France shames Apple for not sacrificing user privacy for COVID-19 app

AppleInsider

The French government has accused Apple of lowering the effectiveness of its upcoming COVID-19 contact-tracking app, with digital technology minister Cedric O claiming Apple is not helping enough by preventing background app access to Bluetooth.

French Digital Minister Cedric O

France is preparing to test its COVID-19 app "StopCovid" on May 11, coinciding with the planned relaxing of lockdown rules affecting the country, with a final public deployment set for June 2. On Tuesday, the government made a public attack on Apple, in a bid to change its policies ahead of the app's launch.

"Apple could have helped us make the application work even better on the iPhone," said France minister for digital technology Cedric O to BFM Business TV, as reported by Reuters. "They have not wished to do so."

As is the case with the United Kingdom's app and some others, France's version is being developed independently of an announced Apple and Google collaborative effort. The app requires the use of Bluetooth to communicate with other devices, but Apple prevents apps running in the background from being able to transfer Bluetooth data, making third-party efforts less effective in the long term.

Rather than use the Apple-Google API, that would potentially work in the background due to future integration in the iOS and Android operating systems, France wants Apple to relax its policy regarding Bluetooth. The government has previously asked for Apple to do this before on April 20, followed by a similar urging on April 30 by carrier Orange, but so far Apple has declined to change its policy.

Cedric O attempted to shame Apple in the interview, suggesting "I regret this, given that we are in a period where everyone is mobilized to fight against the epidemic, and given that a large company that is doing so well economically is not helping out a government in this crisis." The minister claimed he couldn't explain the reasoning behind Apple's unwillingness to help over Bluetooth.

Apple typically prevents Bluetooth access for background apps due to the security and privacy implications involved, something that is also being taken into account in the under-development API. As the API is phone-based without using a central server, and Apple and Google has control over what data can be transmitted and received over Bluetooth over the API, this is considered to be a more private and secure method to accomplish the same contact-tracking goal, without weakening Bluetooth security too much.

The minister continued by downplaying Apple's importance in the COVID-19 fight, claiming "We consider that oversight of the healthcare system, fighting the coronavirus, is a matter for governments and not necessarily for big American companies."

JinTech

And what has France contributed, financially or in the means of medical supplies? I am sincerely curious, it's not a snide question.

EsquireCats

Considering how much money France has sought from technology companies with relation to user privacy, I would not be surprised if this request is never granted. 

It’s stupid to design an app that won’t work on the OS until the OS makes special and compromising allowances for it to run. (All while disregarding the better option being provided by the vendor.)

Edit: I should add: A global response should not involve custom apps from each country.
Europe is highly connected, France alone borders 8 countries, and has direct trains to each and the UK, plus flights to a great many more. The idea that individuals passing through each region will need to download a custom app is utterly absurd, and arrogant to the reality of how the virus spread from country to country.

red oak

Opening Bluetooth access to apps running in the background would be a security disaster.    It is comical that a "Digital Technology Minister" would be demanding it.  

It turns out this guy has no programming or software experience.   And, very limited business experience.    He's never developed an app in his life.   A true socialist bureaucrat appointed to help lead digital technology in France.   LOL 

https://en.wikipedia.org/wiki/Cédric_O

swineone

I guess France could point out its reasoning to bypass the Apple-Google API which would be the natural choice, given Apple and Google account for 100% of the smartphone market. It's probably huge government being huge govenment and never losing a chance to waste taxpayer money. I'm not familiar enough with the matter to tell if the restriction is just a matter of App Store approval, use of undocumented APIs, or if it is a fundamental security limitation of iOS. In the first two cases, Apple should approve this on a case-by-case basis. As for the third case, since Apple now has an API, I guess it's doable, so we go back to the first two cases. So yeah, Apple is being boneheaded as well. Special concessions are being made everywhere due to crisis, Apple might as well do their part. Maybe have a whitelist of apps that can use the feature.

urahara

swineone said:

I guess France could point out its reasoning to bypass the Apple-Google API which would be the natural choice, given Apple and Google account for 100% of the smartphone market. It's probably huge government being huge govenment and never losing a chance to waste taxpayer money. I'm not familiar enough with the matter to tell if the restriction is just a matter of App Store approval, use of undocumented APIs, or if it is a fundamental security limitation of iOS. In the first two cases, Apple should approve this on a case-by-case basis. As for the third case, since Apple now has an API, I guess it's doable, so we go back to the first two cases. So yeah, Apple is being boneheaded as well. Special concessions are being made everywhere due to crisis, Apple might as well do their part. Maybe have a whitelist of apps that can use the feature.

