In France and elsewhere, governments are looking at the use of apps to track citizens through their smartphones as part of efforts to stem the spread of the coronavirus. But critics worry that once such tracking systems are in place, governments may be tempted to use them for something else.
In the mind of France’s Interior Minister, Christophe Castaner, there is no question: If an application can help fight the Covid-19 pandemic in France by alerting smartphone users that they have been close to a sick person, it should be used.
Castaner said it is essential that the government use all the information available to it to curb the epidemic. “Tracking is one of the solutions that have been adopted by a number of countries, so we have decided to work with them in looking at these options,” he said in an interview with France 2 television on April 5. “I am convinced that if [these apps] allow us to fight the virus and if they do not infringe on individual liberties, tracking is a tool that will be accepted by the French people.”
Mobile communications companies have the ability to track every mobile phone user, and a tracking application would enable citizens to be informed if they have been in the vicinity of a known Covid-19 patient while in public so that they, in turn, can try to get tested.
Several countries – including China, Taiwan and South Korea – are collecting GPS information from their citizens’ phones to locate infected people and enforce containment measures. The practice is effective, but it is problematic: Such data collection is prohibited in the European Union because of the General Data Protection Regulation (GDPR), which governs the processing of personal data.
Singapore as a model
Another type of technology is under consideration in France. “Alongside geolocation using 4G or GPS, Bluetooth – which you use to connect your phone to headsets, for example – is emerging as a solution for countries concerned about respecting individual freedoms because it’s a technology that doesn’t reveal your location,” Gérôme Billois, a cybersecurity specialist at the Wavestone consulting firm, told FRANCE 24.
That’s the technology behind the TraceTogether application being used by the government of Singapore. Phones equipped with the application connect to each other within a radius of a few metres, allowing the application to identify potential Covid-19 sufferers in the vicinity and then send an alert if necessary. Each phone also stores a list of cross-phone contacts for 21 days. That way, if a user becomes ill later and enters his state of health in the application, an alert can be sent to all registered users to encourage them to get tested.
Singapore is now being used as a model for European countries that seem convinced the tool could help them slow the pandemic. A new project called the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) has been set up to provide a guide to tracking people digitally while respecting their privacy.
“The avenues currently being studied by the PEPP-PT are interesting, but there is not yet a model detailed enough to make a judgement on the guarantee of privacy,” said Anne-Sophie Simpere of Amnesty International France, which is closely monitoring the development of technologies for tracking citizens.
“The conditions for developing such an application are clear: The law must grant it a very limited objective, strictly linking it to the fight against the epidemic. It must also be demonstrated that the measures taken are necessary, proportionate and, above all, that they have a time limit. And finally, there must be adequate control mechanisms with options for appeal.”
‘Any data collection can be problematic’
For Billois, even an app that uses only Bluetooth to collect data can pose a threat to privacy. Such an app “could make it possible, in a totalitarian regime, to track a political opponent and find out who he meets, so a number of safeguards are needed”, he said.
“Any data collection can be problematic,” Simpere echoed. “It’s an area where, à priori, tiny flaws can lead to human rights violations. Once these systems are in place, governments may be tempted to use them for something else. So we need very clear rules from the outset, especially on consent.”
And that issue has yet to be resolved. Prime Minister Édouard Philippe mentioned “voluntary engagement” during an appearance before the fact-finding mission on the management of the coronavirus epidemic at the National Assembly on April 1. Castaner, however, has declined to rule out compulsory digital tracking. “I can’t tell you,” he told FranceInfo on April 6, when asked if participation in such a programme would be voluntary.
The answer to that question is key, since the effectiveness of any such tracking application is dependent on the number of users; the more people using the app, the more useful it becomes. But even in Singapore, where the penetration rate of smartphones is higher than in France, only “about 10 percent of the population has installed the app”, according to Charles-Pierre Astolfi, secretary general of the French Digital Council, in comments to Mediapart.
That figure seems too low to be effective in combating Covid-19. And such low rates of voluntary tracking could tempt governments – despite the political risks of such a move – into making the collection of location data mandatory.