by Sylvain Tronchet, Radio France investigation unit, 30 May 2020, France Inter - translation
The StopCovid tracing application, available on 2 June, is presented by the government as an "instrument" to combat Covid-19. However, the debates surrounding its acceptance, the technical problems it still encounters and the feedback from abroad raise the question of its effectiveness.
"StopCovid is not the magic weapon against the epidemic." When he presented the tracing application wanted by the government on Thursday, May 28, Édouard Philippe did not show a blissful enthusiasm for this technology. On April 28th before the National Assembly, he admitted that he was "at a loss to tell you if it works, and how it will work exactly." "It's an instrument, complementary to other instruments", the Prime Minister then explained, the day after a heated debate in the National Assembly.
For several weeks now, the debate on the risks of invasion of privacy and individual freedoms that this technology would represent has not seen a consensus emerge between pro and anti "contact-tracing". But beyond these ethical questions, many experts doubt the practical usefulness of such a tool. Cybersecurity researcher Baptiste Robert is among those who have been testing the application since May 27. He notes that "the government never talks about feedback from countries that have already implemented this kind of application. Yet they admitted it was not so good."
In Australia, only one person detected in one month
Singapore, in particular, launched its "TraceTogether" application on 20 March. A month later, in an op-ed piece, Jason Bay, the head of the government's digital services agency, said, "If you ask me if any tracing application, existing or under development, anywhere in the world is going to replace manual tracing, I would say without hesitation that the answer is no." According to him, due to its complexity, "tracing should remain a human made process." In Singapore, only 15% of the 5.6 million people have downloaded the application. A relatively low rate that may also explain these disappointing results.
In Iceland, the local application "Rakning C-19", launched at the beginning of April, is based on the geolocation of users, as the local authorities considered bluetooth to be insufficiently reliable. Despite this more radical technical choice, and a download rate among the highest in the world (40% of the population), one of the police officials in charge of tracking said he too was circumspect in an interview with the MIT Technology Review: "The technology is more or less... I wouldn't say it's useless," Pálmason said. "I would say [Rakning] has been useful in a few cases, but it hasn't changed things for us."
In Australia, the Prime Minister had presented technology as a "key element in the return to normality". Despite an honorable level of downloads (5 million out of a population of 25 million), in one month "Covidsafe" was able to identify... only one person. The Australian government mentions in particular problems of compatibility with iPhones to explain this failure.
France Isolated
Australia, like France, has chosen to develop its own application without using the technology made available by Apple and Google. In an unprecedented collaboration, the two American "tech" giants have developed an "API" (programming interface) that can be used by any government that chooses to use it. To date, 22 countries, including Germany (which collaborated with France for a time before changing direction), Italy, Switzerland and the Netherlands have adopted this "platform", on which each has then developed its own application. France refused, notably for reasons of "digital sovereignty".
According to the Digital Secretary of State, the technology of the two American giants would present "risks of failure", and "the definition of the contact-tracing algorithm and the ability of the health authority to have all the statistical data at its disposal cannot be left in the hands of another entity".
However, all the experts we interviewed are clear: the use of the Apple-Google API does not mean that the data is hosted abroad. "No medical data is sent to Google or Apple servers," Guillaume Rozier, the creator of the Covidtracker platform, explains to the Radio France investigation unit. "Each state keeps its own servers," he said. "This is all the more true because it is a decentralized architecture where the data is stored on each phone, whereas the French system, which is centralized, uses a central server that stores all the data."
According to the French government, the "decentralized" system imposed by Apple's API and Google would be less secure, however. This argument is again disputed by many experts. "Each solution has its advantages and disadvantages in terms of security," explains Gaëtan Leurent, a researcher at INRIA (the institute that served as the bridgehead for the development of Stopcovid).
He and about 15 other researchers signed a document showing how the anonymity theoretically guaranteed by tracing applications can be circumvented. According to him, with decentralized systems, "one can succeed in detecting who is sick in the neighborhood of a building, for example, while centralized systems will eventually allow false alarms to be issued against a person."
In an open letter, several hundred European researchers, including French ones, expressed their preference for decentralized systems, as did the European Parliament in a resolution voted on 17 April.
Digital sovereignty, really?
The "digital sovereignty" argument put forward by the government also leaves some experts perplexed. Paul Christophle, a former digital adviser to Fleur Pellerin and opponent of tracing applications, notes that "the government maintains a certain inconsistency. On the one hand, it refuses Apple and Google's solutions, on the other hand it allows the transfer of SIDEP and Contact Covid files (which gather data from positive tests and health insurance investigations) to the 'Health data Hub', the platform it created and which is hosted by Microsoft!" Cédric O also acknowledged in front of the Senate that on this issue, the government had indeed chosen an American solution for reasons of health efficiency.
