France's centralised app criticised, Germany's app launches
https://www.france24.com/en/2020061...g-app-hard-to-link-to-others-eu-official-says
Germany's app being developed on github with real live development work pushed to publication, and the server also open-source/free-software, not throw-it-over-the-wall open-source-in-name-only like the NHSuX one:
https://github.com/corona-warn-app
https://www.france24.com/fr/20200617-stopcovid-chronique-d-un-échec-annoncé headlines "StopCovid, Timeline of a Predictable Fail":
BEGIN TRANSLATION FOR PURPOSE OF DISCUSSION:
Two weeks after its launch, the French contact-tracing[sic] app StopCovid multiplies its snags. From unpromising beginnings which seem to confirm the beliefs of experts on the effectiveness of this "cockerel solution" for fighting against the spread of Covid-19.
A low number of downloads and criticism from the European Commission against an app accused, amongst other things, of collecting more personal data than necessary. And now throw in more: two weeks after its launch, StopCovid, the official French contact-tracing app to contain the spread of the Covid-19 pandemic, is far from becoming ubiquitous.
According to the official government figures, there were only 1.7 million installations. After a more-than-fair start - 600k downloads on the first day - the speed of installations slowed: in the last five days, only 200k French people have broken for StopCovid, states Francetvinfo.
It's very far from the preannouncements of researchers who estimate that it would need a much larger adoption (from about 20% of the population) for StopCovid to start having an effect.
The Problem of a "Cockerel Solution"
The European Commission also raises scepticism. It criticised, Wednesday, the lack of interoperability of the French app with those developed by 16 other EU countries. "It's the problem of having a cockerel solution, while in parallel helping with reopening European borders. If the apps don't talk to each other, a French person who travels abroad cannot know if they were in contact with an infected person," underlines Nadège Martin, specialist in Intellectual Property Law and associate advocate at Norton Rose Fulbright, contacted by France 24.
The defenders of personal data protection are also not overflowing with enthusiasm. Gaëtan Leurent, a cryptography specialist who works for INRIA (the institute which, amongst other things, is in charge of the StopCovid project), has discovered that the app collects more information than was announced at the start, reported Mediapart on Monday 15 June. In theory, the app stores only the data about two people who have installed StopCovid on their telephone who are in contact less than 1 metre apart for at least 15 minutes. In reality, it is gathering all information of all people who have the app, without regard of the time spent close together, notes Mediapart. The government has recognised that this tracing is much more massive than forseen, and taken refuge behind a debatable technical explanation.
I just realized that #StopCovid seems to send all contacts to the server, even passing on the other side of the street. This would contradict the official decree (contacts of 15min at 1m), and violate data minimization principle required by @CNIL and #GDPR
https://gitlab.inria.fr/stopcovid19/stopcovid-android/-/issues/43 - Gaëtan Leurent (@cryptosaurus6) June 12, 2020
These multiple snags give the impression of a "timeline of an announced failure", affirms Constantin Pavléas, director of Pavléas law practice and specialist in new technology law, contacted by France 24. For him, it could be difficult to be otherwise because of initial choices. "France has taken for its model the app developed by Singapore, although this hasn't been shown effective for preventing the spread," he notes. The authorities of the Asian city-state have effectively recognised, at the end of April, that their application hasn't slowed Covid-19, even though 20% of Singaporians had downloaded it.
Political Errors
Constantin Pavléas also underlines that the European Commission is justified in criticising France. "We've failed massively. It's necessary to do everything to build a digital solution on the European level in order to counteract a virus that doesn't know any borders," assents Constantin Pavléas. This would be the same even for the "original pitch of the French plan," estimates Frans Imbert-Vier, CEO of Ubcom, a Swiss law practice specialising in digital security, contacted by France 24.
This choice of being a lone cowboy on the European scene illustrates, for him, the root of the problem of StopCovid which is political. "The government has preferred to stay faithful to digital sovereignty in developing a national solution, rather than being pragmatic in adopting the same type of app as its European neighbours, with the goal of facing the health threat with allies," continues Frans Imber-Viert.
The other countries, at the cue of Germany, have, in effect, preferred to develop their solution around the standards for digital tracing set by Google and Apple, so that their apps can be easily used on the vast majority of smartphones. France, as usual, hasn't wanted to let these American wolves into the henhouse of French digital health.
If the French don't precipitate towards StopCovid, it will be more because of political errors. "The government has proved that an absence of transparency about the use of data by the app loses the confidence of the population," assures Frans Imbert-Vier. Such as the claim of the length of data retention. "The government continues not to want to explain why the collected data is kept for three months, even though the doctor's division of the World Health Organisation assures that this data isn't useful for health after 21 days," emphasises this expert.
What to do with StopCovid?
The Mediapart revelations go in the same way. "Why not have said spontaneously that StopCovid collected more data than initially forseen? This lack of transparency could seem worrying for an app which touches our fundamental liberties, in that it allows knowledge of where you are, when and with whom," underlines Frans Imbert-Vier.
The hare set running by Mediapart puts everything in doubt about even the effectiveness of StopCovid. "For a contact tracing app to be useful, it's necessary for the collected data to all be quality. But if StopCovid sends data on each person seen [no matter what duration of contact], the database loses pertinence for fighting Covid-19," explains advocate Nadège Martin.
The first two weeks of existence have confirmed the beliefs about the effectiveness of StopCovid in its current state, according to the three experts interviewed. But they are not in agreement on what to do with the baby. For Frans Imbert-Vier, "it's necessary to start over" because the faults inherent to the French solution, notably the incompatibility with other European apps, render it irreparable. Constantin Pavléas also estimates that it's necessary to turn the page on this app. But he goes further, and calls for the creation of a true "Europe of health, that includes digital strategy, and would have a decision-making power to impose the type of app at EU level."
Less pessimistic, Nadège Martin judges that it's still a bit early to bury StopCovid completely. "There was a problem of timing. The application was launched at a moment where the perception of danger linked to coronavirus had reduced, which contributed to a weak number of downloads," she notes. This advocat estimates that if the belief of a second wave takes form, interest in the app could restart. It's only at that moment that we can truly make an assessment of the effectiveness of StopCovid. While we wait, she judges that it would be better to improve what exists already, rather than reinvent the wheel. Above all, "what would replace this app? Nothing says only an alternative would be better accepted by the French," she estimates.
But all assess that there is urgency. If StopCovid has arrived badly hamstrung and too late to help during the first wave, this failures could allow it to be better prepared for an eventual second wave of the epidemic which, with the resurgence of infections in China, has gained credibility.
END TRANSLATION
I think everything about StopCovid above applies to NHSX but more so, such as IIRC the NHSX data retention is 20 years not 3 months!
