abundance calibrator in Pettini & Pagel (2004).
Within the scatter of the relation, the shape of the $\Sigma_{*}$-Z relation
for the different surveys are quite similar. The fitting from the PINGS survey
shows a positive offset of $\sim$ 0.11 dex in comparison with the MaNGA best
fitted curve. This offset is very small at large mass densities. The CALIFA
fit yields slightly larger (smaller) metallicities at low (high) mass
densities in comparison with the curve presented in this study (by +0.06 and
-0.03 dex, respectively). Note that our relationship is based on a much larger
sample than these previous studies yet the local distributions are similar:
whereas the PINGS and CALIFA surveys included 38 and 150 disk galaxies
respectively, we include 653 galaxies from the MaNGA sample.

###  3.3 The MZR from MaNGA Datacubes

Figure 6: The MZR for MaNGA galaxies. The metallicity for each galaxy has been
derived using the integrated values within an effective radius from the two-
dimensional distributions of the emission line fluxes. Stellar masses are
drawn from the NSA catalog. Black contours show the MZR distribution from SDSS
galaxies in the same stellar mass and redshift ranges as those cover by our
MaNGA sample. For comparison, the red and gray contours show the MZR
distribution at the redshift range presented by (Lara-López et al., 2010) and
(Mannucci et al., 2010). Contours cover 95 % of the SDSS sample.

We want to compare how the global properties derived by integrating over the
two-dimentional distributions of our sample compare to those derived by
single-fiber spectroscopy. For this exercise in each galaxy of our sample we
integrated within an effective radius ($\mathrm{R_{eff}}$) the total flux in
each of the two-dimensional distribution corresponding to the emission lines
required to determine our metallicity indicator (see Sec. 3.1). We select the
galaxies considered as star forming from a BPT diagnostic diagram using the
ratios from the integrated fluxes. From this selection we derived the
metallicity in 480 galaxies. The uncertainties are also derived using the
error maps from each emission line. We do not consider the systematic error
from the abundance calibrator.

In Fig. 6 we plot the MZR for the MaNGA galaxies. For comparison purposes
only, we over plot the contours of the MZR distribution derived from single-
fiber spectroscopy in the galaxies included in the SDSS sample. Black contours
cover the same redshift and stellar mass ranges as our sample while the red
contour represents the MZR in a study covering similar redshift range as our
sample (Lara-López et al., 2010, , see also Foster et al. (2012)). For this
sample we derived the metallicity using the fluxes and stellar masses from the
Max-Planck-Institute-Johns-Hopkins-University (MPA-JHU) emission-line analysis
database 222http://www.mpa-garching.mpg.de/SDSS/DR7. The MaNGA integrated
metallicities cover similar values to those covered by single-fiber
spectroscopy within the same stellar mass / redshift regime. In comparison
with previous studies, the MaNGA sample cover galaxies at lower redshift, as a
result, both the MaNGA data points and black contours cover low-mass galaxies.
Despite the difference between methods, covered area, and ranges of the
different samples the MZR constructed from integrated fluxes from the MaNGA
spatially resolved data follows quite a similar trend as those reported in the
literature derived from single fiber spectroscopy. We note a small group of
outliers with an unusual large metallicity for a low-mass galaxy (
$10^{9.2}\mathrm{M}_{\odot}$). Most of these targets are either compact
galaxies or disk with high inclination. They also show a evident bulge. Since
these galaxies are compact, we suspect that the integrated metallicity at 1
Reff includes a wider portion of the galaxy than their conterparts at similar
stellar mass range.

Figure 7: $\Sigma$-Z relation distribution divided at different total stellar
mass and total specific SFR (sSFR) bins (left and right panels, respectively).
In each of the stellar mass/sSFR bins the contours encloses 80% of the sample.
Except for the lowest mass bin, the size of each stellar mass bin is $\sim$
0.4 dex, ranging from 9.2 to 11.0. The sSFR is divided in four different bins
from low ($\log(sSFR)$ < -11 $\log(\mathrm{yr}^{-1})$) to high ($\log(sSFR)$ >
-9.5 $\log(\mathrm{yr}^{-1})$) values. For reference, we plot in gray
colorscale the distribution presented in Fig.3.

###  3.4 Residuals in the $\Sigma_{*}$-Z Relation

While the $\Sigma_{*}$-Z relation has been described before, the much larger
amount of data from MaNGA allows us to test the degree to which this relation
– on its own – can adequately explain both the mass-metallicity relation and
the radial metallicity gradients in disk galaxies.

Figure 8: Scatter of the $\Sigma_{*}$-Z relation with respect to the total
stellar mass. Black points represent the median value at different bins (0.1
dex for the total stellar mass). In both panels, the solid-red and dashed-blue
curves represent a quadratic and linear fit of the median scatter
metallicities, respectively. Black dashed line represents zero-scatter in the
$\Sigma_{*}$-Z relation.

To start, we can ask how galaxies with different stellar masses populate the
$\Sigma_{*}$-Z relation. To do this, we separated our sample in five bins with
approximately the same width in total stellar mass distribution ($\sim$ 0.4
dex). In the left panel of Fig. 7 we plot the $\Sigma_{*}$-Z relation for each
of these stellar mass bins. This shows that lower-mass galaxies are composed
of lower-metallicity material residing in regions of lower surface mass
density. As the stellar mass increases the distribution of points in the
$\Sigma_{*}$-Z relation move steadily along the relation towards progressively
higher metallicities and surface-mass densities. This shows explicitly how the
relations between $\Sigma_{*}$, Z, and stellar mass can arise from purely
local relations.

Another important property of a galaxy is its stellar age. We parameterize
this by the specific star formation rate (sSFR: the SFR per unit stellar
mass). In the right panel of Fig. 7 we divide our MaNGA sample into four bins
in the sSFR measured for the galaxy based on the SDSS MPA-JHU catalog. As in
the left panel, there is a smooth trend with galaxies having progressively
lower values of sSFR as $\Sigma_{*}$ and Z increase.

Figure 9: Top: Radial distribution of the surface mass density for disk
galaxies at different total stellar mass bins in effective radius units. The
mass bins are the same used in Sec. 3.4. Gray lines represent individual
gradients in radial bins of 0.2 $R_{\mathrm{eff}}$. For each radial bin red
point and error bar represent the median and standard deviation, respectively.
Bottom: Radial distribution of the difference between the observed metallicity
and the value derived from the best fitted curve of the $\Sigma_{*}$-Z
relation for the same mass bins within the range of $\Sigma_{*}$ where the
fitting was performed. Red points and error bars represent the median and
standard deviation for a given radius. Except for the lowest mass bin, the
derived metallicity gradient is consistent to the observed one.

We now want to test explicitly whether the residuals in the best-fit
$\Sigma_{*}$-Z relation correlate systematically with other properties of the
galaxy. For each star forming region we calculate the difference between its
observed metallicity and the one derived using the best fitted curve for the
$\Sigma_{*}$-Z relation ($\Delta\,12+\log(\mathrm{O/H})$).

In top panel of Fig. 8 we plot this scatter against the total stellar mass of
the galaxy. We find that the residuals in this relation are small, and only
exceed the scatter in the $\Sigma_{*}$ \- Z relation (0.08 dex) for the lowest
mass galaxies ($M_{*}<10^{9.2}M_{\odot}$). A quadratic fit is better than a
linear regression (red-solid vs dashed-blue lines). In a future paper we will
further explore the physical origin of the effect at low stellar masses.

