Expense Manager Services

Getting a handle on Unmanaged Spend through Expense Manager Services

France Newsletter

telecommunications

Hundreds of French academics sign letter asking for safeguards on contact tracing

A group of 471 French cryptography and security researchers has signed a letter to raise awareness about the potential risks of a contact-tracing app. A debate in the French parliament will take place tomorrow to talk about all things related to post-lockdown — including contact-tracing app StopCovid.

Among the group of researchers, 77 of them are affiliated with Inria, the French research institute that has been working on the contact-tracing protocol that will power the government-backed contact-tracing app, ROBERT. With this letter, it appears that Inria is conflicted about ROBERT.

“All those applications induce very important risks when it comes to protecting privacy and individual rights,” the letter says. “This mass surveillance could be done by collecting the interaction graph of individuals — the social graph. It could happen at the operating system level on the phones. Not only operating system makers could reconstruct the social graph, but the state could as well, more or less easily depending on the approaches.”

The letter also mentions a thorough analysis of centralized and decentralized implementations of contact-tracing protocols. It includes multiple attack scenarios and undermines both the DP-3T protocol as well as ROBERT.

Ahead of the debate in the French parliament tomorrow, researchers say that “it is essential to thoroughly analyze the health benefits of a digital solution with specialists — there should be important evidence in order to justify the risks incurred.”

Researchers also ask for more transparency at all levels — every technical choice should be documented and justified. Data collection should be minimized and people should understand the risks and remain free not to use the contact-tracing app.

Over the past few weeks, multiple groups of researchers in Europe have been working on different protocols. In particular, DP-3T has been working a decentralized protocol that leverages smartphones to compute social interactions. Ephemeral IDs are stored on your device and you can accept to share ephemeral IDs with a relay server to send them to the community of app users.

PEPP-PT has been backing a centralized protocol that uses pseudonymization to match contacts on a central server. A national authority manages the central server, which could lead to state surveillance if the protocol isn’t implemented properly. ROBERT is a variant of PEPP-PT designed by French and German researchers.

While the French government has always been cautious about the upsides of a contact-tracing app, there’s been little debate about the implementation. Inria, with official backing from the French government, and Fraunhofer released specifications for the ROBERT protocol last week.

Many (including me) have called out various design choices, as you have to trust your government that they’re not doing anything nefarious without telling you — a centralized approach requires a lot of faith from the end users as the government holds a lot of data about your social interactions and your health. Sure, it’s pseudonymized, but it’s not anonymized, despite what the ROBERT specification document says.

Moreover, ROBERT doesn’t leverage Apple and Google’s contact-tracing API that is in the works. France’s digital minister, Cédric O, has been trying to put some pressure on Apple over Bluetooth restrictions with a Bloomberg interview. Given that Apple and Google provide an API for decentralized implementations, they have little incentive to bow to French pressure.

On Sunday, Germany announced that it would abandon its original plans for a centralized architecture in favor of a decentralized approach, leaving France and the U.K. as the two remaining backers of a centralized approach.

France’s data protection watchdog CNIL released a cautious analysis of ROBERT, saying that the protocol could be compliant with GDPR. But it says it will need further details on the implementation of the protocol to give a definitive take on StopCovid.

The European Data Protection Supervisor (EDPS) also said on Twitter that the debate in front of the French parliament is particularly important. “Decisions will have an impact not only on the immediate future but as well on years to come,” they say.

France’s Inria and Germany’s Fraunhofer detail their ROBERT contact-tracing protocol

Read more: https://techcrunch.com/2020/04/27/hundreds-of-french-academics-sign-letter-asking-for-safeguards-on-contact-tracing/

telecommunications

France is officially working on Stop Covid contact-tracing app

France’s health minister Olivier Véran and digital minister Cédric O have officially announced that the French government is working on a smartphone app to slow the spread of COVID-19. The government is putting a stamp of approval on the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) project but remains cautious about what to expect from an app.

Using mobile apps to track the coronavirus is a sensitive issue in Europe. Dozens of nonprofit organizations have written a common statement urging governments to respect human rights.

They fear that governments could use this opportunity to enforce far-reaching surveillance measures that don’t comply with the regulatory framework and that remain in place after the coronavirus crisis. The European Commission reminded governments that they should implement “appropriate safeguards” as EU citizens are not going to trust contact-tracing apps if they don’t treat personal information appropriately.

That’s probably why the government is preventively trying to reassure people before releasing the Stop Covid app. According to a statement, the Ministry for the Digital Sector says that it is working with the Health Ministry, the Justice Ministry and the Ministry of Higher Education, Research and Innovation to coordinate tech-based initiatives.

Led by Germany’s Fraunhofer Heinrich Hertz Institute for telecoms (HHI), the PEPP-PT project that was unveiled last week is a coalition of dozens of research institutions across multiple countries. France’s INRIA is a member of the PEPP-PT and the French government is willing to collaborate with the INRIA as part of the PEPP-PT effort.

