France to test controversial Covid-19 tracking app during lockdown exit
Issued on: Modified:
As France awakens from lockdown on 11 May, the government will start testing “under real conditions” a prototype for its much-criticised StopCovid contact tracking phone app, ahead of the product’s intended full roll-out on 2 June.
The app works by using Bluetooth to interact with nearby phones and detect when users come into contact with potential coronavirus carriers. It generates an anonymous numerical ID that’s exchanged with other smartphones also running the app.
The ID of anyone who tests positive is red-flagged, and a warning is then sent to those who have crossed paths with an infected person. The app does not, however, reveal details about where and when the encounter took place. Unlike similar technology in China, geolocation data is not recorded.
The use of StopCovid – developed in France by researchers and companies under the supervision of the government – will be purely voluntary, but it needs to be widespread if it’s to play any meaningful role in slowing the epidemic.
Too much power in the hands of government?
While its designers have given assurances the app will not ask for a person’s civil status or phone number, there is no guarantee that police or health authorities will not have access to the information behind the anonymous identifier.
Similar smartphone apps using “contact tracing” have proven a popular tool for governments around the world to monitor the coronavirus, and while medical authorities say tracking software has helped to slow its spread, critics worry the technology gives authorities too much power to exploit personal data.
Last week the French government postponed a debate on the tracing app project after questions were raised over privacy – and how the data might be used after the crisis – with people from across the political spectrum questioning the wisdom of implementing such technology at a state level.
“We need to be careful. There’s legal precedent that we could be establishing now with this framework, and it could later be expanded to other areas,” warned Philippe Gosselin from the conservative Les Républicains party.
Even France’s venerable 300-year-old Academy of Medicine, which is in favour of using a digital device to help ease the country through its “deconfinement”, cautions against the risk of a confidentiality breach. It says the app’s performance must be properly audited and a deadline imposed to ensure it does not survive beyond the health crisis.
Speaking to the parliament, Prime Minister Edouard Philippe conceded that questions concerning civil liberties were “well-founded” and “should be asked”.
If the testing phase goes as planned, Digital Affairs Minister Cedric O said a parliamentary debate would finally be held the week of 25 May.
Dispute between France and Apple
France’s StopCovid project hit early delays amid disagreement between Paris and digital giants Apple and Google – who manage their smartphones’ Bluetooth systems.
Because access to Bluetooth is normally blocked unless the user is actively running an app, France had been pushing for the tech companies to alter the settings and grant StopCovid full access to run Bluetooth in the background.
A refusal by Apple after weeks of discussions on Tuesday led the government to accuse the iPhone maker of undermining France's efforts to fight the coronavirus.
Both Apple and Android-maker Google – the manufacturers of nearly all of smartphones in France – maintain that access to Bluetooth must be limited to prevent apps from spying on users without their knowledge. It also protects the life of phone batteries.
The companies are collaborating on a Covid-19 contact tracing system of their own. It's a common programming interface they say will use a phone’s Bluetooth feature in ways designed to protect privacy. Only limited data would be collected, advertising would be banned and the opt-in technology would not access the user's GPS geolocation.
France has rejected the system, citing issues surrounding “privacy and interconnection with the health system”. Cedric O went a step further, arguing the fight against coronavirus was "the role of the states, not necessarily of US digital giants”.
The standoff has led experts to debate which of the two models – the “centralised” one chosen by France for StopCovid, or the “decentralised” one proposed by Apple and Google – offers users the best protection in terms of privacy.
App technicians in Europe form rival coalitions
Scientists and technicians have had to quickly decide which system to support, with experts from the Swiss Federal Institute of Technology in Lausanne (EPFL) and ETH Zurich in April pulling out of the collaborative Pan-European Privacy-Preserving Proximity Tracing project (PEPP-PT), citing a lack of transparency.
Led by EPFL's professor Carmela Troncoso, the Swiss team has mounted a rival downloadable system called DP-3T (Decentralised Privacy-Preserving Proximity Tracing), which stores data on the phones themselves rather than on a centralised server.
Upon installing the app, a "key" is created that is unique to the phone, emitting random ephemeral identifiers that are stored on a person's phone for 14 days. If the person becomes infected, the random number can, with permission, be uploaded to a central server for processing.
"We've spoken to civil society to understand their worries," Troncoso says, adding the app – which is designed to dismantle itself once it's uninstalled – cannot be misused in its existing form.
"It is important this not be prone to abuse – there's nothing here that can be used to extract personal information ... For the app to get any more information, it would itself need more infrastructure."
Europe pushes for a common solution
About half of EU member states have turned to location-tracking measures to combat the coronavirus, working in tandem with telecom companies to develop apps that trace people at risk, and also by mapping population movements using aggregated location data.
The European Commission wants a common EU approach towards digital solutions to fight Covid-19 and has passed a resolution in parliament stressing that government projects must be in full compliance with EU data protection and privacy laws.
Calls for safeguards to be included in contract tracing have come from the Council of Europe’s data protection commissioner Jean-Philippe Walter and the chair of the council’s data protection “Convention 108” committee, Alessandra Pierucci – who warn of the risks of entering unchartered territory.
While the automatic detection of a person’s contacts could save public health officials “precious hours tracing the chain of infection” and could “fill in important gaps that human memory would not be able to”, the duo said dangerous side effects must also be considered.
“Although technological tools can play an important role in addressing the current challenge, the first – essential – question we have to ask ourselves before systematic and uncritical adoption of technology is: are those 'apps' the solution?”
Daily newsletterReceive essential international news every morningSubscribe