For Tariq Krim, "by definition, when you develop on iOS or Android, you're not sovereign." The creator of Netvibes, former vice-president of the National Digital Council believes that Apple "is in its role in refusing to allow software, whoever its creator is, to take control of the phone without the user being fully aware of it".
For another industry expert, "the government pretended to believe that Apple was going to allow them to depart from their rules when they have always refused to do so, even to the US government! They probably wanted to send a signal that they were not going to work with Apple and Google and that they would prefer national companies, but basically, it won't make much difference..."
No "interoperability" with foreign applications
This French choice will nevertheless have a consequence: StopCovid will probably never be compatible with most foreign applications. Questioned by MEPs in the Law Committee on 26 May, Cedric O acknowledged that "to date, there are strong doubts about the ability to make the French and British solutions interoperable on the one hand, with the German, Italian and Swiss solutions on the other".
The Secretary of State was particularly questioned on this subject by Philippe Latombe, Member of Parliament (Modem) for the Vendée region, for whom "the question is: will the systems make it possible to prevent the creation of clusters linked to population movements [in Europe] this summer for the holidays? The answer is apparently no for the moment. Aware of this limitation, the British government has launched a contract for the development of an application compatible with Apple and Google systems, in case it is necessary to replace the current one, comparable to Stopcovid in its operation.
StopCovid will not work well with iPhones
The choice of France will probably have another annoying drawback: Apple's iPhones will only work very imperfectly with StopCovid. The American firm has refused to collaborate with the government to lift restrictions on the use of bluetooth on its devices. "If an iPhone is on standby, or the application is running in the background," explains Baptiste Robert, "the operating system of iPhones does not allow access to bluetooth for privacy reasons. This is also true with the latest generation of Android."
The Secretary of State for Digital Affairs claims to have found a way around this problem: a feature of Android-equipped mobile phones would be able to "wake up" the bluetooth of iPhones when they pass close by. This possibility was indeed observed during the first tests conducted since Wednesday.
Despite everything, this feature doesn't seem to work every time. "I've had trouble getting applications to communicate with each other, including between Android devices, without knowing whether it came from the application itself or the operating system," explains Adrien Jeanneau, one of those "ethical hackers" who look for flaws and bugs to fix them before the official release of Stopcovid.
For many experts, one thing seems pretty certain: two StopCovid-equipped iPhones in close proximity will not communicate in the majority of cases. A "hole in the racket" implicitly recognized by Cédric O when he says that "the application locates 75-80% of the devices in the vicinity." Random or not, this rate of non-detection corresponds roughly to Apple's market share in France, around 21%. When asked, the Secretary of State for the Digital Economy did not answer our questions on this subject, any more than Apple and Google did.
How many contacts detected?
These technical concerns are far from being anecdotal about the overall effectiveness of the application. "Problems with iPhones can eliminate many contacts and give a false sense of security to some users," says one researcher. This would generate what experts call "false negatives. On the other hand, the inaccuracy of bluetooth technology could create "false positives," people who receive warning messages when they have not been in close contact with a potential sick person.
"You have to understand that bluetooth was not developed for this, and that it is a relatively imprecise technology," explains Baptiste Robert. "What's more, we are not all equal," continues the cyber security researcher. "Depending on the age of your phone, the type of bluetooth chip or version, the performance can be really different."
In Singapore, the head of the government digital agency believes that these limitations in the effectiveness of these applications are not insignificant. "There are lives at stake," he wrote. "False positives and false negatives have consequences in real life."
How many downloads?
Finally, it remains to be seen how many French people will actually download and use StopCovid. In countries that have already launched their application on a voluntary basis, rates range from 10 to 50% of the population. A study conducted by Oxford University estimated in March that a minimum of 60 per cent of a population would be needed for this type of application to be a real help in curbing the epidemic.
In an op-ed published on the internet, Cedric O says that "in a population area like a city, the application starts to be effective from a few percent." A statement that does not convince some specialists. "If you are 10% of the population that has the application", reminds Gaëtan Leurent from INRIA, "in the best case you can only detect 1% of contacts, since both people must have the application."
Other researchers also point out that the mode of spread of the disease was unpredictable and that some people were infected from well over a meter away, while others were not as a result of close contact. "They're launching a tool whose effectiveness is very doubtful, telling us that if it only saves one person, that's good enough," says Paul Christophle. "But at what price?" he asks. "I know it's a difficult speech to make politically in times of crisis, but what's the price of creating a file that gathers a lot of personal and sensitive information and which, by definition, is not inviolable?"