Following the same procedure outlined above for the stellar mass, we study how
the scatter of the relation changes for different values of the global
specific SFR computed from the MaNGA data. Again, the residuals are small, and
only exceed the scatter in the $\Sigma_{*}$ \- Z relation for the highest
specific star-formation rates ($\mathrm{sSFR}>10^{-9.2}$ yr-1, corresponding
to the starburst regime).

In conclusion, our results suggest that the gas-phase metallicity of star
forming regions in disk galaxies is determined primarily by the local stellar
surface mass density, rather than by other properties of the galaxies such as
the total stellar mass or specific SFR.

###  3.5 Radial Metallicity Gradients and the $\Sigma_{*}$-Z Relation

In addition to the tight relation between the local stellar surface mass
density and gas-phase metallicity ($\Sigma_{*}-Z$), disk galaxies also show
tight relations between their total stellar mass and their effective stellar
surface mass density ($\Sigma_{*,\mathrm{eff}}=M_{*}/2\pi
R_{\mathrm{eff}}^{2}$), and between their total stellar mass and their gas-
phase metallicity (MZR). One may think that the correlation between these two
local parameters ($\Sigma_{*}$ and metallicity) could be a secondary
correlation that is induced by these two other global correlations. In this
section, we will argue that this is not the case, because we will show that
the $\Sigma_{*}-Z$ relation can also reproduce the well-known radial
metallicity gradients seen in disk galaxies, which is independent of the MZR
and $\Sigma_{*,eff}$ relations. To do so, we will use the spatially-resolved
information from the MaNGA survey to determine how the observed radial
metallicity gradients naturally emerge from the radial gradients in
$\Sigma_{*}$ and the local $\Sigma_{*}-Z$ relation.

In top panels of Fig. 9 we show the radial profiles of the surface mass
density in the five different stellar mass bins introduced in Sec. 3.4. These
profiles are obtained for each galaxy by averaging the surface mass density
from the star forming regions within elliptical rings of width 0.2
$\mathrm{R_{eff}}$. These rings cover the radial range from 0.2 to 1.8
$\mathrm{R_{eff}}$ with the ellipticity and position angle drawn from the NSA
catalog. We select this range of radii to cover a similar portion in each
galaxy regardless of their selection criteria (Primary or Secondary, see Sec.
2.1).

We then use the observed radial profile in $\Sigma_{*}$ and our best-fit
$\Sigma_{*}$-Z relation to predict a radial metallicity gradient. In each of
these rings we also measure the average metallicity of the star forming
regions. In the bottom panels of Fig. 9 we plot the radial profiles of the
differences between the measured and predicted metallicities
($\Delta\,12+\log(\mathrm{O/H})_{r}$). We find that the observed and predicted
metallicities are in good agreement over the range of radial locations and
total stellar masses that we probe. In particular for the higher mass bins
(three bottom rightmost panels in Fig. 9), all median differences at different
radii are smaller than the nominal error in the determination of the
metallicity from emission line ratios ($\sim$ 0.06 dex), and the standard
deviations of the residuals are of the same order ($\sim$ 0.04 dex). For
intermediate masses (from 9.2 to 10.0
$\log(\mathrm{M}_{*}/\mathrm{M}_{\odot}$) the median differences are also
quite small ( 0.02 dex), however with larger standard deviations ($\sim$ 0.07
dex). For the lowest mass bin galaxies (bottom leftmost panel in Fig. 9), the
central observed metallicity is lower than the one derived from the central
mass density ($\sim$ 0.1 dex). This difference gets reduced at larger radii.
The standard deviation is in general large compared to other mass bins ($\sim$
0.1 dex). This consistent with the results in the top panel of Fig 8.

In conclusion, our study of the difference between the observed metallicity
and those derived from the $\Sigma_{*}$-Z relation shows that for a wide range
of stellar masses, the metallicity gradient observed in disk galaxies can be
well reproduced by means of the radial density gradient taken together with
the $\Sigma_{*}$-Z relation.

##  4 Discussion

We have confirmed that for our sample of disk galaxies the local oxygen
abundance has a tight correlation with the local stellar surface mass density
(see Fig. 3). This is in agreement with previous IFS surveys (see Fig. 5,
Rosales-Ortega et al., 2012; Sánchez et al., 2013). Our results confirm that
the well-studied MZR is a scaled-up version of the local $\Sigma_{*}$-Z
relation. We have shown that the $\Sigma_{*}$ vs. Z relation can also explain
the observed radial metallicity gradients. These results suggest that both the
MZR relation and radial gradients are reflections of a more fundamental and
intimate relation between local properties within disk galaxies.

The much larger body of data provided by the MaNGA survey compared to prior
IFS surveys makes it suitable for further analysis of the impact of global
properties of the galaxy on the metallicity derived at local scales. Our
results indicate that local oxygen abundance can be described by means of the
best-fit of the $\Sigma_{*}$-Z relation over wide ranges of stellar mass and
sSFR (covering almost two orders of magnitude in each parameter, see Fig 8).
These results indicate that to first order the metal content of a disk galaxy
depends more strongly on the local properties than on those of the galaxy as a
whole. Similarly, in Sec. 3.5 we analyzed the differences between the observed
metallicity gradients and those derived using the radial surface mass density
gradients and the $\Sigma_{*}$-Z relation for galaxies in different stellar
mass bins. Except for the lowest-mass galaxies
($\log(\mathrm{M}_{*}/M_{\odot})$ < 9.2), the derived radial metallicity
gradients are in good agreement (see Fig. 9).

An interplay of different processes has been proposed to explain the chemical
evolution of galaxies, including both the MZR and radial metallicity gradients
(e.g., Davé et al., 2012; Lilly et al., 2013). The simplest case is the
closed-box model in which the metal content of disk galaxies depends only on
the metal yield ($y_{Z}$) and the gas mass fraction
($f_{\mathrm{gas}}=M_{\mathrm{gas}}/[M_{*}+M_{\mathrm{gas}}]$):
$Z=y_{Z}\,\ln(f_{\mathrm{gas}})$. There is a strong observed inverse
correlation between the local values for $f_{\mathrm{gas}}$ and $\Sigma_{*}$,
and this then implies an observed strong inverse correlation between
$f_{\mathrm{gas}}$ and $Z$ (Carton et al., 2015). Thus, part of the
$\Sigma_{*}$ vs. Z relation can be explained by the fact that the lower
density regions are more gas rich and therefore simply less chemically-
evolved. This is consistent with the standard “inside-out” model for the
formation of disk galaxies in which the inner (denser) regions form earlier
than the outer (less dense) regions which in turn are more chemically-evolved
and less gas-rich. It is also consistent with the downsizing phenomenon in
which the (progenitors of) more (less) massive galaxies form earlier (later).

According to integrated observations, the metallicity should also be regulated
by the gas accretion of metal-poor gas and/or ejection of metal rich material
(e.g., Tremonti et al., 2004; Gallazzi et al., 2005; Kobayashi et al., 2007;
Mannucci et al., 2010; Lara-López et al., 2010). Indeed, we observed that the
residuals in the $\Sigma_{*}$ vs. Z at the lowest stellar masses (and highest
values of sSFR) may reflect the effect of outflows, given that such galaxies
have shallow potential wells and may therefore be less able to retain the
metals they produce (e.g., Larson, 1974).

