Contact-tracing: France gets ready to launch its own app, rejects Apple and Google option

StopCovid launches tomorrow, and it will not use the API put forward by Apple and Google.
Written by Daphne Leprince-Ringuet, Contributor

France's homegrown contact-tracing app StopCovid will be available to download nationwide from 2 June at midday, the French state secretary for the digital economy Cedric O has said, as the country starts easing lock-down restrictions.

Speaking on French radio station Radio J this week-end, O confirmed that StopCovid is currently being reviewed by Apple and Google and, barring a last-minute tech glitch, that the app will be showing up in iOS and Android Play stores, ready for download, from tomorrow. 

The French Parliament gave the contact-tracing app the green light last week, despite expectations that the technology would face a hostile response from senators in the upper house of Parliament due to concerns with privacy, as well as questions about the effectiveness of the tool.

SEE: VPN: Picking a provider and troubleshooting tips (free PDF)

Like the UK, France started working on developing a contact-tracing app at the start of April, but has now beaten its neighbor to launch. The UK's app was initially planned to become nationally available in or around mid-May, but is currently still being trialed on the Isle of Wight and has not met its delayed official launch date on 1 June. 

"The app can only come out when it is ready, and it is technologically very hard to develop," said O. "An app like this one normally takes up to two years to launch, and we launched it in two months and a half; and what's more, before the English, Italian and Spanish apps."

Both France and the UK have decided to create their own model for digital contact-tracing, rather than adopting a protocol jointly put forward by Apple and Google – a move that sets them apart from most of their European counterparts. Google and Apple's contact-tracing API follows a decentralized approach, which the tech giants maintain is a better way to protect user privacy.

The French team behind StopCovid, instead, set up a centralized protocol called Robert (ROBust and privacy-presERving proximity Tracing). Robert assigns each user a permanent ID stored in a central server; each permanent ID is then tied to regularly generated random IDs, which are broadcasted to other smartphones via Bluetooth. 

If a user tests positive for COVID-19, they will be given a QR code to scan into the app. This triggers an alert to the random IDs that have been picked up by the tool, and which correspond to risky interactions – as defined by the Robert protocol, those that occurred at less than one metre and for at least 15 minutes. 

Although data will be encrypted and anonymous, having a central database of permanent and random IDs tied to users presents a risk, both from malicious hackers and, for some privacy campaigners, the state itself. 

Last week, the French digital freedoms agency CNIL confirmed that the app was lawful and did not interfere with the right to privacy, but maintained that the tool should be regularly evaluated. A bug bounty program dubbed YesWeHack is already operating to dig out any vulnerabilities in the app. O said that less than ten flaws had been flagged so far, none of which were critical. In no case, he added, would anyone be able to access users' social interactions, or the list of people who have tested positive for the virus.

One of the reasons put forward for adopting a centralized approach, rather than a decentralized one, is that it enables better supervision of the overall system by public health services. Specifically, it means that false positives and false negatives could be better controlled, so that warnings are not sent to users unnecessarily.

Marcel Salathé, an epidiemologist from EPFL University in Switzerland, who worked on the Swiss contact-tracing app (which follows a decentralized model), told ZDNet: "In the beginning, there was a concern that if you decentralized, you wouldn't be able to call someone back out of quarantine if the original trigger was false.

"This was a concern in the early days, when testing wasn't good enough; and the idea that you can self-trigger these systems without good testing is indeed very dangerous. You could send thousands of other people into self-quarantine with a malicious attack. But this is not a valid argument anymore, now that testing has improved."

Salathé also argued that a key benefit of using the API put forward by Apple and Google, as opposed to national centralized approaches, is that the tech giants' model automatically enables compatibility with iOS and Android. 

O admitted that the team behind StopCovid initially ran into a number of difficulties, particularly to make sure that the app worked on iPhones; but he added that issues have now been fixed, and that the app has been tested successfully on the top 100 phone models that are most popular among French consumers. 

It remains that a made-in-France contact-tracing app won't be interoperable with apps developed in other countries, which might be problematic for French residents who wish to travel. "It is regrettable, but we are working to make the app interoperable in the future," said O. "The consequences in everyday life, however, will be limited. If you want to spend your holiday in Spain, you will just have to download the Spanish app."

Increasingly, reports have emerged questioning the need for a contact-tracing app altogether. The TraceTogether tool in Singapore, and the CovidSafe app in Australia, have so far been received with mixed reviews. Critics point to the low levels of uptake that the technology has seen, which typically stagnate at around 20% to 25% of the population.

SEE: Contact tracing apps unsafe if Bluetooth vulnerabilities not fixed

O, while acknowledging that health services would need a maximum number of people to download the app, also argued that the tool will start showing "macro and systemic" results even if only 10% of the population in busy cities picks it up. 

Targeting the entire French population does not make sense and is not achievable, said O: to put things into perspective, he compared a 60% uptake with, roughly, the level of download for an app like WhatsApp. "Rather, we are targeting people who live in cities, who take public transportation and go to the restaurant, because they are those who are carrying the virus around," he said. 

The app's launch coincides with the re-opening of parks, cafes, restaurants and some schools across the country. In this context, the French government hopes that the technology will help keep the epidemic under control as people start meeting again, and become less aware of social-distancing rules. 

The launch will come with a strong communication campaign that will portray downloading the app as a similar act to so-called "barrier gestures", such as washing your hands or sneezing in your elbow.

Editorial standards