The financial cost of the StopCovid system is as yet unknown. Before the Senate, Cédric O explained that the companies associated with the project had worked for free until now and that the management of the application should cost "a few hundred thousand euros per month". A web entrepreneur, who has been watching the project for several months, sighs: "We don't know if this app will really be useful, but I can already see a lot of people starting to fumble, because they understood that there were budgets that were going to be released."
Original article in French:
https://www.franceinter.fr/application-stopcovid-accouchee-dans-la-douleur-et-une-efficacite-deja-remise-en-cause
In Australia, only one person detected in one month
Singapore, in particular, launched its "TraceTogether" application on 20 March. A month later, in an op-ed piece, Jason Bay, the head of the government's digital services agency, said, "If you ask me if any tracing application, existing or under development, anywhere in the world is going to replace manual tracing, I would say without hesitation that the answer is no." According to him, due to its complexity, "tracing should remain a human made process." In Singapore, only 15% of the 5.6 million people have downloaded the application. A relatively low rate that may also explain these disappointing results.
In Iceland, the local application "Rakning C-19", launched at the beginning of April, is based on the geolocation of users, as the local authorities considered bluetooth to be insufficiently reliable. Despite this more radical technical choice, and a download rate among the highest in the world (40% of the population), one of the police officials in charge of tracking said he too was circumspect in an interview with the MIT Technology Review: "The technology is more or less... I wouldn't say it's useless," Pálmason said. "I would say [Rakning] has been useful in a few cases, but it hasn't changed things for us."
In Australia, the Prime Minister had presented technology as a "key element in the return to normality". Despite an honorable level of downloads (5 million out of a population of 25 million), in one month "Covidsafe" was able to identify... only one person. The Australian government mentions in particular problems of compatibility with iPhones to explain this failure.
France Isolated
Australia, like France, has chosen to develop its own application without using the technology made available by Apple and Google. In an unprecedented collaboration, the two American "tech" giants have developed an "API" (programming interface) that can be used by any government that chooses to use it. To date, 22 countries, including Germany (which collaborated with France for a time before changing direction), Italy, Switzerland and the Netherlands have adopted this "platform", on which each has then developed its own application. France refused, notably for reasons of "digital sovereignty".
According to the Digital Secretary of State, the technology of the two American giants would present "risks of failure", and "the definition of the contact-tracing algorithm and the ability of the health authority to have all the statistical data at its disposal cannot be left in the hands of another entity".
However, all the experts we interviewed are clear: the use of the Apple-Google API does not mean that the data is hosted abroad. "No medical data is sent to Google or Apple servers," Guillaume Rozier, the creator of the Covidtracker platform, explains to the Radio France investigation unit. "Each state keeps its own servers," he said. "This is all the more true because it is a decentralized architecture where the data is stored on each phone, whereas the French system, which is centralized, uses a central server that stores all the data."
According to the French government, the "decentralized" system imposed by Apple's API and Google would be less secure, however. This argument is again disputed by many experts. "Each solution has its advantages and disadvantages in terms of security," explains Gaëtan Leurent, a researcher at INRIA (the institute that served as the bridgehead for the development of Stopcovid).
He and about 15 other researchers signed a document showing how the anonymity theoretically guaranteed by tracing applications can be circumvented. According to him, with decentralized systems, "one can succeed in detecting who is sick in the neighborhood of a building, for example, while centralized systems will eventually allow false alarms to be issued against a person."
In an open letter, several hundred European researchers, including French ones, expressed their preference for decentralized systems, as did the European Parliament in a resolution voted on 17 April.
Digital sovereignty, really?
The "digital sovereignty" argument put forward by the government also leaves some experts perplexed. Paul Christophle, a former digital adviser to Fleur Pellerin and opponent of tracing applications, notes that "the government maintains a certain inconsistency. On the one hand, it refuses Apple and Google's solutions, on the other hand it allows the transfer of SIDEP and Contact Covid files (which gather data from positive tests and health insurance investigations) to the 'Health data Hub', the platform it created and which is hosted by Microsoft!" Cédric O also acknowledged in front of the Senate that on this issue, the government had indeed chosen an American solution for reasons of health efficiency.
For Tariq Krim, "by definition, when you develop on iOS or Android, you're not sovereign." The creator of Netvibes, former vice-president of the National Digital Council believes that Apple "is in its role in refusing to allow software, whoever its creator is, to take control of the phone without the user being fully aware of it".
For another industry expert, "the government pretended to believe that Apple was going to allow them to depart from their rules when they have always refused to do so, even to the US government! They probably wanted to send a signal that they were not going to work with Apple and Google and that they would prefer national companies, but basically, it won't make much difference..."
