Franceinfo returns the two months which led to the launch, Monday, June 2, of the application supposed to help identify “case contacts” thanks to the Bluetooth of your smartphone.
Just two months ago, the project was not “not a subject” on which the executive was working, according to Christophe Castaner. But StopCovid is indeed downloadable Monday June 2. Developed since late March to contain the Covid-19 pandemic in France, the application crystallized many tensions, between health benefits and security tracking.
>> Find all the info on the Covid-19 epidemic in our live
On the technical side, StopCovid is a tracking application allowing to record, via a Bluetooth connection, the people with whom you have been in contact for more than 15 minutes, and to notify them if you test positive for Covid-19, thanks to a QR code obtained at the time of the test. But on the political side, it has also become the disputed symbol of an additional step towards a surveillance society.
From initial hesitations of the government, until the far from unanimous vote in Parliament on May 27, Franceinfo tells you about the tortuous path taken by the StopCovid application to reach the phones of the French.
In February, the epidemic brought out a myriad of tools to fight Covid-19, sometimes synonymous with extreme surveillance. In China, for example, an application has been launched to assign a color to each citizen according to their state of health. However, it conditioned access to transport or certain public spaces and transmitted data to the police. In South Korea, authorities have started to track infected patients, collecting their mobile, bank data or video surveillance images. Anyone who encountered someone with the virus could know their past route, gender or age.
These highly disparaged examples have led to great caution in France. Even if it means first excluding the use of such tools. On March 26, the Minister of the Interior ruled that these devices were not “not in French culture”. “I trust the French so that we do not need to set up these systems, which basically reach the individual freedom of each to be effective. This is not a subject on which we are working”, he said. But ten days later, change of speech: the same Christophe Castaner announced that tracking was a track under study.
Because at the same time, Emmanuel Macron instructed an analysis committee to study “the advisability of a digital strategy for identifying people who have been in contact with infected people”. According to The Sunday Journal, it was through a press release from the Elysée that Cédric O, Secretary of State in charge of Digital, understood that it was necessary to speed up the pace. Behind the scenes, several companies are jostling at the gate to offer their solution. The discreet advisor Aymeril Hoang, member of the Scientific Council on the Covid-19, is responsible for listening to them, analyzing the proposals and transmitting the summary to the executive.
On April 7, the government entrusted the project to the National Research Institute for Digital Science and Technology (Inria), which houses researchers specializing in artificial intelligence or encryption. The next day, Olivier Véran and Cédric O specify in The world their intention: to create a tool whose use will remain voluntary, using Bluetooth and not geolocation, to indicate to the people you have met for a long time that they have possibly encountered a positive case. The application, which would complement the manual “contact tracing” already carried out, must then be a brick, again “uncertain”, the deconfinement strategy. “The computer code will be public, ‘auditable’ by anyone, and compatible with other countries”, specifies Cédric O.
To do this, Inria surrounds itself with private actors who will work on a voluntary basis. Start-ups, like Lunabee, responsible for developing the application itself, but also manufacturers such as Orange, Dassault or Capgemini. Along the way, a team is removed from StopCovid, causing a stir: that of the Interdepartmental Digital Directorate and agents of Beta.gouv. A team of developers at the disposal of Cédric O, yet capable of developing such an application and who had already got to work. But strong disagreements on the technical choices and the organization led the agents of Beta.gouv to be landed, tells the site Acteurspublics.fr.
– Elliot Alderson (@ fs0c131y) April 27, 2020
But the teams at Inria and its partners are up to the task. The short deadlines imposed by the coming deconfinement are pressing their work, including that of Claude Castellucia, data security specialist at Inria. “As a researcher, we are used to working for a long time”, he testified to franceinfo.
There, we worked for a few weeks, seven days a week. If we had had two or three years, different things would have been done, but we are very satisfied with the work accomplished.at franceinfo
Despite the urgency, Inria manages to develop and begins to publish, on April 18, the technical protocol of the application, responding to the name of “Robert”. It makes it possible to calculate proximity with other mobile phones, in a secure manner and respectful of data protection, storing information on a central server, explains Inria. A different choice from other European solutions, Germany or Switzerland having opted for the DP-3T solution, which stores data in a decentralized manner. The use of Bluetooth, which has been the subject of regular faults for years, and which does not allow an exact proximity distance to be calculated, is however criticized.