These ideas have recently been considered in the context of two related
scenarios for the origin of radial metallicity gradients. Carton et al. (2015)
proposed a scaled-down radial version of the reservoir model (e.g., Lilly et
al., 2013) in which the metal content in each radial bin of a disk galaxy is
regulated by local inflows of metal-poor gas from the halo, the metal rich
material carried out of the galaxy by feedback, and the metals produced by
massive stars (the stellar yield). With this simple model they were able to
fit with relatively good agreement the radial metallicity profiles of 50
nearby galaxies with different contents of molecular gas (Wang et al., 2014).
Similarly, Ho et al. (2015) suggest that metallicity gradients are the result
of the coevolution of the stellar and gas disk in a virtual closed-box
chemical evolution model.

In our next paper, we will explore in more detail the inter-dependences
between all the basic local properties of disk galaxies: the metallicity, the
stellar surface-mass density, the escape velocity, the specific SFR, and the
luminosity-weighted mean age. This in turn will allow us to gain a better
understanding of the physical origin of the global mass-metallicity relation
and radial metallicity gradients, and of the implications for galaxy
evolution.

##  5 Summary

We have used data from the MaNGA survey to study the role of the local stellar
surface mass density $\Sigma_{*}$ in determining both the localmetallicity
relation and radial metallicity gradients in disk galaxies. While the
relationship between $\Sigma_{*}$ and metallicity (Z) has been known for some
time (e.g., Moran et al., 2012; Rosales-Ortega et al., 2012; Sánchez et al.,
2013), the much larger data set provided by MaNGA allows us to assess whether
this relationship is a universal one, or whether instead the residuals in the
relationship correlate systematically with the global properties of galaxies.
We found:

  * •

In agreement with these earlier studies, the metallicity increases steeply
with increasing surface mass density over the range $\Sigma_{*}\sim 10^{0.5}$
to $\sim 10^{2}M_{\odot}$ pc -2. The relation then flattens at higher
densities ($\Sigma_{*}\sim 10^{2}$ to $10^{3}M_{\odot}$ pc-2), reaching
roughly solar metallicity. The rms residuals around the best fit relation are
about $\pm$0.08 dex.

  * •

The loci of the local values of $\Sigma_{*}$ and Z as measured in galaxies of
different global stellar masses ($M_{*}$) systematically populate different
parts of this relationship. As we move from low-mass to high-mass galaxies,
the values for $\Sigma_{*}$ and $Z$ systematically increase: while all the
data points lie along the same $\Sigma_{*}$ \- Z relationship, low (high) mass
disk galaxies are preferentially composed of regions of low (high) surface
mass density and metallicity.

  * •

Similarly, the loci of the local values of $\Sigma_{*}$ and Z as measured in
galaxies of different global specific star-formation rates (sSFR)
systematically populate different parts of this relationship. As we move from
galaxies with high to low global sSFR, the values for $\Sigma_{*}$ and $Z$
systematically increase: while all the data points lie along the same
$\Sigma_{*}$ \- Z relationship, disk galaxies with high (low) global sSFR are
preferentially composed of regions of low (high) surface mass density and
metallicity.

  * •

There are only weak systematic relationships between the residuals with
respect to the best fit to the $\Sigma_{*}$ \- Z relationship and either the
global $M_{*}$ or sSFR. The largest systematic residuals are for the galaxies
with very low $M_{*}$ ($\sim$ -0.08 dex below $\sim 10^{9.2}M_{*}$) or very
high sSFR ($\sim$ -0.08 dex above sSFR $\sim 10^{-9.2}$ yr-1).

  * •

Using the best-fit to the $\Sigma_{*}$ \- Z relation and the measured radial
profiles of $\Sigma_{*}(r)$, we can accurately reproduce the observed radial
metallicity gradients in disk galaxies spanning the range in global M∗ from
$10^{9}$ to $10^{11}$ M⊙. The worst disagreement ($\sim-0.1$ dex) was found in
the inner regions ($<R_{50}$) in the lowest mass galaxies ($<10^{9.5}$ M⊙).

The critical point is that a single local relationship between stellar surface
mass density and gas-phase metallicity can simultaneously reproduce two
different systematic properties of disk galaxies: their mass-metallicity
relation and their radial metallicity gradients. These reproductions are not
perfect over the full range of galaxy properties. In the next paper in this
series we will explore the nature of possible ’secondary parameters’ that
could affect metallicity.

Put in the simplest possible terms, the results here show that the local gas-
phase metallicity is very well determined by the local stellar surface-mass
density: the outer disk of a massive galaxy and the inner regions of a low-
mass galaxy (with the same density) have the same metallicity. This is a
rather remarkable result in terms of the way in which galaxies assemble.

## Acknowledgements

We thank R. Maiolino for useful discussion and revision on the manuscript.
Funding for the Sloan Digital Sky Survey IV has been provided by the Alfred P.
Sloan Foundation, the U.S. Department of Energy Office of Science, and the
Participating Institutions. SDSS-IV acknowledges support and resources from
the Center for High-Performance Computing at the University of Utah. The SDSS
web site is www.sdss.org.

SDSS-IV is managed by the Astrophysical Research Consortium for the
Participating Institutions of the SDSS Collaboration including the Brazilian
Participation Group, the Carnegie Institution for Science, Carnegie Mellon
University, the Chilean Participation Group, the French Participation Group,
Harvard-Smithsonian Center for Astrophysics, Instituto de Astrofísica de
Canarias, The Johns Hopkins University, Kavli Institute for the Physics and
Mathematics of the Universe (IPMU) / University of Tokyo, Lawrence Berkeley
National Laboratory, Leibniz Institut für Astrophysik Potsdam (AIP), Max-
Planck-Institut für Astronomie (MPIA Heidelberg), Max-Planck-Institut für
Astrophysik (MPA Garching), Max-Planck-Institut für Extraterrestrische Physik
(MPE), National Astronomical Observatory of China, New Mexico State
University, New York University, University of Notre Dame, Observatário
Nacional / MCTI, The Ohio State University, Pennsylvania State University,
Shanghai Astronomical Observatory, United Kingdom Participation Group,
Universidad Nacional Autónoma de México, University of Arizona, University of
Colorado Boulder, University of Oxford, University of Portsmouth, University
of Utah, University of Virginia, University of Washington, University of
Wisconsin, Vanderbilt University, and Yale University.

