How Google and Apple outdid governments in the race to create coronavirus apps – POLITICO

In the digital fight against COVID-19, Big Tech resisted governments and won.

As European policy makers pushed to develop smartphone apps to track the spread of the coronavirus, Apple and Google have relaxed their muscles by setting the conditions for building the tools, which will now be deployed across the block and beyond at the start of June.

In conversations with more than 30 policymakers, data protection experts, freelance computer scientists and technology engineers from across the EU and the United States, HEAVEN32 explained how Google and Apple got away with it. , often with politicians who have used their opposition in the United States United States Technology players will gain political capital from local voters. The companies have also teamed up with longtime privacy activists, often those who objected to the collection of personal data from Silicon Valley residents, to dispel concerns about possible government surveillance.

In often difficult discussions, officials believed that protecting privacy from public health was imperative in order to fight a virus that, so far, has left nearly 300,000 people died all over the world. Tech executives and privacy groups have set aside long-standing disputes over how to build COVID-19 applications, often condensing months of work in just weeks. Politicians had to decide to go it alone, often with technological offerings that left a lot to be desired, or to team up with some of the biggest names in Silicon Valley whose approach to accepting or leaving was wrong .

A group led by Germany has promoted a set of tools, developed in collaboration with 130 technology experts in eight countries, to create applications capable of detecting possible infections .

"I am not taking a stand against Apple and Google," French digital minister Cedric O told HEAVEN32 after publicly criticizing the companies for refusing to work with the independent application of the Paris coronavirus. "I say I don't want to be limited by a company's public health policy decisions."

As governments strive to push coronavirus to its limit, the unlikely alliance between some of the world's biggest tech companies and global privacy groups is starting to pay off.

"We hope to harness the power of technology to help countries around the world stop the spread of COVID-19," the companies said. told me when they announced their initiative last month. The two declined to comment on their dealings with governments on the creation of smartphone apps, although senior engineers involved in the project stressed that it was up to governments, not companies, to determine which approach use.

By June, national capitals from Berlin and Rome to Paris and London will launch smartphone apps that use mobile technology to track people's interactions, informing local people if they've been in touch with them. other people infected with coronavirus. Most of these programs, which can last until 2021, are based on the approach advocated by Google and Apple, often against initial proposals put forward by policy makers around the world.

The ability of these tech companies to get by, often supported by local privacy and security advocates, has raised questions about the role of Big Tech in determining how governments respond to global health crisis. Public. With future apps that depend on both Google and Apple procedures, and those that don't, confusion will hamper Europe's strategy to coordinate its response across the block of 27 countries and elsewhere, because different digital tools they cannot interact with each other.

"The interoperability of these applications was a huge blind spot," said Michel Beaudouin-Lafon, professor of computer science at Paris-Saclay University, who co-author of a recent report on how these tools should work. "From a technical point of view, it will be difficult to get these applications to communicate with each other."

Germany changes sides

Nowhere else are these tensions more evident than in Germany, where some of the oldest privacy protections in the world are found.

Earlier last month, a group led by Germany launched a toolkit, developed in collaboration with 130 tech experts in eight countries, to create apps that could detect potential infections. Above all, the plan made it possible to put everyone's data on a central server and to give epidemiologists and decision-makers access to certain information, in order to analyze how the virus spread through the country.

Within days, the initiative hit a brick wall. With little or no communication with local experts and EU policy makers, Google and Apple announced on April 10 that they have partnered with software that would allow apps supported by the government to detect potential infections even when running in the background of people's smartphones. The approach was based on the remaining data, for the most part, on people's devices. The two companies have refused to open their technology to governments pushing for centralized data storage, a strategy they deemed vulnerable to state investigations.

German privacy and security experts quickly got into action. In the often animated WhatsApp conversations, some wondered if Apple and Google should be supported. Others have questioned whether corporate efforts will consolidate their already dominant position in the smartphone market. But in late April, after similar warnings from international researchers in more than 25 countries, six influential civil liberties organizations sent an open letter to the German government, criticizing the storage of people's data in one place and warning that it could lead to massive government surveillance.

A group led by Germany has promoted a set of tools, developed in collaboration with 130 technology experts in eight countries, to create applications capable of detecting possible infections | Sascha Steinbach / EPA-EFE

Two days later, the government of Chancellor Angela Merkel intervened

get rid of the initial proposals led by Germany in favor of those promoted by Google and Apple.

"The discussion between technology experts has destroyed the credibility and reliability of the technology," a senior German official told HEAVEN32. "So we decided to take a different approach." The Berlin decision was quickly followed by similar movements in Ireland and Italy. and other countries as managers have moved to a decentralized approach, realizing that it would be best to partner with tech giants and Germans if these coronavirus apps took off at across the EU. The European Commission has stressed that it is up to national governments to determine which application to use, but urged officials to find ways for the tools to communicate across borders.

The choice in Germany was made out of pragmatism rather than conviction, as well as a growing realization that Berlin had to work closely with Apple and Google to develop the app if engineers wanted to avoid serious gaps in its possible digital tool, depending on conversations. with nearly half a dozen German government and industry representatives who spoke to HEAVEN32 on condition of anonymity as the deliberations are private.

"We need to have a discussion on how Silicon Valley is increasingly taking over the work of a nation state," said a government official. "But we don't need to have it in the middle of a pandemic."

