France postpones parliament debate on contact-tracing app

Earlier today at the National Assembly, French Prime Minister Édouard Philippe gave a lengthy speech about post-lockdown measures in France ahead of a debate with deputies. The government originally planned to discuss France’s contact-tracing app StopCovid. It broadened the subject of the debate to post-lockdown policies a couple of days ago.

But Philippe said that it was too early to discuss the rollout of StopCovid. According to him, as the app is not ready yet, it would be difficult to vet the advantages and risks of a contact-tracing app.

The section of Philippe’s speech on StopCovid wasn’t long, so here’s everything he had to say on contact tracing:

Could we or should we leverage the extraordinary resources or digital tools in order to be more efficient? A European consortium has laid groundwork that should lead to the creation of the StopCovid app — the app would only be useful in addition to what I already described. It would come in addition to the health investigations that I described. Those investigations, whether they are physical or by phone, are essential but present a flaw.

They are sometimes hampered by the inability to establish transmission chains in urban areas, in the most dense areas and in particular in public transit. It’s hard to notify the person who was in the same metro train at 7:46 on line 12. You don’t know them, they don’t know you and [public transport company] RATP doesn’t know either of them.

That’s the goal of the StopCovid project. It would make it possible to notify people who crossed the path of a positive individual in order to indicate what to do next without, of course, collecting any data on the identity of the person you encountered.

A large number of political leaders, from all parties, including the president of the National Assembly himself, told me about their concern on that type of tools, on the questions that it would inevitably raise when it comes to civil liberties and individual liberties. Those questions, and I already said it before, are justified. They should be asked, they should be debated. I even think that it should lead to a vote.

For now, given the uncertainty around this application, it would be quite difficult for me to tell you if it works and how it works exactly. I have no doubt that engineers will work tirelessly and will deliver on this project.

But, as it is not the case right now, I think that holding a debate would be premature. But I want to reaffirm my pledge. When the application currently in development is working, and before its release, we will hold a debate dedicated to StopCovid followed by a vote.

French Prime Minister Edouard Philippe delivers a speech at the French National Assembly as he presents the government’s plan to exit from the lockdown situation (Photo by David Nivière / Pool / AFP / Getty Images)

While it seems like the French government is going back to the drawing board, the Digital Ministry told TechCrunch that it is still going ahead with its controversial ROBERT protocol.

“I can confirm that French authorities only work on a solution that avoids the circulation of a list (even encrypted) of Covid+ people as in the Robert protocol. The discussions with Germany haven’t stopped to find the best architecture,” a spokesperson for the Digital Ministry told TechCrunch.

Last week, research institutes Inria and Fraunhofer released the specifications of the protocol that the French and German governments planned to use at the time. Named ROBERT, it is a centralized protocol that uses pseudonymization to match contacts on a central server. A national authority manages the central servers.

But you have to trust your government that they’re not doing anything nefarious on their servers without telling you — a centralized design could lead to abuse and even state surveillance.

On Sunday, Germany reversed its stance and abandoned ROBERT altogether. German authorities are now working on a decentralized protocol that leverages smartphones to compute social interactions. Ephemeral IDs are stored on your device and you can accept to share ephemeral IDs with a relay server to send them to the community of app users.

Yesterday, hundreds of French cryptography and security researchers signed a letter to raise awareness about the potential risks of a contact-tracing app. “It is essential to thoroughly analyze the health benefits of a digital solution with specialists — there should be important evidence in order to justify the risks incurred,” the letter said.

The French government is now also betting heavily on health investigators in order to contact everybody who has tested positive in order to list their social interactions. After that, investigators can contact those other individuals and tell them to get tested as soon as possible.

TechCrunch’s Natasha Lomas contributed to this report