Country analysis: France

Slow start for Stop Covid, the contact tracing app

In early April, the French government announced an automated contact-tracing app. The project, Stop Covid, is headed by the National Institute for Research in Computer Science and Automation (Inria), a public organization. It designed its own centralized, pseudonymized Bluetooth-based protocol, ROBERT.

Parliament voted to support the project in late May, with the government’s party and parts of the right supporting it. Others voted against, citing concerns that the project brought little in way of health safety while opening the door to widespread government surveillance. The data protection authority published an opinion on 26 May, which stated that the project was legal.

A few hiccups happened as the app was developed. Orange, the historical telecommunications company, announced its own contact-tracing app before stepping back. Some people downloaded a Georgian app with the same name, Stop Covid, and complained that it was not available in French. The actual app was finally published on the App Store and Google Play on June 2.

Minor incidents followed the release, such as the government’s forgetting to allow the app in France’s former colony of Guadeloupe, which is now part of France proper. Overall, software security experts praised that the code was open-sourced and that a bug bounty program allowed for finding and fixing bugs early.

However, key aspects of the project remain blurry. It is unclear, for instance, whether or not personally identifiable information, such as IP addresses and user-agents, are stored centrally.

Adoption has been slow in the first week after launch, with 1.2 million users activating the app and about 350,000 daily running it daily.

Mask-recognition algorithms

DatakaLab, a Paris-based company, supplied several public institutions with a tool to automatically detect mask-wearing. It was used at least in Cannes (population 70,000) and at the Parisian metro station of Châtelet-Les Halles (800,000 daily commuters).

Both trials were suspended in June.

Fever controls

Several cities installed automated software coupled to infrared cameras to measure the temperature of visitors entering town halls, or of children leaving school. Roissy airport installed a similar system to screen passengers from some international flights.

La Quadrature du Net, a civil society organization, claims that such measures are likely illegal under GDPR.

Download the full report as PDF (1 MB).