Germany now plans to unveil its app, created by industry giants Deutsche Telekom and SAP, in mid-June, several weeks after the originally scheduled date, in part because the tech giants will not release any key software components until mid-May, said the same officials.

France is on its heels

While Germany finally sided with Apple and Google, France went the other way and ended in an open confrontation with the tech giants.

Work in Paris started in mid-March when Singapore introduced its own monitoring tool. While the country's interior minister said at the time that coronavirus apps "were not part of French culture", O, the country's digital minister, was already making plans with close advisers.

Experts from the French National Institute for Research in Computer Science and Automation contacted Apple in March, without the support of the French government, to ask it technical questions about how a tracking tool works, according to a person involved in these discussions. .

In early April, authorities confirmed that they were working on an app that would work by centralizing user data, an approach that has also been adopted by Germany, until Google and Apple reveal their plans in mid-April. French experts close to these discussions told HEAVEN32 that many people involved in the project saw the centralized approach as more privacy-friendly than storing data only on people's phones.

Not everyone agreed. Amid intense debate over possible government surveillance, several government coders who favored Apple and Google plans have been excluded from the StopCovid app project, according to three sources with direct knowledge of the project.

France has advanced with its application which, according to the government itself, would not work fully on Apple and Google devices because it would shut down when smartphones are in standby mode.

"We chose the centralized system because of data protection issues and linked to the interconnection with (our) epidemiological system," O told HEAVEN32. The country's privacy regulator and the National Digital Council told me that France's plans complied with EU confidentiality standards, provided that adequate surveillance is applied.

Several people involved in the project said they were surprised by the announcement by Google and Apple of the joint project to apply the coronavirus. When they found out, many through public statements from companies, officials attempted to convince them to lift technical restrictions on the French approach that would prevent the StopCovid app from working properly on almost all smartphones .

Aymeril Hoang, who sits on the scientific council that advises the government on digital tracking, told HEAVEN32 that he had spoken on several occasions with Sébastian Gros, director of government relations at Apple, after the April 10 announcement to convince the company that removing the restrictions. His efforts failed.

Cédric O criticized Apple and Google for refusing to work with the independent application of the Paris coronavirus The | Photo of the swimming pool by Ludovic Marin / EPA-EFE

Despite this obstacle, France continued its application which, according to the government's own admission, would not work fully on Apple and Google devices because it would stop when smartphones are in standby mode. It would be a big obstacle to the main purpose of the app to track all possible encounters with infected people.

On April 20, O again urged companies to work with the authorities to find an alternative solution. But their arguments were rejected when the tech giants reiterated that they would only work on projects based on decentralized data.

The digital minister, who was previously advisor to President Emmanuel Macron, was tested, refusing to give in to the decentralized approach. In particular, he told HEAVEN32 that it should be up to governments, not businesses, to determine what is best to protect citizens from the global pandemic.

As the country begins to break out of its national blockade, France now plans to launch its application by June 2. But the confrontation between Paris and Silicon Valley companies continues to divide privacy advocates and government regulators.

"We have a kind of statement of principles that Apple is presenting which says that this or that solution is more or less protective for users without there being a contradictory discussion on the subject," he told HEAVEN32 Sébastien Soriano, head of the French telecommunications regulator. . . "Perhaps Apple is right and could demonstrate that accepting certain protocols poses risks to its users. But there is no process for independent judges or authorities to decide. "

The UK caught in the middle

After an initial stagnant response to the global public health crisis, London was impatient to demonstrate that it was above the fight against COVID-19, and quickly turned, in early March, to a possible smartphone tracking app which had successful result in some parts of Asia.

Within the NHSX, the new technological innovation unit of British health services, the debate quickly focused on the centralization of personal data, a strategy which was then followed by others countries in Europe, in part because it would allow modeling at the national level. how the virus was evolving, which could not be done by a decentralized approach.

Before Google and Apple's decision to take a different route, informal discussions were held between corporate government officials and some in Westminster to inform policymakers of future plans. But no formal notice has been given to the British government, according to three people informed of the discussions.

The ad divides opinion. Some NHSX members discussed the change in strategy in the UK when questions started to emerge about how the app could access the smartphone technology needed to keep the tracking tool operational when the devices were in sleep mode. Foreigners, including Michael Veale, UK professor of digital rights who helped to build a digital tracking tool focused on confidentiality This was copied by the separate efforts of tech companies, it also warned London that their efforts could be wasted if they didn't shift gears.

"On the day of Apple's launch, I sent them an email explaining that their system would not work properly in the background," he said.

London is still planning to launch its app across the country in late May and more than 65,000 people downloaded it during the trial phase.

Talks between tech companies and UK officials have remained generally friendly, often focused on how to quickly get the UK app approved for the two companies' app stores. But frustrations have also been overwhelmed by Apple and Google's refusal to work more directly with the UK's centralized approach to their tracking tool, according to two external consultants informed of the discussions.

On a technical level, the NHSX application has also faced problems, repeatedly failing the basic security and privacy checks required for approval in the service acquisition process. health, according to another outside consultant knowing the issue. The Health Service Journal reported for the first time These failures.

The privacy groups involved in the initial testing of the British app said its communication with NHSX was patchy at best. Emails would go days without receiving a respon se. Basic requirements, such as submitting a data protection impact assessment, a mandatory part of the development of any application, were made after the digital tool started testing on the Isle of Wight earlier this month, according to a review of government documents