Your suggestion to whitelist the apps that can use the feature reminded me about “back door for good guys” debate. 

tommikele

Shame on France for attacking the freedoms of people and using Covid as an excuse. There is no reason to trust governments or companies to protect our freedom. They have all proven time and time again they cant be trusted.

hodar

Perhaps France should focus on THEIR problems, and stop blaming others for not fixing their problems?  Apple provides, perhaps the best and most secure ecosystem on the planet, they do this to benefit their GLOBAL customers - not for France.

France has a lot of issues, they have migrants that have completely changed the lives of every man, woman and child in the country.  They have violence,riots and protests, their country is experiencing turmoil internally, and the virus is just the latest problem.  Apple is not the cause, nor the cure.

So, do like every other country on the planet, fix the problem yourself - and perhaps try to step up to the problem, instead of running away and blaming someone else.  It's not becoming, in fact, it's kind of annoying.

prismatics

tommikele said:

Shame on France for attacking the freedoms of people and using Covid as an excuse. There is no reason to trust governments or companies to protect our freedom. They have all proven time and time again they cant be trusted.

What is freedom, and why is everyone supposed to be entitled to the humanist version of freedom? Not arguing for France though as I personally support privacy too. Just wondering about the thought and its implications.

avon b7

JinTech said:

And what has France contributed, financially or in the means of medical supplies? I am sincerely curious, it's not a snide question.

France has done a lot but there came a time when resources had to be pumped into its own needs. It sent medical resources to China at the start and provided medical facilities to Italian patients when things began to heat up in the EU. It helped Iran, too. 

It is also using its scientific resources in the common task of COVID-19 treatments and preventative measures. Just like everybody else. Spain, for example, has authorised testing  for a drug which was already available for another coronavirus which affects a COVID-19 protein (eEF1A) attempting to impede its ability to replicate.

Then there are those foreign nationals working for other countries. Esteban Domingo (a Spaniard) is a member of the U.S National Academy of Sciences looking at Lethal Mutagenesis (among other things) to tackle COVID-19.

An international effort by all accounts but without shortcuts and still an incredibly complex task. 

lkrupp

Well now, how come we in the U.S. don’t have a Digital Minister?! That sounds like someone with a MCSE certificate and political connections. Should be an easy position to fill here. 

beowulfschmidt

AppleInsider said:

Cedric O attempted to shame Apple in the interview, suggesting "I regret this, given that we are in a period where everyone is mobilized to fight against the epidemic, and given that a large company that is doing so well economically is not helping out a government in this crisis." The minister claimed he couldn't explain the reasoning behind Apple's unwillingness to help over Bluetooth. 

Of course you can explain it you fascist twit.  You just don't want to.

Idiot French minister: "The only possible reason Apple doesn't want to give us access to this privacy invasive functionality is because they don't care about people, whereas we, your benevolent government, only want what's best for you, even if you don't know what that is and won't acknowledge that we know better than you."

pujones1

Since he only mentioned Apple, does that mean that this is allowed on Android devices? Does anyone know?

This isn’t sarcasm. I’m serious. I’ve never owned an Android device so I’m curious. 

gatorguy

pujones1 said:

Since he only mentioned Apple, does that mean that this is allowed on Android devices? Does anyone know?

This isn’t sarcasm. I’m serious. I’ve never owned an Android device so I’m curious. 

https://developer.android.com/guide/topics/connectivity/bluetooth

The user has to approve it on a per app basis (permissions). At least on more recent versions of Google Android you are also given the option when the app is first used to allow -Always, -Never, or -When in Use. Typically I check the option "When in Use".

Since Android Oreo (2017) it should be the same granular permissions whether using iOS or Android. If not my guess is Apple doesn't have the same permission structure, something changed quite recently? I don't think that's the case but...