They’re working on an open standard to develop contact-tracing apps. Those apps would rely on Bluetooth Low Energy to identify other phones running the same app. If, at some point, you are near an infected person, you would be notified.

And the French government says that there will be an app specifically designed to track people living in France. That app will leverage the PEPP-PT protocol.

People in favor of contact-tracing apps say that it would help break infection chains if you combine those apps with proactive tests and self-isolations.

In an interview with Le Monde, Cédric O and Olivier Véran detailed the effort. France isn’t going to force you to install the app and “Stop Covid” is only going to use Bluetooth. A prototype is in the works, but it’s going to take three to six weeks to develop.

Even then, the French government might not even release the app. “We’re not sure that we can overcome all the technical difficulties because Bluetooth hasn’t been designed to measure the distance between individuals. We will decide later if it would be useful to roll out such an application or not,” Cédric O told Le Monde .

When it comes to privacy, Cédric O says the app will be open-source and France’s privacy watchdog the CNIL will have a say. We’ve reached out to the CNIL for comment but the agency said it was too early to comment.

More importantly, details are still thin on the implementation of the PEPP-PT protocol in France. Privacy experts are debating the design of the system. Some argue that it should be as decentralized as possible. Smartphones should keep a log of your social interactions (via ephemeral Bluetooth identifiers). Your phone would regularly fetch a list of infected ephemeral Bluetooth identifiers and do the heavy lifting.

The PEPP-PT project currently supports centralized and decentralized approaches, which means that governments have to decide on an implementation. In a centralized system, a server would assign each user an anonymized identifier and collect data about your social interactions. Each user would be able to fetch the status of its identifier to check whether they’ve been potentially infected or not. It creates a single point of failure and presents risks if someone is able to match anonymized identifiers with real names.

EU privacy experts push a decentralized approach to COVID-19 contacts tracing

The Ministry for the Digital Sector also detailed how France is leveraging tech in general to understand the coronavirus outbreak, improve COVID-19 treatments and plan the end of the lockdown in France.

In addition to the app that is currently in the works, the French government has rolled out an official website to inform people, is encouraging telemedicine services to treat patients (such as Covidom from public hospitals in Paris), is mining aggregated data from telecom companies to understand how people move around the country and is leveraging machine learning on big data to forecast the coronavirus outbreak.

Read more: https://techcrunch.com/2020/04/08/france-is-officially-working-on-stop-covid-contact-tracing-app/

banks

Moneytis is like a travel fare aggregator, but for sending money abroad

If you don’t care too much about loyalty programs, chances are that you’ve been relying on platforms like Booking.com and Expedia to find the cheapest flights and hotel rooms. Moneytis wants to do the exact same thing, but for foreign exchange services.

TransferWise is arguably the biggest consumer brand in international transfers. Instead of telling your bank to send money to your bank account, you send money to TransferWise first. The startup then converts the amount and transfers your money to the other account abroad.

It’s been an eye-opening experience for many consumers who realized that they’re getting screwed by banks, Western Union, Moneygram, etc.

But TransferWise is just one player in this space. For instance, while the startup is usually quite competitive when you want to convert GBP into EUR, it’s not as competitive when you want to send money from the U.S. to Europe. Other services, such as CurrencyFair let you keep more money at the end of your transfer.

That’s why Moneytis is applying the Booking.com model to international transfers. The experience is quite straightforward as you just have to put two different currencies and how much money you plan on sending.

“I was an expat in China and Etienne [Tatur] was in Europe. And I was shocked by hidden fees every time I wanted to send money,” co-founder and CFO Christophe Lassuyt told me. “That’s when we listed and compared all solutions out there. Friends quickly asked us to see the list. We ended up launching a comparison tool. We then understood that users wanted to compare, but also transfer easily. That’s the service we’re launching.”

 

Moneytis then compares many services and displays the fastest service, the cheapest one, the most popular one, etc. You don’t have to sign up to other services as you can send your money directly on Moneytis.

The startup doesn’t add any fee. Instead, Moneytis takes a small cut from third-party services as it is generating leads for those foreign exchange services. On average, clients are sending $2,000 — Moneytis takes 0.3 percent (representing $6) and it’s transparent for the user.

There’s no clear winner in the foreign exchange space as big players like TransferWise only cover some currencies. Exchange rate volatility also means that some services are going to be cheaper one day and more expensive the next day. Finally, some services will be able to get better deals for particular routes.

Moneytis is clearly a volume play as the startup will need thousands of transfers per day to scale. It could build an API so that big clients can automate transfers and always use the cheapest service out there. This way, the service could become an essential tool for companies doing business in many different countries.

Read more: https://techcrunch.com/2017/08/12/moneytis-is-like-a-travel-fare-aggregator-but-for-sending-money-abroad/