A few weeks ago, France announced it was developing its own covid-19 contact-tracing app, dubbed StopCovid. The app, while intended to monitor the spread of the novel coronavirus, raised privacy questions, and now, the French government is reportedly tussling with Apple, claiming the company’s iOS Bluetooth policy is stifling its efforts to build the app.
The French government plans to launch its app by May 11, coinciding with efforts to ease shelter-in-place restrictions, according to Bloomberg. As more governments start to consider reopening schools, businesses, and other public areas, contact-tracing apps have emerged as a faster, less laborious way to potentially monitor populations and notify people if they may have come in contact with someone with covid-19. The big question, though, is privacy, and whether Big Tech and governments will keep their word that when this is all over, the data they collected won’t be abused.
In the case of France’s StopCovid, the app is Bluetooth-based, which is better for privacy than using GPS or cellular data. However, France wants its app to send the collected data to a state health services server—a less-secure approach than keeping data locally on a user’s phone, because anonymized data can easily be deanonymized by hackers. Apple’s Bluetooth protocol on iOS doesn’t allow for Bluetooth to run constantly in the background if that data isn’t going to stay on the device—and therein lies the problem for France’s government.
“We’re asking Apple to lift the technical hurdle to allow us to develop a sovereign European health solution that will be tied to our health system,” France’s Digital Minister Cedric O told Bloomberg. Apple is reportedly not keen on doing so.
Part of the reason might be that Apple is already working with Google on a joint contact-tracing solution. That project has also raised questions from privacy experts, but one thing it has going for it is that users can opt to store their data locally. The centralized approach France is gunning for is vulnerable to mission creep, where governments or private-sector companies could repurpose contact-tracing tech for more nefarious means down the road.
Over the weekend, more than 300 scientists and researchers spanning 25 countries released a joint statement warning against contact-tracing apps that use a centralized approach. In it, the academics applauded Apple and Google’s more privacy-based approach and warned against a centralized approach, noting that it’s unnecessary given existing alternatives. The American Civil Liberties Union also recently put out a detailed white paper that advocated for “minimal reliance on central authorities.” To top things off, the European Parliament last week voiced support for a decentralized approach to contact tracing.
France’s insistence on barreling through with a centralized approach, despite expert opinion against it, is baffling. True, the French government loves to slap Apple with fines, but this isn’t a matter of Apple’s dickish business practices. The privacy experts have weighed in, and they overwhelmingly do not support the approach France is pressuring Apple to allow. At this point, instead of wasting time fighting Apple, why not just...do the thing privacy experts recommend?