There are eight requirements that apps and technologies to combat coronavirus must meet in order to be used in Europe. Seven days after the announcement, the European Commission has developed a coordinated approach with the 27 states of the Union. Objective: to avoid leaks forward and solutions that do not speak the same language.

According to the reconnaissance of Brussels, we move from tactics like that of Austria , inspired by Singapore (one of the first countries to have adopted technologies in contrast to Covid-19), in Cyprus, which adopted the platform of the Massachusetts Institute of Technology, (also presented in Italy), from the mobility maps of the Czech Republic (based on the data of the telephone operators and being tested in three regions) to the apps in the pipeline in many states (including Germany, France, Italy). In total, there are 12 so far Union chancelleries that have launched tenders, calls for tenders and research to adopt technological solutions against the spread of Covid-19.

Speaking 50 days after the first case of coronavirus in Italy, Brussels found itself chasing chancelleries in measures to contain the contagion from Covid-19. The risk is also phase 2 ended in a Babel. Not only of road maps and calendars to exit the lockdown, but also in the use of technologies to monitor the spread of Sars-Cov-2.

For this reason, the Commission, with the Directorate-General Connect on the front line (the one responsible for telecommunications and digital) has developed a toolbox. In other words, guidelines for the technical tools of the 27 states to communicate with each other on the basis of common standards and homogeneous rules. On the other hand, collecting the most data and using apps for contact tracing are considered among the six key measures to exit the lockdown. ” Contact tracing apps can be useful to limit the spread of coronavirus, especially as part of the exit strategies of the Member States “, stressed the Commissioner for the internal market, Thierry Breton, the former manager of the telecommunications industry who intervened with interventionism in managing the crisis.

Containment measures against Covid-19 adopted in EU countries (source: European Commission)

The rules

The eight basic requirements reflect what the European authorities have been repeating for some time. First: respect the privacy rules and in particular the guidelines resulting from the advice of the Council of European Privacy Guarantors (EDPB). Second: be developed in close coordination with the health authorities. Third: installation is voluntary and these technologies must be removed as soon as they cease to be useful. Fourth: technologies that most protect privacy, such as bluetooth, should be preferred . Fifth: the data must be anonymized and it must not be possible to trace the identity of the people. Sixth: apps must be interoperable across Europe, so it works if someone crosses borders. Seventh: they must be designed with the best standards in the epidemiological, information security and accessibility fields. Eighth and final point: they must be safe and effective.

Interoperability (from the European Commission document)

The theme of interoperability

Net of the bureaucratic patina, for technicians called to draw up the parameters, the first level of work was interoperability . The technologies that the 27 Member States adopt must talk to each other and exchange data . A conditio sine qua non to reopen borders and mobility within the Schengen area. If a French citizen becomes infected in Spain, the health authorities must be able to have homogeneous information to reconstruct the chain of infection.

The issue of interoperability, which does not affect geolocation via GPS, arises for bluetooth, which seems to be a more welcome technology in Brussels. Bluetooth (specifically, low energy, which consumes little battery), which allows smartphones to exchange an ID to connect when they are close, suffers from the fragmentation of models, brands and operating systems. In a few days, the collaboration between Google and Apple on bluetooth-based systems breaks down this wall and, in fact, allows the communication of around 3 billion devices worldwide .

For May, Google and Apple are planning to disclose the programming interfaces for the applications (API), which can be mounted within the official apps of governments and health authorities to collect information. In a second moment the two companies will churn out their solution. The Commission itself, which has not expressed an official position on the Apple-Google agreement, although far from the microphones has recognized its usefulness (while observing that it respects the privacy rules), has set the date of 30 April to analyze the effectiveness of local instruments and their interoperability on the border.

What technologies to use

The second level concerns the type of device. So far the debate has focused on apps and smartphones . But a source who worked on the drafting of the European guidelines explains to Wired that data may also have been taken into account and can be collected from other devices. As a smartwatch or fitness tracker for outdoor activities, since action is taken in phase two. Or again, from tools in use for specific categories, such as the elderly or people with disabilities, although at the moment the Commission foresees for them the manual collection of information.

The data sharing scheme of the contact tracing solution proposed by Google and Apple (source: Google-Apple study)

The privacy shield

The third level concerns the protection of personal data. Minimise the collection of useful information, use anonymized and aggregated data , prevent third parties from tracing the person’s identity, delete the archive as soon as possible, adopt apps on a voluntary basis . These are the principles that have long reaffirmed the Commission and the European Guarantor for personal data, Wojciech Wiewiorówski. And these are also echoed by the recent letter from the EDPB president, Andrea Jelinek. That, among other things, has called on governments to pass ad hoc laws that justify the use of these tools.

The Brussels guidelines insist on opt-in systems. That is, the subject must give his consent for the use of information, such as geolocation and timetables. It is clear that this collection system works only if a large number of people download and activate the app. In Italy the privacy guarantor, Antonello Soro, has calculated a minimum of 60% for it to be effective.

The chain of contagion

All this process, however, does not perform contact tracing per se. Up to this point the app has only stored some information (in the Apple-Google model, stored on the device itself). So much so that Jelinek himself recalls that the goal of these programs ” is not to follow the movements of individuals ” but only to ” discover events “, that is the contact between two people, one of whom is subsequently positive at Covid -19.

Smartphone data is therefore analyzed only if a person turns out to be suffering from coronavirus . Then the “safe” opens. The health authorities will rebuild the chain of contacts and, if necessary, access the app archive. At that point the alert will be triggered towards those who have been close to the patient . Without revealing the identity, but, reuniting the random pseudonyms exchanged between the devices, with a message that can warn of contact at risk, suggest the isolation measures to be taken, invite to undergo the test. It is still not clear who will press the notification button (whether the individual himself or a doctor) to avoid errors, manipulations or false alarms.

In parallel, Brussels also wants to collect data from telecommunications operators to model contagion spreading maps, based on people’s movements. There are 19 telephone companies to which the European Commission asked for data, to cover all countries. Among them, Vodafone, Deutsche Telekom, Orange, Telefónica, Telenor, A1 Telekom Austria, Telia and Tim. Furthermore, Brussels is in contact with large platforms such as Facebook and Google , which are making mobility maps. The information, also anonymized, will go directly to the Community research center, the Joint research center, which will share the results of its analyses

Group of young adults, photographed from above, on various painted tarmac surface, at sunrise.

with the governments.