Since 11 May, France has entered the phase of de-conference. To prevent a second wave of Covid-19 contamination and a second containment, the government has taken several steps to protect citizens. One is StopCovid, a mobile app that detects the user’s contact with other people and reports if any of the contacts carry the coronavirus. Here are all the details.
At the beginning of April, several French politicians were speaking about the development of a mobile application to establish the list of people crossed by the French and to report whether they have been in contact with a person carrying the coronavirus. A project validated by the President of the Republic and supported by several ministers, including Olivier Véran, Minister of Health, and Olivier O, Secretary of State for Digital Affairs, both of whom discussed the project on 8 April 2020. The app is called StopCovid.
Five days later, on 13 April, during his televised address, Emmanuel Macron confirmed the development of the mobile application as part of the France’s gradual de-conference, which will begin on 11 May. This is despite the fact that it is controversial, especially in terms of the efficiency and security of personal data. Assuring that every effort would be made to protect user information, he added that the application improves prevention against the risk of contamination.
You will find in this folder all the information to know about the StopCovid application, including its role and operation so that you can decide, as serenely as possible, whether or not to install it on your smartphone when it becomes available.
❓ StopCovid, what is it?
StopCovid is a smartphone app. It is iOS and Android compatible. It relies on the Bluetooth standard (which you already use to connect your phone to an interactive speaker, smartwatch or wireless headset, for example). And it’s used to determine if you’ve been in contact with someone else using Bluetooth.
By collecting contact information, it not only helps to trace a path of infection if a user declares himself ill, but also to warn all people crossed by infected people by advising them to be tested and isolated.
The development of the application is managed by INRIA (National Institute for Research in Computer science and automatics). Half a dozen companies collaborate in this project: Capgemini, Dassault Systems, Lunabee Studio, Orange, Nodle and Withings. To this panel, we must add three government agencies: ANSSI, INSERM and Public Health France. Another group, including Thales, Atos and Accenture, is also mentioned.
🥅 What is The Purpose of StopCovid?
The purpose of the StopCovid app is twofold. The first objective is to determine the path of contamination coronavirus. The path of contamination is the path taken by the virus through infected people. They, whether or not they have symptoms, transmit the virus to those close to it. And so on.
The second objective, which continues the mission of the former, is to notify the user if they have been in contact with someone who has indicated that they are carrying the virus. If this is the case, the application invites the user to stay at home, isolated, so as not to infect other people, contact a doctor in videoconference in order to be prescribed a test. With this device, the government hopes to break the chains of contamination. In addition, the malades will be managed more quickly, since their contamination will be known further upstream.
The StopCovid app works in a similar way to Coalition, an app launched in the U.S. to trace contacts. StopCovid works in two parts. The first part is the detection of other citizens in a nearby area. The second component is the relationship between a person declared ill (or carrying the virus) and a healthy person.
Let’s look at the first part first. The StopCovid app, once activated, searches for the phone of people in the vicinity geographically. A contact is recorded when the person is nearby (and if they have a smartphone equipped with the app).
For a contact to be registered in the app, Maximum distance must be 1.5 metres. According to the company responsible for designing the Bluetooth part of the app, the calculation of distances using Bluetooth is fairly accurate up to 2 meters. That’s a distance greater than the distance used to record a contact.
The app does not rely on the technology bricks (or API) of Apple and Google. Indeed, the French government has not signed agreements with the two American giants and has chosen the protocol Robert, designed by INRIA. This means that there is a technical constraint: the contact is not recorded by the app if the perceived smartphone is an iPhone and the latter is locked. Nevertheless, Cedric O, the Secretary of State for Digital Affairs, says that StopCovid will simply circumvent Apple’s limitations and “will work very well” iPhone.
Once activated, the app works in the background and constantly solicits the Bluetooth connection smartphone. This means that the app will affect the battery life of the smartphone. According to the designer of the Bluetooth part of the app, StopCovid consumes between 0.5% and 3.5% of the battery, depending on the battery’s capacity.