No "interoperability" with foreign applications
This French choice will nevertheless have a consequence: StopCovid will probably never be compatible with most foreign applications. Questioned by MEPs in the Law Committee on 26 May, Cedric O acknowledged that "to date, there are strong doubts about the ability to make the French and British solutions interoperable on the one hand, with the German, Italian and Swiss solutions on the other".
The Secretary of State was particularly questioned on this subject by Philippe Latombe, Member of Parliament (Modem) for the Vendée region, for whom "the question is: will the systems make it possible to prevent the creation of clusters linked to population movements [in Europe] this summer for the holidays? The answer is apparently no for the moment. Aware of this limitation, the British government has launched a contract for the development of an application compatible with Apple and Google systems, in case it is necessary to replace the current one, comparable to Stopcovid in its operation.
StopCovid will not work well with iPhones
The choice of France will probably have another annoying drawback: Apple's iPhones will only work very imperfectly with StopCovid. The American firm has refused to collaborate with the government to lift restrictions on the use of bluetooth on its devices. "If an iPhone is on standby, or the application is running in the background," explains Baptiste Robert, "the operating system of iPhones does not allow access to bluetooth for privacy reasons. This is also true with the latest generation of Android."
The Secretary of State for Digital Affairs claims to have found a way around this problem: a feature of Android-equipped mobile phones would be able to "wake up" the bluetooth of iPhones when they pass close by. This possibility was indeed observed during the first tests conducted since Wednesday.
Despite everything, this feature doesn't seem to work every time. "I've had trouble getting applications to communicate with each other, including between Android devices, without knowing whether it came from the application itself or the operating system," explains Adrien Jeanneau, one of those "ethical hackers" who look for flaws and bugs to fix them before the official release of Stopcovid.
For many experts, one thing seems pretty certain: two StopCovid-equipped iPhones in close proximity will not communicate in the majority of cases. A "hole in the racket" implicitly recognized by Cédric O when he says that "the application locates 75-80% of the devices in the vicinity." Random or not, this rate of non-detection corresponds roughly to Apple's market share in France, around 21%. When asked, the Secretary of State for the Digital Economy did not answer our questions on this subject, any more than Apple and Google did.
How many contacts detected?
These technical concerns are far from being anecdotal about the overall effectiveness of the application. "Problems with iPhones can eliminate many contacts and give a false sense of security to some users," says one researcher. This would generate what experts call "false negatives. On the other hand, the inaccuracy of bluetooth technology could create "false positives," people who receive warning messages when they have not been in close contact with a potential sick person.
"You have to understand that bluetooth was not developed for this, and that it is a relatively imprecise technology," explains Baptiste Robert. "What's more, we are not all equal," continues the cyber security researcher. "Depending on the age of your phone, the type of bluetooth chip or version, the performance can be really different."
In Singapore, the head of the government digital agency believes that these limitations in the effectiveness of these applications are not insignificant. "There are lives at stake," he wrote. "False positives and false negatives have consequences in real life."
How many downloads?
Finally, it remains to be seen how many French people will actually download and use StopCovid. In countries that have already launched their application on a voluntary basis, rates range from 10 to 50% of the population. A study conducted by Oxford University estimated in March that a minimum of 60 per cent of a population would be needed for this type of application to be a real help in curbing the epidemic.
In an op-ed published on the internet, Cedric O says that "in a population area like a city, the application starts to be effective from a few percent." A statement that does not convince some specialists. "If you are 10% of the population that has the application", reminds Gaëtan Leurent from INRIA, "in the best case you can only detect 1% of contacts, since both people must have the application."
Other researchers also point out that the mode of spread of the disease was unpredictable and that some people were infected from well over a meter away, while others were not as a result of close contact. "They're launching a tool whose effectiveness is very doubtful, telling us that if it only saves one person, that's good enough," says Paul Christophle. "But at what price?" he asks. "I know it's a difficult speech to make politically in times of crisis, but what's the price of creating a file that gathers a lot of personal and sensitive information and which, by definition, is not inviolable?"
The financial cost of the StopCovid system is as yet unknown. Before the Senate, Cédric O explained that the companies associated with the project had worked for free until now and that the management of the application should cost "a few hundred thousand euros per month". A web entrepreneur, who has been watching the project for several months, sighs: "We don't know if this app will really be useful, but I can already see a lot of people starting to fumble, because they understood that there were budgets that were going to be released."
Original article in French:
https://www.franceinter.fr/application-stopcovid-accouchee-dans-la-douleur-et-une-efficacite-deja-remise-en-cause
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.