By Douglas Busvine
BERLIN (Reuters) - A rift has opened up over the design of smartphone apps to trace people in Europe at risk of coronavirus infection, potentially hindering efforts to curb the pandemic and ease crippling travel restrictions.
Scientists and researchers from more than 25 countries published an open letter on Monday urging governments not to abuse such technology to spy on their people and warning of risks in an approach championed by Germany.
"We are concerned that some 'solutions' to the crisis may, via mission creep, result in systems which would allow unprecedented surveillance of society at large," said the letter that gathered more than 300 signatures.
Tech experts are rushing to develop digital methods to fight COVID-19, a flu-like disease caused by the novel coronavirus that has infected 2.4 million people worldwide and been linked to 165,000 deaths.
Automating the assessment of who is at risk and telling them to see a doctor, get tested or self-isolate, is seen by advocates as a way to speed up a task that typically entails phone calls and house calls.
Contact tracing apps are already in use in Asia, but copying their approach by using location data to would violate Europe's privacy laws. Instead, Bluetooth chatter between devices is seen as a better way to measure person-to-person contacts.
The apps should be voluntary, and would need to be downloaded by at least 60% of the population to achieve the so-called "digital herd immunity" needed to suppress COVID-19, say researchers from Oxford University's Big Data Institute.
Yet controversy over the best way forward could delay the rollout of apps to help governments, once they have brought the pandemic under control, to contain any new outbreaks.
MISSION CREEP
The rift has opened up over a German-led initiative, called Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT https://www.pepp-pt.org), which has been criticised for being too centralised and thus prone to governmental mission creep.
Its critics back a decentralised contact tracing protocol called DP-3T https://github.com/DP-3T/documents/blob/master/DP3T%20White%20Paper.pdf, pioneered by Swiss researchers, that is aligned with a technology alliance between Apple (NASDAQ:AAPL) and Alphabet (NASDAQ:GOOGL)'s Google.
The details are highly technical, but revolve around whether sensitive data would be kept safely on devices or stored on a central server in a way that might allow a bad actor to reconstruct a person's "social graph" - a record of where and when they meet other people.
"Solutions which allow reconstructing invasive information about the population should be rejected without further discussion," the scientists said in their letter.
Among the signatories was Michael Backes, head of Germany's CISPA Helmholtz Center for Information Security, which pulled out of PEPP-PT at the weekend. Swiss researchers have also publicly dissociated themselves from PEPP-PT, citing concerns over centralisation and privacy.
Critics have also questioned PEPP-PT's assertion that seven European countries - Austria, Germany, France, Italy, Malta, Spain and Switzerland - had come on board. Spain and Switzerland now back rival DP-3T, government and research sources said.
PEPP-PT said it was committed to guaranteeing the privacy of users and data protection at all times.
PEPP-PT also asserted its commitment to privacy in a 25-page document https://github.com/pepp-pt/pepp-pt-documentation/blob/master/10-data-protection/PEPP-PT-data-protection-information-security-architecture-Germany.pdf it released at the end of last week on GitHub, a software developers platform.
"If the system would leak information about personal behaviour, identities, or even reveal who has been infected with Sars-CoV-19, users would quite rightfully refuse to adopt the system," the document stated.
Germany plans to release a contact tracing app within weeks based on the PEPP-PT platform, government sources said last week. The head of France's INRIA digital research institute has also backed the initiative.
The PEPP-PT platform is designed to support national apps that could "talk" to each other across borders - a goal that could become harder to achieve if other European countries back a different standard.
"The debate is turning away the focus from what really matters: to build an app that traces the virus, not the human, and to do this as fast as possible," said Julian Teicke, CEO of Berlin insurance tech firm WeFox who is involved in a German-based coronavirus app tracing project called Healthy Together.