France is officially working on Stop Covid contact-tracing app

France’s health minister Olivier Véran and digital minister Cédric O have officially announced that the French government is working on a smartphone app to slow the spread of COVID-19. The government is putting a stamp of approval on the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) project but remains cautious about what to expect from an app.

Using mobile apps to track the coronavirus is a sensitive issue in Europe. Dozens of nonprofit organizations have written a common statement urging governments to respect human rights.

They fear that governments could use this opportunity to enforce far-reaching surveillance measures that don’t comply with the regulatory framework and that remain in place after the coronavirus crisis. The European Commission reminded governments that they should implement “appropriate safeguards” as EU citizens are not going to trust contact-tracing apps if they don’t treat personal information appropriately.

That’s probably why the government is preventively trying to reassure people before releasing the Stop Covid app. According to a statement, the Ministry for the Digital Sector says that it is working with the Health Ministry, the Justice Ministry and the Ministry of Higher Education, Research and Innovation to coordinate tech-based initiatives.

Led by Germany’s Fraunhofer Heinrich Hertz Institute for telecoms (HHI), the PEPP-PT project that was unveiled last week is a coalition of dozens of research institutions across multiple countries. France’s INRIA is a member of the PEPP-PT and the French government is willing to collaborate with the INRIA as part of the PEPP-PT effort.

They’re working on an open standard to develop contact-tracing apps. Those apps would rely on Bluetooth Low Energy to identify other phones running the same app. If, at some point, you are near an infected person, you would be notified.

And the French government says that there will be an app specifically designed to track people living in France. That app will leverage the PEPP-PT protocol.

People in favor of contact-tracing apps say that it would help break infection chains if you combine those apps with proactive tests and self-isolations.

In an interview with Le Monde, Cédric O and Olivier Véran detailed the effort. France isn’t going to force you to install the app and “Stop Covid” is only going to use Bluetooth. A prototype is in the works, but it’s going to take three to six weeks to develop.

Even then, the French government might not even release the app. “We’re not sure that we can overcome all the technical difficulties because Bluetooth hasn’t been designed to measure the distance between individuals. We will decide later if it would be useful to roll out such an application or not,” Cédric O told Le Monde .

When it comes to privacy, Cédric O says the app will be open-source and France’s privacy watchdog the CNIL will have a say. We’ve reached out to the CNIL for comment but the agency said it was too early to comment.

More importantly, details are still thin on the implementation of the PEPP-PT protocol in France. Privacy experts are debating the design of the system. Some argue that it should be as decentralized as possible. Smartphones should keep a log of your social interactions (via ephemeral Bluetooth identifiers). Your phone would regularly fetch a list of infected ephemeral Bluetooth identifiers and do the heavy lifting.

The PEPP-PT project currently supports centralized and decentralized approaches, which means that governments have to decide on an implementation. In a centralized system, a server would assign each user an anonymized identifier and collect data about your social interactions. Each user would be able to fetch the status of its identifier to check whether they’ve been potentially infected or not. It creates a single point of failure and presents risks if someone is able to match anonymized identifiers with real names.