## References

  * Abazajian et al. (2005) Abazajian K., et al., 2005, AJ, 129, 1755
  * Abazajian et al. (2009) Abazajian K. N., et al., 2009, ApJS, 182, 543
  * Baldwin et al. (1981) Baldwin J. A., Phillips M. M., Terlevich R., 1981, PASP, 93, 5
  * Blanton et al. (2011) Blanton M. R., Kazin E., Muna D., Weaver B. A., Price-Whelan A., 2011, AJ, 142, 31
  * Bresolin & Kennicutt (2015) Bresolin F., Kennicutt R. C., 2015, MNRAS, 454, 3664
  * Brooks et al. (2007) Brooks A. M., Governato F., Booth C. M., Willman B., Gardner J. P., Wadsley J., Stinson G., Quinn T., 2007, ApJ, 655, L17
  * Bundy et al. (2015) Bundy K., et al., 2015, ApJ, 798, 7
  * Calura et al. (2009) Calura F., Pipino A., Chiappini C., Matteucci F., Maiolino R., 2009, A&A, 504, 373
  * Cano-Díaz et al. (2016) Cano-Díaz M., et al., 2016, preprint,  (arXiv:1602.02770)
  * Carton et al. (2015) Carton D., et al., 2015, MNRAS, 451, 210
  * Davé et al. (2012) Davé R., Finlator K., Oppenheimer B. D., 2012, MNRAS, 421, 98
  * Drory et al. (2015) Drory N., et al., 2015, AJ, 149, 77
  * Edmunds & Pagel (1984) Edmunds M. G., Pagel B. E. J., 1984, MNRAS, 211, 507
  * Ellison et al. (2008) Ellison S. L., Patton D. R., Simard L., McConnachie A. W., 2008, ApJ, 672, L107
  * Erb et al. (2006) Erb D. K., Shapley A. E., Pettini M., Steidel C. C., Reddy N. A., Adelberger K. L., 2006, ApJ, 644, 813
  * Finlator & Davé (2008) Finlator K., Davé R., 2008, MNRAS, 385, 2181
  * Foster et al. (2012) Foster C., et al., 2012, A&A, 547, A79
  * Gallazzi et al. (2005) Gallazzi A., Charlot S., Brinchmann J., White S. D. M., Tremonti C. A., 2005, MNRAS, 362, 41
  * Gunn et al. (2006) Gunn J. E., et al., 2006, AJ, 131, 2332
  * Ho et al. (2015) Ho I.-T., Kudritzki R.-P., Kewley L. J., Zahid H. J., Dopita M. A., Bresolin F., Rupke D. S. N., 2015, MNRAS, 448, 2030
  * Hughes et al. (2013) Hughes T. M., Cortese L., Boselli A., Gavazzi G., Davies J. I., 2013, A&A, 550, A115
  * Kauffmann et al. (2003a) Kauffmann G., et al., 2003a, MNRAS, 341, 33
  * Kauffmann et al. (2003b) Kauffmann G., et al., 2003b, MNRAS, 346, 1055
  * Kewley et al. (2001) Kewley L. J., Dopita M. A., Sutherland R. S., Heisler C. A., Trevena J., 2001, ApJ, 556, 121
  * Kobayashi et al. (2007) Kobayashi C., Springel V., White S. D. M., 2007, MNRAS, 376, 1465
  * Köppen et al. (2007) Köppen J., Weidner C., Kroupa P., 2007, MNRAS, 375, 673
  * Lara-López et al. (2010) Lara-López M. A., et al., 2010, A&A, 521, L53
  * Larson (1974) Larson R. B., 1974, MNRAS, 169, 229
  * Law et al. (2015) Law D. R., et al., 2015, AJ, 150, 19
  * Law et al. (2016) Law D. R., et al., 2016, preprint,  (arXiv:1607.08619)
  * Lequeux et al. (1979) Lequeux J., Peimbert M., Rayo J. F., Serrano A., Torres-Peimbert S., 1979, A&A, 80, 155
  * Lilly et al. (2013) Lilly S. J., Carollo C. M., Pipino A., Renzini A., Peng Y., 2013, ApJ, 772, 119
  * Maiolino et al. (2008) Maiolino R., et al., 2008, A&A, 488, 463
  * Mannucci et al. (2010) Mannucci F., Cresci G., Maiolino R., Marconi A., Gnerucci A., 2010, MNRAS, 408, 2115
  * Marino et al. (2013) Marino R. A., et al., 2013, A&A, 559, A114
  * Moran et al. (2012) Moran S. M., et al., 2012, ApJ, 745, 66
  * Mouhcine et al. (2007) Mouhcine M., Baldry I. K., Bamford S. P., 2007, MNRAS, 382, 801
  * Moustakas et al. (2010) Moustakas J., Kennicutt Jr. R. C., Tremonti C. A., Dale D. A., Smith J.-D. T., Calzetti D., 2010, ApJS, 190, 233
  * Padilla & Strauss (2008) Padilla N. D., Strauss M. A., 2008, MNRAS, 388, 1321
  * Pettini & Pagel (2004) Pettini M., Pagel B. E. J., 2004, MNRAS, 348, L59
  * Rodríguez & Padilla (2013) Rodríguez S., Padilla N. D., 2013, MNRAS, 434, 2153
  * Rosales-Ortega et al. (2012) Rosales-Ortega F. F., Sánchez S. F., Iglesias-Páramo J., Díaz A. I., Vílchez J. M., Bland-Hawthorn J., Husemann B., Mast D., 2012, ApJ, 756, L31
  * Sánchez-Menguiano et al. (2016) Sánchez-Menguiano L., et al., 2016, A&A, 587, A70
  * Sánchez et al. (2012) Sánchez S. F., et al., 2012, A&A, 538, A8
  * Sánchez et al. (2013) Sánchez S. F., et al., 2013, A&A, 554, A58
  * Sánchez et al. (2014) Sánchez S. F., et al., 2014, A&A, 563, A49
  * Sánchez et al. (2015) Sánchez S. F., et al., 2015, preprint,  (arXiv:1509.08552)
  * Sánchez et al. (2016) Sánchez S. F., et al., 2016, preprint,  (arXiv:1602.01830)
  * Savaglio et al. (2005) Savaglio S., et al., 2005, ApJ, 635, 260
  * Skillman et al. (1989) Skillman E. D., Kennicutt R. C., Hodge P. W., 1989, ApJ, 347, 875
  * Smee et al. (2013) Smee S. A., et al., 2013, AJ, 146, 32
  * Tremonti et al. (2004) Tremonti C. A., et al., 2004, ApJ, 613, 898
  * Vale Asari et al. (2009) Vale Asari N., Stasińska G., Cid Fernandes R., Gomes J. M., Schlickmann M., Mateus A., Schoenell W., 2009, MNRAS, 396, L71
  * Vazdekis et al. (2012) Vazdekis A., Ricciardelli E., Cenarro A. J., Rivero-González J. G., Díaz-García L. A., Falcón-Barroso J., 2012, MNRAS, 424, 157
  * Vila-Costas & Edmunds (1992) Vila-Costas M. B., Edmunds M. G., 1992, MNRAS, 259, 121
  * Wake (2016) Wake D., 2016, in American Astronomical Society Meeting Abstracts. p. 334.01
  * Walcher et al. (2014) Walcher C. J., et al., 2014, A&A, 569, A1
  * Wang et al. (2014) Wang J., et al., 2014, MNRAS, 441, 2159
  * Wu et al. (2016) Wu Y.-Z., Zhang S.-N., Zhao Y.-H., Zhang W., 2016, MNRAS, 457, 2929
  * Yan et al. (2016) Yan R., et al., 2016, AJ, 151, 8
  * Zaritsky et al. (1994) Zaritsky D., Kennicutt Jr. R. C., Huchra J. P., 1994, ApJ, 420, 87
  * Zheng et al. (2015) Zheng Z., et al., 2015, ApJ, 800, 120


XX XX 8 October/November

# Privacy Guarantees of BLE Contact Tracing: A Case Study on COVIDWISE

Salman Ahmed  Virginia Tech  Ya Xiao  Virginia Tech  Taejoong (Tijay) Chung
Virginia Tech  Carol Fung  Virginia Commonwealth University  Moti Yung§ Google
LLC and Columbia University  Danfeng (Daphne) Yao  Virginia Tech

(2021)

###### Abstract

Google and Apple jointly introduced a digital contact tracing technology and
an API called “exposure notification,” to help health organizations and
governments with contact tracing. The technology and its interplay with
security and privacy constraints require investigation. In this study, we
examine and analyze the security, privacy, and reliability of the technology
with actual and typical scenarios (and expected typical adversary in mind),
and quite realistic use cases. We do it in the context of Virginia’s COVIDWISE
app. This experimental analysis validates the properties of the system under
the above conditions, a result that seems crucial for the peace of mind of the
exposure notification technology adopting authorities, and may also help with
the system’s transparency and overall user trust.

###### keywords:

Exposure Notification, Privacy, Security, Contact Tracing, COVIDWISE, GAEN.

