Germany has changed its stance on the centralization of data generated from mobile apps designed to help combat COVID-19.
Until recently, German officials have backed the idea of a mobile app that would generate geolocation information, including where a user goes and who they meet, of which this data would be stored centrally.
The problem with this concept, and one criticized by civil rights and privacy groups, is that the vast collection of citizen data could pave the way for future surveillance on a scale never before seen in the West, as this information would be accessible by groups potentially including government departments — or, perhaps, law enforcement.
Despite privacy concerns, the development of contact tracing apps that alert users, when they have been in contact with someone who has a confirmed case of COVID-19, is in full swing.
Until a vaccine or potent medication is available, many countries are trying to slow down the spread of the respiratory illness in order to prevent overburdening medical services — but this is hampered as the novel coronavirus can be transmitted by those who are not symptomatic.
Mobile technology may be able to help contain the virus by alerting users and making them aware they need to self-isolate. However, despite the rush to develop a suitable solution, the overall case for protecting our privacy cannot be ignored.
See also: Coronavirus contact-tracing app: Here’s how we’ll protect your privacy, says NHS
A centralized approach, the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) initiative, was originally backed by Germany. Last week, France asked Apple, in particular, to relax existing iPhone Bluetooth security controls which prevent data from leaving devices.
The existing measures stop PEPP-PT apps from working, but Apple has not been willing to degrade its mobile security standards.
Germany’s plans to integrate a PEPP-PT app with a centralized system to host citizen data have also been scuppered. As a result, as reported by Reuters, Germany is abandoning plans for a homegrown app in favor of a decentralized approach, as supported by both Apple and Google.
A government official told the publication that there was “no alternative but to change course” as Apple would not back down.
On Sunday, Germany’s Chancellery Minister Helge Braun and Health Minister Jens Spahn said that a decentralized approach will now be explored.
CNET: Apple and Google’s coronavirus tracking tool: How privacy fits in
Many European countries are examining short-range technologies, such as Bluetooth, to fit this model. Bluetooth ‘handshakes’ between devices can provide the architecture required for sending COVID-19 alerts, without handing over user data to central authorities. In addition, the technology does not register or store user locations.
“This app should be voluntary, meet data protection standards and guarantee a high level of IT security,” Braun and Spahn said. “The main epidemiological goal is to recognise and break chains of infection as soon as possible.”
Both Apple and Google have said they will provide technological support for apps that adopt a decentralized approach to contact tracing.
TechRepublic: Kaspersky offers free cybersecurity training to assist teams working remotely
France and the United Kingdom, however, are still pursuing a centralized approach to tracking. The UK government is developing an app which will use Bluetooth for alerts but will also give the UK National Health Service (NHS) access to anonymized user data relating to symptoms. However, a lack of clarity and transparency surrounding the app’s security and data collection has already earned criticism and worries concerning uptake.
Previous and related coverage
Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0