I was under the impression the user can approve "Always" when the app is first used on an iPhone too, but someone will answer more authoritatively. 

In any event unless you the user actively approve it the French (and UK) apps will have the same issue with Android devices as they do with iPhones. I suppose the French want "Always" to be the automatically enabled option? 

EDIT: I found this much clearer explanation, in this case referring to the UK version but equally applicable to the French. Not just the permissions but the way Bluetooth in general is handled:

Despite what the NCSC has continued to imply, the app will not, as it stands, work all the time on iOS nor Android since version 8. The operating systems (Android and iOS) won’t allow the tracing application to broadcast its ID via Bluetooth to surrounding devices when it’s running in the background and not in active use. Apple’s iOS forbids it, and newer Google Android versions limit it to a few minutes after the app falls into the background.

That means that unless people have the NHS app running in the foreground and their phones awake most of the time, the fundamental principle underpinning the entire system – that phones detect each other – won’t work.

It will work if people open the app and leave it open and the phone unlocked. But if you close it and forget to reopen it, or the phone falls asleep, the app will not broadcast its ID and no other phones around you will register that you’ve been close by

SamWebb

For the most part, the way France has handled COVID-19 has be exemplary. The government has been very helpful to workers who have had to stay at home or who have been put out of work, have been very clear in communicating why policies have been put in place without politicizing the issues, and is quite respected here even though the opposition are being immoral jerks. People are the priority. They even worked out how to transfer those on ventilators via TGV to another part of the country where hospital space was available. The competence has been refreshing to be around. With that being said, France should change their decision and go with the Apple/Google API. The insistence on trying to shame Apple into modifying the OS to make it less secure is short-sighted. I hope they come to the correct decision soon.

riverko

The same France that was trying to accuse
Apple of not respecting users privacy enough? Really?

bshank

JinTech said:

And what has France contributed, financially or in the means of medical supplies? I am sincerely curious, it's not a snide question.

Arrogance

frantisek

Apple_Bar said:

frantisek said:

I would just advice Mr. Minister to confront this statistic before asking for anything. Source https://www.worldometers.info/ 

Good job Apple, they could use your technology so they can blame themselves.

Some people are using the graph as if it really means  something...ߙ䦬t;br>
You don’t see any red flags screaming at you just by looking at it for 1 fs.

Agree completely. Forgot about marginal corona a go and live your life as before. Or not? Is there any urgent need to track people?

Rayz2016

swineone said:

 I'm not familiar enough with the matter to tell if the restriction is just a matter of App Store approval, use of undocumented APIs, or if it is a fundamental security limitation of iOS. 

Then maybe you should've asked.

 In the first two cases, Apple should approve this on a case-by-case basis. As for the third case, since Apple now has an API, I guess it's doable, so we go back to the first two cases. So yeah, Apple is being boneheaded as well. Special concessions are being made everywhere due to crisis, Apple might as well do their part. Maybe have a whitelist of apps that can use the feature.

Well, ignoring the fact that whitelisting apps is just asking for someone to break your security, but that's not the problem. What Mr O is asking for is for Apple to allow their app to run in background all the time, constantly pinging Bluetooth to look for the app on other phones. Once folk realise that it's the French government's COVID app that is draining their battery, then they'll stop using it, which will render their whole COVID scheme useless anyway; so I don't see Apple giving ground on this one. It's a poor solution to a problem that's already been solved.  Ask the Germans.

Rayz2016

red oak said:

Opening Bluetooth access to apps running in the background would be a security disaster.    It is comical that a "Digital Technology Minister" would be demanding it.  

It turns out this guy has no programming or software experience.   And, very limited business experience.    He's never developed an app in his life.   A true socialist bureaucrat appointed to help lead digital technology in France.   LOL 

https://en.wikipedia.org/wiki/Cédric_O

Mmmm. That explains a lot.

larryjw

This is the same argument used by the US government for getting a back door. 

Getting a back door is always the goal: google, Facebook, the cops, the states, the feds. The only thing that changes is the rationale. 

Funny, I’d much prefer a back door to the administration, the Congress, the courts, the 1%.

I’d much prefer balance. You can have my data, but I want all of yours in return.