††journal: Computer§§footnotetext: The opinions and statements in this work
(performed as a project within an academic setting) are personal, and do not
necessarily represent the employer of this author.

COVID-19 has become the most deadly viral outbreak across the globe since the
H1N1 virus pandemic of 1918 (known as “The Spanish influenza” due to a
misconception about its origin). Today, containment and mitigation have been
the best strategies, at the start, in the absence of vaccination, and then
after initial vaccines have been found, as the strategy when new waves of
variants and mutations of the virus appear. Contact tracing can greatly help
early containment by tracing from people exposed to newly infected patients
and isolating them early [1]. The latest advancement in computer technology
aids the contact tracing process by tracking individuals’ mobile devices and
their proximity using Global Positioning Systems [2], or Bluetooth Low Energy
(BLE) beacons [3].

To combat COVID-19 and aid governments and health organizations with contact
tracing, technology companies (Google and Apple, in particular) jointly
introduced a Bluetooth Low Energy (BLE) technology called Google/Apple
Exposure Notification (GAEN) system in April 2020 [4]. The GAEN system uses
interoperable BLE signals to broadcast Bluetooth beacons from one device to
another when Android/iOS users come in close proximity. The Bluetooth beacons
help track the distance between the users and the duration of users being in
close proximity. When one person is diagnosed as COVID-19 positive at the time
of the contact or within a valid time frame of the contact (and only then) the
system can notify the other users about potential exposure to a COVID-19
positive person (the infected user uploads the generators of its signal and
other users pull them from the server).

Researchers have scrutinized the contact tracing technology and warned that
adoption of the technology can have privacy and security issues [5, 6, 7, 8,
9, 10, 11], thus perhaps advocating against its wide adoption. However, these
works primarily designed attacks based on abstract protocol design and
abstract (theoretically formulated) adversaries (which have access to much
more than the actual protocol on actual devices given to users). These
attacks, at times, represent extreme settings and economically unjustified
(i.e., expensive) scenarios, rather than a typical adversary whose motivation
is based on rational decision making and whose means are of a typical user.
Most did not verify the systems based on actual device investigation
(accessing the software itself and experimenting with devices), and none of
them try to find out in which scenarios the system is robust enough against a
typical attack.

While scrutiny is always important, none of the earlier works assessed the
feasibility of the attacks in the real situation (when the system is deployed)
in terms of operation or cost feasibility vs. gain. Granted, there are extreme
cases of heavy investing and massive deployments of devices/readers which can
attack the system, or attacks that are extreme due to the attacker assumed
capability (having full access to attacked devices). In this sense, the above
attacks were, indeed, good to know as extreme but unlikely attacker behavior.
This work, like other works [12, 13, 14, 15] that evaluate trust, security,
privacy, usefulness, traceability, transparency, and reliability, means to
fill the gap and investigate the systems in a balanced way, by inspecting the
actual system (software and operation of the working system), and also by
assessing strengths and not only weaknesses (essentially, assuming the system
encounters a typical not too costly attack by an adversary exploiting it
directly, and not an adversary performing a dedicated targeted costly attack,
by an attacker who invests much money to subvert properties of a system).

We then increase the capabilities of the adversary gradually. The current
investigation can be useful to understanding the mitigation capability of the
system against typical attacks as an explanation toward the system adoption–
currently, in future waves of the COVID-19 pandemic, or future pandemic
outbreaks.

Specifically, we perform an analysis of GAEN with two focus points: i)
ensuring that the library code (from Google and Apple) and contact tracing app
code (from various government and health organizations) protect user privacy,
and ii) investigating the privacy shortcomings/flaws in the design and
implementation of GAEN, if any.

We investigate the above in the context of COVIDWISE [16], the state of
Virginia’s official contact tracing app, which uses the GAEN system. Other
major GAEN-based contact tracing apps around the globe include COVID Alert
(Canada), Corona-Warn-App (Germany), COVID Tracker (Ireland), SwissCovid
(Switzerland), Immuni (Italy), NHS COVID-19 (United Kingdom), as well as
several US apps including GuideSafe (Alabama), Covid Watch (Arizona), COVID
Alert NY (New York), Care19 Alert (Wyoming), Safer Illinois (University of
Illinois) and PocketCare (University at Buffalo). In mid March 2021, COVIDWISE
was the most adopted (10.5%) contact tracing app in the US [17].

In the rest of this article, we explain and analyze GAEN’s privacy design. We
experimentally evaluate several BLE-related properties. We confirm that GAEN
prevents tracking through random Bluetooth addresses, thus providing strong
privacy guarantees. We found that iPhones deliver strong privacy protection
via the non-resolvable random private address and prevent malicious apps from
snooping on users’ Rolling Proximity Identifiers (RPIs). We also confirm that
RPI’s refreshing interval is within the range of 10-20 minutes [18] and may
vary with the distance between devices. For advanced attacks targeting contact
tracing apps, we break down their assumptions and assess the attack
feasibility.

## DESIGN OVERVIEW of GAEN

GAEN broadcasts and stores BLE beacons without any interaction with the app if
the system is turned ON. However, a user can turn ON/OFF the system by either
using the app or directly through the exposure notification settings. GAEN
provides API calls to support different operations invoked by the contact
tracing app. Figure 1 illustrates the interactions between a user, the
exposure notification system, and the app.

Figure 1: Interactions of user and contact tracing app with the exposure
notification system.

GAEN uses BLE technology due to its availability on a smartphone needed for
applications such as smart homes, proximity, wearables, healthcare, and
fitness that require low data transfer and low latency. BLE’s practical
communication range is 10-20 meters (33-66 feet) which is sufficient for GAEN.
GAEN’s use of BLE also optimizes power consumption; it consumes significantly
less power than traditional BLE communication used for peripherals. Besides,
GAEN’s passive power usage (i.e., actively broadcasting when devices are close
to each other) further reduces power consumption.

### TEK, Bluetooth Beacon, and RPI

The heart of GAEN is a key called Temporary Exposure Key (TEK). TEK is a
16-byte random number generated using randomness and a cryptographically
secure pseudorandom number generator. The TEK is associated with a device for
a day within its lifetime. The GAEN system generates a new TEK every 24 hours
to make it hard for attackers to track infected users, who employ and upload
TEK numbers, beyond a day period. Then, the Bluetooth beacon’s payload
includes an identifier called Rolling Proximity Identifier (RPI). An RPI is
derived from a TEK as an AES encryption key (and the current time indication
within the 24 hours period as the message). In addition, a Bluetooth beacon’s
payload also includes metadata such as protocol version and transmission power
which are encrypted using a key derived from the TEK. The RPI and metadata are
expected to change every 10-20 minutes (see the specification [18]) to prevent
attackers from tracking a device of uninfected users based on Bluetooth
beacons being overly persistent.

When a user is infected, its TEKs for the relevant period (14 days) are
uploaded to the server, and users pull TEKs of infected people from the server
(not in the order they are uploaded), produce the day’s RPIs, and match
against their device stored RPI of that day and time, done locally on the
device to detect exposure. TEK being a daily key, makes it impossible to link
RPIs between days (when one downloads TEKs from the server, there is no
indication which TEK on other days are coming from the device of a given day’s
TEK). The goal of the system, from a basic privacy design goal, is to relate
to TEKs and RPIs which are random objects and not to users or devices. This
design philosophy was originally shared by the GAEN system and many academic
groups as well, all attempting to minimize the loss of privacy while allowing
support for contact tracing (and allowing reasonable storage and computations
at devices).