Over the weeks, the application is delayed. The executive confirms that StopCovid will not be ready for May 11, the date of the deconfinement. And even less for April 28, when a debate was planned in the Assembly about the application. The day before, Edouard Philippe warns Cédric O of a postponement, when the latter had already started to write his speech, reports The Sunday Journal.
At the same time, StopCovid makes people cringe, among politicians as well as among “geeks”. Even within the presidential majority, the hesitations of March sometimes turned into firm opposition. Like Sacha Houlié, the MP for Vienne. “To make the French believe that there could be virtuous tracking is, from my point of view, a lie“, thunders the young elected LREM.
In Parliament, hearings are held to question experts and entrepreneurs on the subject. This is the case of cybersecurity specialist Baptiste Robert, fiercely opposed to StopCovid, whose utility is very reduced according to him.
It is not very thorough tracking, the application will not take your GPS position or your contacts. But it is a step in the wrong direction. And the real subject is the question of the usefulness of such a device.at franceinfo
A position joined by the association of Quadrature du Net, for which StopCovid is of a hazardous efficiency, sacrificing individual freedoms and accustoming the population to digital surveillance tools.
But Cédric O’s office and the StopCovid teams are staying the course. On April 24, they received the favorable opinion from the National Digital Council (Cnum). The application must be transparent and its use limited in time, he warns. Two days later, the same thing happened on the side of the National Commission for Data Protection (Cnil), which issues various emergency recommendations. On May 26, it issued a new notice explaining that its requests were generally respected, but insisted on the publication of the entire source code for the sake of transparency.
After the favorable opinions of the Cnum and the Cnil, Cédric O’s office, under tension, and the StopCovid team are trying to give maximum guarantees on security. Life-size tests are carried out in the metro, or with soldiers from the army. StopCovid is tested on a hundred mobiles, the most used by the French. Attempts “show that roughly 75% to 85% of the people who are nearby are captured “, Says Cédric O.
The end of May is that of the last gun passes around StopCovid, fueled by the relative failure of such applications in other countries. In Australia, six million people have installed COVIDSafe, but it has only identified one Covid-19 positive case, reports the Guardian.
The day before the vote at the Meeting, Inria begins to publish the application source code. But not in its entirety, regret specialists. Under the impetus of the National Agency for Information Systems Security, the government is calling on the “ethical hackers” of Yes We Hack. As of May 27, these hackers are responsible for detecting flaws to help correct them before the publication of the app. “I have never seen so many guarantees given to citizens”, comments MP Laure de la Raudière (Agir), specialist in surveillance and digital issues.
Then comes the time for an astonishing debate in the Assembly and the Senate. At the perch, Jean-Luc Mélenchon vociferates against “Big Data”, criticizes the application and asks colleagues to remove their number from their phone, echoing false information about StopCovid. Republicans’ deputies do not hesitate to denounce a project “Orwellian”, in the words of Damien Abad. Right-wing elected officials had nevertheless voted for the intelligence law in 2015, without mobilizing such an argument in the face of a much more significant text in terms of surveillance.
The deputy Paula Forteza, of the new parliamentary group Ecology democracy solidarity, is alarmed as for her addiction to the monitoring tools and calls for a principle of digital precaution vis-a-vis the risks for the security of the data. Mounir Mahjoubi and Cédric Villani unsurprisingly defend the application brought by Cédric O. The Assembly approved on May 27 the government statement on StopCovid, with 338 votes in favor and 215 against. She is followed by the Senate in the evening.
It is therefore this June 2 that was fixed the publication of the application, the time to repair the flaws detected by the hackers of Yes We Hack. It will thus support the second phase of deconfinement and the more active social life it will generate. It’s impossible to know how many French people will install the application. Many opponents of StopCovid recall that around 25% of the population does not have a smartphone, especially the elderly, the most vulnerable to the epidemic.
But Cédric O repeated it over and over again, any contamination avoided thanks to the application will already be a success. As for the risks on data security, the Secretary of State for Digital concedes: “I cannot guarantee there is zero risk, but we have taken the utmost care.” It remains to be hoped that no hacker a little too creative or ill-intentioned actor comes to cool the ambitions of this French initiative.