Let’s move on to the second part: the alert. Once a contact has been recorded by the application, the information is transmitted to a secure server. If a user declares himself infected, the system recovers all the contacts recorded over a 14-day period and sends generic notifications to cross-references, inviting them to isolate themselves and seek screening.
💿 What data does the app collect?
The data collected by the app is anonymous. When two StopCovid-equipped smartphones connect to each other through Bluetooth protocol and confirm their owners’ proximity, they exchange information. Each app emits a Random identifier. This identifier is saved with the time. Geolocation is not backed up because it is not useful for determining a path of contamination. The app does not need a permanent GPS or GSM connection.
Contacts made (associated with anonymous random identifiers) are transmitted to a secure server when an Internet connection is available. It is this server that will look for people in a path of contamination if a person declares himself ill. And it is he too who will send the generic message to the people crossed by the patient. No information on the identity of the patient will be passed on to the recipients of the alerts.
⌚ When will the app be available?
The date of publication of the application is not yet certain. Indeed, the developments on the application are not yet finished at the time we write these lines. Initially, the state wanted the app toready from the first phase of the de-conference, which begins on 11 May. But several technological and political challenges have hindered its development.
The government hopes that it will be available at the beginning of the second phase, which will start on June 2, 2020. Before that date, StopCovid will be in the testing phase. According to the Secretary of State for Digital Affairs, a functional version should be presented to the government by May 11, when the deconfeinment begins. A “real-world” testing phase will be carried out during the weeks of the first phase.
Note that StopCovid should also be the subject of a parliamentary debate by the time it is launched. This debate, which must lead to a vote, was postponed for the first time by the French government, because the application is not unanimous, even within the presidential majority. There is a risk that MPs and senators will block its deployment.
👨 ⚖️ Is it mandatory to use it?
No, it will not be mandatory to install and use StopCovid to take advantage of the deconfinement. From the outset, the government insisted that StopCovid’s use will be subject to volunteering. You choose if you want to install it.
This choice makes sense because a part of the population will not be able to use it, even if it were made mandatory. Indeed 23% of French people do not have a smartphone. The latter will therefore benefit from the deconfinement like all other French, without using the application.
There is also another reason why the authorities are forcing this voluntary approach. As the risky proposal by an LREM MP to make StopCovid mandatory or to grant benefits to those who use it would be contrary to the RGPD and runs counter to the CNIL’s opinion on this issue.
In addition, users voluntarily report their Covid-19 infection. No information will be collected from doctors or medical services. It is volunteerism that prevails here too to build the path of infection. It is therefore the goodwill of the users that determines the effectiveness of the device.
😡 Why is StopCovid controversial?
The StopCovid app is controversial for two reasons. The first is doubt about its true effectiveness to alert and warn citizens. The second is protecting personal data. Two important points raised not only by many experts, who spoke against it in an open letter, and associations such as the Quadrature du Net.
The effectiveness of the application is questioned for several reasons. Firstly, because the protocol Bluetooth was not designed to calculate distances between two devices. An adaptation of the technology is therefore necessary. But this does not guarantee that it will not generate false positives (or that it will not forget to record a contact).
Then, the fact that it does not use The APIs of Google and Apple will block the registration of certain contacts, especially those whose iPhone will be locked. Finally, the whole system is based on volunteerism, a concept repeatedly recalled. A person must volunteer to install the app and use it. It must also be reported to be contaminated. If the number of voluntary users is too low, the entire system will be ineffective.
In addition, the protection of personal data is called into question. First, is the information transmitted between smartphones anonymous? Is the exchange protocol encrypted to prevent information theft? Is the safeguarding of contacts well protected? Is the application itself secure enough? And what about the server that will store all the information to cross them and pull out the paths of contamination? These are just some of the many questions from computer security experts. This is despite the idea that the CNIL (National Commission on Computer Science and Freedoms) has given the green light to the project, after showing some skepticism.