### API and app responsibilities

The contact tracing app and the underlying GAEN system have different
responsibilities. GAEN is responsible for transmitting, receiving, and storing
Bluetooth signals. The app allows positively tested patients to share their
diagnosis and automatically notify the central server and, eventually via the
system, others who were in contact with the patients. The health authority
(e.g., Virginia Department of Health) sets the exposure detection thresholds
(e.g., the minimum distance between users and duration of exposure) used in
the contact tracing app.

Figure 2: COVIDWISE allows a COVID-19 positive patient to share their positive
information using a six-digit PIN.

GAEN provides 17 API calls for a contact tracing app (e.g., COVIDWISE) to
interact with the GAEN system. The key responsibilities of GAEN API calls are
TEK creation and management, RPI generation and management, BLE broadcast and
scan, and Exposure detection. The contact tracing app is responsible for user
authorization, downloading published TEKs, presenting exposure notifications,
and uploading TEKs if infected. For example, the Virginia Department of
Health, one of the health authorities using GAEN for their contract tracing
app, allows users to share COVID-19 positive test results, and for security
purposes, they assign a six-digit PIN to each COVID-19 patient. The patient
may enter the PIN to the COVIDWISE app (as shown in Figure 2). This disclosure
is voluntary in the State of Virginia. People who have been in close proximity
to a COVID-19 infected person for at least $T$ minutes in the last 14 days are
then notified via the system operation on their device. The Virginia
Department of Health determines and sets the value of $T$.

### Overview of GAEN’s privacy design

Out of the 17 API calls that allow the interactions between the GAEN system
and the app, two APIs – getTemporaryExposureKeyHistory() and
provideDiagnosisKeys() in Android – deal with potentially sensitive
information. The first API call fetches the TEKs of the last 14 days from the
on-device data store and provides them to the app for uploading to the key
server. An app uses the second API call to insert one or more batches of TEKs
into the on-device data store. These two API calls are sensitive because they
exchange critical information (i.e., TEKs) between the app and the GAEN
system. To ensure the privacy and integrity of the TEKs, the API calls use a
specific file format (e.g., export.bin) and a verification method through
signatures (e.g., export.sig).

On the other hand, the contact tracing app (COVIDWISE) is responsible for
securely communicating with the key server, uploading, and downloading TEKs.
Both the app and the key server verify the integrity of TEKs through digital
signatures. The app does not use any personally identifiable information
(PII), device identifier, or Bluetooth identifier in the process of sharing
the COVID-19 positive information.

### Threat models and claimed privacy guarantees

We consider four threat levels to discuss GAEN’s privacy guarantees: i)
walking trail model, ii) your neighbor model, iii) stalker model, and iv)
organized crime model. We define and categorize the threat levels based on
attackers’ privilege levels regarding accessing RPI beacons in different real-
world scenarios. These privilege levels are also compatible with the
assumptions made in the existing literature [5, 6, 7, 8, 9, 10, 11]. In the
walking trail and your neighbor models, an adversary can sniff a very limited
amount of beacons for obtaining RPIs. We then consider a stalking model where
an adversary can sniff a small number of BLE beacons (e.g., using less than 10
BLE sniffing devices) to obtain RPIs. Finally, in an organized crime model, we
assume that an adversary can compromise a smartphone, set up a large-scale
infrastructure to sniff BLE beacons, and hack health care systems to obtain
PINs to share positive information. We discuss the threat levels of these
attack scenarios in Table 1.

The privacy guarantees of GAEN and the contact tracing app lie in five key
aspects: i) preventing attackers, public health authorities, government, and
Apple/Google from tracking or monitoring a user’s movements, ii) generating
TEKs without using any PII or any context (like the geographic location), iii)
sharing COVID-19 positive diagnostic information without revealing any user
information, iv) preventing attackers from obtaining any PII, even if
attackers get access to the TEKs, and v) users’ ability to turn ON/OFF GAEN
based on their discretion. Furthermore, based on the principle of least
privilege, TEKs never leave a user’s device unless the user tests positive.

## BLE and RPI EXPERIMENTS

We conducted simple experiments to investigate various BLE aspects in GAEN and
COVIDWISE to confirm the privacy guarantees. Using PacketLogger (an extension
to the Xcode Apple developer tool) in iOS and Bluetooth system logs in
Android, we intercepted and collected Bluetooth beacons to investigate whether
all the intervals work as expected and whether there exist any identifiers
(e.g., resolvable Bluetooth address) in the Bluetooth beacons. We also
inspected the device storage for keys and identifiers in Android (Pixel 4a)
and iOS (iPhone 7) devices by measuring the number of Bluetooth beacons sent
in 24 hours.

### Randomness of Bluetooth address

We examined the randomness of Bluetooth addresses used in transmitting
Bluetooth beacons to observe if a receiving entity can resolve the sender’s
Bluetooth address. We observed that both Android and iOS utilize random
addresses to conceal the identity of the sender while transmitting
advertisement packets, as expected.

Android and iOS apply different types of random addresses. Android phones use
resolvable random private addresses, while iPhones use non-resolvable random
private addresses in advertising packets. The difference is that Android
devices allow trusted parties (e.g., paired devices) to resolve the resolvable
random private addresses. However, both operating systems preserve privacy,
assuming that any paired Bluetooth devices (e.g., the user’s own AirPods) are
trustworthy.

It is important to know that contact tracing apps do not require location
permission in the latest version of Android (i.e., Android 11). Older versions
of Android apps require the location settings to be turned ON for the
Bluetooth communication to work (a strange capability given that in this
application no location information is used whatsoever!).

### RPI interception

We examined the runtime RPI (Bluetooth beacon) and metadata using PacketLogger
for iOS devices and Bluetooth HCI snoop logs for Android devices. We observed
that each device received a set of advertising payloads around every 4 minutes
in Android and around every 3.5 minutes in iOS. Figure 3 shows a raw BLE
advertisement packet captured from an Android device (Pixel 4a). The last 20
bytes are composed of a 16-byte RPI and a 4-byte metadata.

Figure 3: 20-byte advertised random numbers with RPI and metadata captured
from Pixel 4a.

We found that the RPI and metadata of the advising packets are zeros for iOS
devices. The observed zero values are the result of third-party apps’ access
to the exposure notification UUID (Universally Unique Identifier). Because iOS
blocks access to avoid malicious third-party apps from snooping on users’
RPIs. This security mechanism renders attack proposals based on stealing RPIs
(e.g., as described in [19]) useless on iOS.

Figure 4: RPI transmission interval experiment. The interval varies with
device distance.

### RPI intervals

We intercepted Bluetooth beacons to examine the RPI transmission intervals. In
our experiment, we used one Android device (Pixel 4a) and two iPhones (iPhone
7). We positioned each device according to the distance in Figure 4. Based on
RPIs received on the Android device, we observed that the RPI transmission
interval varies with the distance between devices. However, the observed
intervals satisfy the published intervals in the specifications (i.e., between
10 to 20 minutes). Imprecise distance approximation due to device positions
(e.g., in human pockets) or surroundings (e.g., glass protections) may also
impact this interval.

### Key and RPI storage

We analyzed the storage requirements of RPIs. We found that an Android or iOS
device takes around 0.59 MB to 0.63 MB of storage per day. Since GAEN stores
keys and RPIs for the past 14 days, a device may take roughly 8.25 MB to 8.8
MB of storage if we consider non-interrupted interactions between the devices.
In practice, the interactions are interrupted due to movements and obstacles,
and the storage is less than 8 MB. For TEKs, we are unable to locate any
stored TEK values on the logs of either Android or iOS devices, as expected.

