Paris (AFP)

The StopCovid deconfinement contact tracing application, which the National Assembly will debate on Tuesday, is not technically ready and doubts remain about the government's ability to complete the project by May 11.

A very attractive objective in theory ...

The objective of a contact tracing "app" is on paper very attractive: allowing each user to warn other users he has encountered in the past two weeks, when he discovers his contamination with coronavirus.

All these people can then take the necessary precautionary measures, such as self-containment, and request a test.

The exclusively voluntary application would use Bluetooth, a communication technology between nearby electronic devices, to operate.

... but a huge risk to privacy

But the risks to privacy are enormous. When you discover contaminated, you must transfer to the system the list of people you have encountered during the last two weeks, thus informing him of his state of contamination.

Malicious actors can take advantage of this to try to find out who has been infected and build files. Or, by crossing all the lists of people approached, piece together a lot of information about our lives.

Is there not a risk of laying the foundations for a surveillance company?

Pseudonyms that don't solve everything

In an attempt to ensure respect for privacy, the system will work with coded identifiers or pseudonyms: users will not be able to identify by name who they have encountered.

But the question of pseudonyms does not resolve everything, since at some point the pseudonym of a person who has crossed the path of an infected person must be linked to the person who must be notified.

Different technical choices depending on the country

To best remedy this problem, two main architectural choices are in conflict.

The French model of StopCovid corresponds to a centralized architecture.

Regularly, our smartphones would check on a central server that our pseudonym is not in the list of pseudonyms crossed by an infected person.

If our pseudonym is on a list, we will receive an alert message.

The other great model of architecture is said to be "decentralized".

In this architecture, our smartphones regularly import the list of all the pseudonyms having crossed contaminated people, and check themselves if our pseudonym is on these lists or not.

The increasingly isolated French choice

The question of architecture gives rise to passionate debates between experts. And the decentralized option seems to collect more and more votes outside France. On Sunday, Germany announced that it would join this architecture, which is also favored by Apple and Google.

Apple and Google in central position

In these debates, Apple and Google occupy a central position, insofar as they hold control of the two major operating systems of smartphones in force, respectively iOS and Android. Impossible to communicate smartphones belonging to these two galaxies without their agreement.

Apple and Google will quickly offer the basis of a contact tracking application that governments can customize as they wish.

But in the name of its sovereignty, France claims that the American giants can make its own technical and architectural choices.

The problem is particularly sensitive with Apple, which jealously protects, for security reasons, the functioning of Bluetooth.

If France could not convince Apple, StopCovid would only work when it is open and in the foreground - thus preventing its user from using his smartphone to read his emails or browse the internet.

In France, who is working on StopCovid?

Inria, the national computer research institute charged by the government with technically piloting the project, clarified on Sunday the relations between its project and that prepared for several weeks by Orange and private partners.

All of these players work together for StopCovid and have created a project-team including the companies Capgemini, Dassault Systèmes, Thales, Sopra Steria, Atos and Withings (connected objects).

Among public players, the list mentions Anssi (national agency for information systems security), Inserm (public medical research) and Public Health France.

The Cnil, the guardian of the privacy of the French, gave a green light in principle to StopCovid, demanding to review the government copy when the application has actually been defined and built.

© 2020 AFP