## GAEN’s privacy w.r.t. threat models

As with all security solutions, the privacy guarantees of GAEN are relative.
There certainly exist extreme scenarios (e.g., [3, 6, 7, 8, 19, 20]) where
attackers may learn additional information. If an adversary has access to
RPIs, TEKs, and RPI date-time information read by (say) thousands of users,
then the adversary can profile a user’s movement [3, 7, 6].

Table 1 summarizes the attack difficulty and the leak severity in GAEN under
multiple (increasing) threat categories: i) walking trail causal encounter
model, ii) your neighbor model, iii) stalker model, and iv) organized crime
model. The first three models capture the most typical threat scenarios
(representing small-scale individuals or group effort), in which, it turns
out, GAEN leaks no sensitive information.

The adversary in Your Neighbor model (ID 2) may occasionally receive beacons
from a few (e.g., 3-5) nearby users. The difference between Your Neighbor (ID
2) and Stalker I (ID 3) model is that adversaries in the former receive RPIs
normally, while adversaries in Stalker I deliberately orient themselves (e.g.,
by changing locations) to intercept RPIs from more victims (e.g., 5-10). If
successful, the Stalker I model only reveals the approximate number of nearby
GAEN users, still not posing any privacy threat.

Table 1: Privacy leak and severity of leak in GAEN against realistic and complex threat models and their assumptions ID |  | Threat
---
Level
| Attack
---
Difficulty
Attack Requirement | Attack Goal | Info Leaked |  | Severity
---
if Leak
Refs
1 |  | Walking
---
Trail
Low |  | Access to one RPI
---
(common scenario)
| Any information
---
about a user
None | None | —
2 |  | Your
---
Neighbor
Low |  | Access to 0-5 RPIs from 3-5
---
victims considering neighbors
come nearby 0-5 times a day
(common scenario)
| Any information
---
about a user
None | None | —
3 | Stalker I | Low |  | Access to at least on RPIs in
---
a 10 to 20-minute time window
from 5-10 victims
| To estimate the number
---
of GAEN users
around an attacker
| Approximate number
---
of nearby GAEN users
None | [19]
4 | Stalker II | Medium |  | 1\. Access to RPIs from at
---
least one victim. Tracking
a victim for an hour
requires all RPIs in that hour
2\. Continuity of RPI
reception from a victim
| To continuously
---
track a user
| None (Not trackable
---
based on our
observation)
None | [8]
5 |  | Organized
---
Crime I
High |  | 1\. Access to unlimited RPIs with
---
location data from 10+ victims
2\. Access to published
TEKs through jailbreaking
or rooting attacker’s phone or
imitating a contact tracing app
3\. Aggregated data for each
10-20-minute time window:
date, time, interaction graph,
social graph, addresses,
location type (residential,
workplace, library, etc.),
surveillance cameras
| To profile movements
---
of infected users
and de-anonymize them
| Imprecise
---
de-anonymization
(precision decreases
with increasing
number of profiles
Medium |  |  [3],
---
[6],
[7]
6 |  | Organized
---
Crime II
High |  | 1\. Access to a victim’s
---
smartphone through hacking
2\. Storage protection bypass
| To obtain the victim’s
---
infection status
| Information whether the
---
victim is infected or not
Medium | [20]

A reported attack [8] relied on the asynchronous change of Bluetooth addresses
and RPIs, which is represented in the Stalker II model (ID 4) in Table 1.
However, this attack no longer works, since GAEN requires the Bluetooth
address and RPI to change synchronously, which we experimentally confirmed by
extracting around 11k random Bluetooth addresses and RPI pairs from the
advertising packets over three days. We obtained advertising packets from an
Android (v11) device (Pixel 4a), where the advertising packets were received
from two iPhones (iPhone 7 and iPhone 11 with iOS 15.0.2) placing the three
phones 6-12 feet away with regular phone activities. Each Bluetooth address is
paired with a unique RPI and vice-versa. We checked the existence of any non-
unique pairs by searching the usage of a Bluetooth address with multiple RPIs
or an RPI with multiple Bluetooth addresses using a Python program. We
observed no asynchronous change of the Bluetooth addresses and RPIs. Hence,
user privacy is preserved in the Stalker II model (ID 4). Listing 1 shows a
few unique Bluetooth addresses and RPI pairs.

⬇

Bluetooth Address Rolling Proximity Identifier (RPI)

13:ac:57:35:3c:ea 59c62b86cdace1fe40446bc80689ccbd323588b8

33:5d:64:6b:cd:b7 3ad310dca4f810ef2b0a17968be47cb6ec59b6b6

09:b2:da:e9:eb:c6 6d5c54d1376e95b7872cfffc93425903102a1673

24:fe:37:59:2c:d6 0376829e0ebd180e82e5756e52ce7cbd7c465a03

04:2c:4d:b1:93:40 b5f1091b23a3871129a1225a6c3cebf175de28fa

Listing 1: Synchronous change of Bluetooth addresses and RPIs in advertising
packets.

Some attack scenarios in Table 1 have rather strong assumptions regarding the
complexity of the attack setup and demand huge resources. For example,
attackers in the Organized Crime I model (ID 5) require TEKs and aggregated
data in each 10 to 20-minute time window to de-anonymize infected users [3, 6,
7]. Aggregated data include public and sensitive information, such as date,
time, interaction graph, social graph, address, location type (e.g.,
residential, workplace, and library), and surveillance cameras. This
requirement of additional side-channel sources of information reduces the
feasibility of the attack.

In addition, the Organized Crime I model requires access to published TEKs
through a jailbroken/rooted device or imitating a contact tracing app [6] (in
normal operation, the TEK downloaded are not readily available to the user and
the exposure assessment is done away from the user). While obtaining TEKs
through a jailbroken/rooted device might be feasible, imitating a contact
tracing app is rather difficult. To imitate a contact tracing app, an attacker
needs to somehow fool or bypass the authorization system, specifically an
authorized administrative console, which is designed by GAEN to protect
malicious apps from downloading TEKs.

In addition, a malicious entity cannot fool the contact tracing app to accept
forged TEK export files. For maintaining the back-end key server, an
authorized contact tracing entity (e.g., Virginia Department of Health) must
create a signing key to sign the TEK export files and share the corresponding
public key with Google/Apple – ensuring information authenticity.

Google and Apple also restrict app developers’ access to GAEN APIs through an
approval process. Google also limits the access to the Android Software
Development Kit for regular app developers. These restrictions prevent the
misuse and abuse of GAEN APIs.

The attack represented by the Organized Crime II model in Table 1 (ID 6) is
difficult to launch in practice, as it requires the hacker to gain access to
the victim’s smartphone [20].

While vulnerabilities like the power and storage drain do not hamper the
effectiveness of GAEN, vulnerabilities such as relay-and-replay and trolling
attacks may degrade its effectiveness by increasing false positives. These
false positives do not have an impact on privacy, though. Note that our
reported results do not assess the effectiveness of GAEN, but rather they
focus on privacy issues. (Hence, we do not discuss RPI spreading attacks which
may require a large costly network of spreaders and/or require large
collaboration of smartphone holders which is unrealistic for a conspiracy to
stay undetected: all these issues, while cheaper “misinformation channels” are
available.)

## CONCLUSIONS

Our findings which are based, both, on experimentation with actual devices and
a concrete system implementation, and on analysis based on classifying grades
of attacks, confirmed that GAEN preserves privacy in a quite comprehensive
collection of typical threat scenarios (including the walking trail casual
encounter model, your neighbor model, the stalker model, and even in the
costly organized crime model). Compromising user privacy by exploiting GAEN
requires an unlikely, complex, or costly attack setup, e.g., compromising a
victim’s smartphone, mounting many Bluetooth radio devices, correlating with
additional victim information, or rogue access to the healthcare systems.
Besides, the built-in authorization, permission, and policy-enforcement
mechanisms in GAEN add an extra layer of difficulty against the proposed
attacks in the literature.

To summarize, and in light of our findings, our article aims at helping people
understand and appreciate GAEN’s privacy protection, and encourage them to
adopt GAEN-based contact tracing. This knowledge can be extremely powerful, as
it will enable us to effectively manage the rest of the current (2020-2021)
and future pandemics and, in turn, help reduce unnecessary casualties due to
enhanced automatic contact tracing and its advantages, especially given the
initial estimates of effectiveness [1, 21].

## ACKNOWLEDGMENT

This work has been supported by the Virginia Commonwealth Cyber Initiative
(CCI).

## References

  * [1] L. Ferretti, “Quantifying sars-cov-2 transmission suggests epidemic control with digital contact tracing,” Science, 8 May 2020, vol. 368: https://www.science.org/doi/10.1126/science.abb6936, 2020.
  * [2] L. Reichert, S. Brack, and B. Scheuermann, “Privacy-Preserving Contact Tracing of COVID-19 Patients.,” IACR Cryptol. ePrint Arch., vol. 2020, p. 375, 2020.
  * [3] C. Troncoso, M. Payer, J.-P. Hubaux, et al., “Decentralized Privacy-preserving Proximity Tracing,” arXiv preprint arXiv:2005.12273, 2020.
  * [4] Google and Apple Inc., “Exposure Notifications: Using Technology to Help Public Health Authorities Fight COVID‑19.” https://www.google.com/covid19/exposurenotifications/.  Accessed on April 14, 2021.
  * [5] Y. Gvili, “Security Analysis of the COVID-19 Contact Tracing Specifications by Apple Inc. and Google Inc.,” IACR Cryptol. ePrint Arch., vol. 2020, p. 428, 2020.
  * [6] L. Baumgärtner, A. Dmitrienko, et al., “Mind the GAP: Security & Privacy Risks of Contact Tracing Apps,” arXiv preprint arXiv:2006.05914, 2020.
  * [7] O. Seiskari, “Paparazzi Attack PoC.” https://github.com/oseiskar/corona-sniffer.  Accessed on April 14, 2021.
  * [8] M. Vuagnoux, “Little Thumb Attack on SwissCovid.” https://vimeo.com/453948863.  Accessed on April 14, 2021.
  * [9] V. Iovino, S. Vaudenay, and M. Vuagnoux, “On the effectiveness of time travel to inject covid-19 alerts,” tech. rep., Cryptology ePrint Archive, Report 2020/1393. https://eprint. iacr. org/2020/1393, 2020.
  * [10] A. K. R. Gennaro, A. Krellenstein, and J. Krellenstein, “Exposure Notification System May Allow for Large-Scale Voter Suppression,” arXiv preprint arXiv:2005.12273, 2020.
  * [11] A. Boutet, C. Castelluccia, et al., Contact Tracing by Giant Data Collectors: Opening Pandora’s Box of Threats to Privacy, Sovereignty and National Security.  PhD thesis, EPFL, Switzerland; Inria, France; JMU Würzburg, Germany; University of …, 2020.
  * [12] Y. J. Park and D. D. Shin, “Contextualizing privacy on health-related use of information technology,” Computers in Human Behavior, vol. 105, p. 106204, 2020.
  * [13] Y. J. Park, J. E. Chung, and D. H. Shin, “The structuration of digital ecosystem, privacy, and big data intelligence,” American Behavioral Scientist, vol. 62, no. 10, pp. 1319–1337, 2018.
  * [14] D.-H. Shin, “The effects of trust, security and privacy in social networking: A security-based approach to understand the pattern of adoption,” Interacting with computers, vol. 22, no. 5, pp. 428–438, 2010.
  * [15] D.-H. Shin, “Ubiquitous computing acceptance model: end user concern about security, privacy and risk,” International Journal of Mobile Communications, vol. 8, no. 2, pp. 169–186, 2010.
  * [16] Virginia Department of Health, “COVIDWISE, Official Contact Tracing App in Virginia.” https://www.vdh.virginia.gov/covidwise/.  Accessed on April 14, 2021.
  * [17] Alejandro De La Garza, “COVID-19 Contact Tracing App Adoption Rates.” https://time.com/5905772/covid-19-contact-tracing-apps/.  Accessed on April 14, 2021.
  * [18] Google and Apple Inc., “Exposure Notification Bluetooth Specification.” https://blog.google/documents/70/Exposure_Notification_-_Bluetooth_Specification_v1.2.2.pdf.  Accessed on April 14, 2021.
  * [19] R. Grünblatt, “Stop Covid Detector 3000.” https://github.com/rgrunbla/Stop_Covid_Detector_3000.  Accessed on April 14, 2021.
  * [20] J. Chan, S. Gollakota, E. Horvitz, J. Jaeger, S. Kakade, T. Kohno, J. Langford, J. Larson, S. Singanamalla, J. Sunshine, et al., “Pact: Privacy Sensitive Protocols and Mechanisms for Mobile Contact Tracing,” arXiv preprint arXiv:2004.03544, 2020.
  * [21] C. Wymant, “The epidemiological impact of the nhs covid-19 app,” Nature, vol. 594, 408–412, https://doi.org/10.1038/s41586-021-03606-z, 2021\.

Salman Ahmed, is a Ph.D. Candidate at Virginia Tech working with Professor
Danfeng (Daphne) Yao. His research interests include system security
assurance, attack surface quantification, and program analysis. He received
his M.S. degree from East Tennessee State University. Contact him at
<EMAIL_ADDRESS>
Ya Xiao, is a Ph.D. student in the Department of Computer Science at Virginia
Tech, working with Professor Danfeng (Daphne) Yao. Her research interests
include neural network-based software security solutions. She received an M.S.
degree from Beijing University of Posts and Telecommunications (BUPT). Contact
her at<EMAIL_ADDRESS>
Dr. Taejoong (Tijay) Chung, is an Assistant Professor at the Computer Science
department at Virginia Tech. He received his Ph.D. in Computer Science and
Engineering from Seoul National University in 2015. His work focuses on
Internet security, privacy implications, and Internet measurement. Contact him
at<EMAIL_ADDRESS>
Dr. Carol Fung, is an Associate Professor at Virginia Commonwealth University.
She received her Ph.D. degree in computer science from the University of
Waterloo (Canada). Her research interests include network security, mobile and
IoT systems, and softwarized and programmable networks. Contact her at
<EMAIL_ADDRESS>
Dr. Moti Yung, is a Security and Privacy Research Scientist with Google and an
Adjunct Research faculty with the Computer Science Department, Columbia
University. He received his Ph.D. degree from Columbia University in 1988. Dr.
Yung’s research interests are primarily in security, privacy, and
cryptography. Contact him at<EMAIL_ADDRESS>Dr. Danfeng (Daphne) Yao, is
a Professor of Computer Science at Virginia Tech. She is an Elizabeth and
James E. Turner Jr. ’56 Faculty Fellow and CACI Faculty Fellow. She received
her Ph.D. degree from Brown University. Her research interests are on building
deployable and proactive cyber defenses, focusing on detection accuracy and
scalability. Contact her at<EMAIL_ADDRESS>