Coronavirus: France set to roll out contact-tracing app before UK

French smartphone owners can download a coronavirus contact-tracing app from Tuesday, its Prime Minister said. That is set to pre-date a UK counterpart.

The move will coincide with France's lifting of several restrictions, including the reopening of some bars, restaurants, beaches and parks.

A bug bounty scheme will be run to encourage the public to help identify any flaws in the software.

But critics claim it suffers from a "fundamentally flawed design".

Edouard Phillippe's announcement came a day after France's Senate approved the app's release by a vote of 187-to-127, which in turn followed an 338-to-215 National Assembly vote.

The StopCovid app will supplement work already being done by a French team of human contact tracers who are trying to identify people who are infected with the disease but unaware of the fact.

The app works by using Bluetooth signals to detect when two handsets are in close proximity, in order to log an estimation of the distance and length of the encounter.

France, like the UK, has opted for a "centralised" app, which carries out contact matches on a computer server.

That contrasts with the "decentralised" model - an approach advocated by Google and Apple - which carries out matches on users' own devices.

The main differences between the two are that centralised apps provide the authorities greater scope to delve into gathered data to refine their approach to tackling the pandemic, while decentralised ones in theory promise users a greater degree of anonymity and privacy.

The French government has made appeals to national pride over its decision to roll out a proprietary solution.

It faces having an incompatible system to its neighbours Germany, Switzerland and Italy as a consequence.

"This is a French project, with the excellence but also the panache and some would say the stubbornness which characterises our country," Digital Affairs Minister Cedric O said on Wednesday.

"Is it really a coincidence that 22 countries have used the Apple-Google API [application programming interface], but not France and Britain, which are the only two countries in Europe with their own nuclear deterrent?"

Cash rewards

The risk for the French government is that its decision to adopt the centralised model deters members of the public from installing it.

The app's developers have acknowledged that although users' identities are anonymised before they upload their logs to the central server, it is in theory still possible to re-identify them afterwards.

That has concerned civil rights activists.

"It could threaten the right to privacy and more generally the right to freedom of expression and peaceful assembly because it opens up a way to monitor the interactions of everyone who installs it," Amnesty International France has said.

Some security researchers have also called for the rollout to be delayed until a Bluetooth vulnerability - full details of which have yet to be made public - is addressed. The issue does no affect apps based on the Apple-Google model.

The French government has, however, invited a select group of "ethical hackers" to audit the app's code in advance of its launch.

And it has teamed up with the European bug bounty programme YesWeHack, which will offer cash rewards to anyone who finds critical flaws in the program after its release.

UK rollout

England had originally planned to launch its own NHS Covid-19 app nationwide in conjunction with the start of phone calls by its Test and Trace team of human investigators, which happened this morning.

A contact-tracing app should be offered to all England's residents by mid-June

Health Secretary Matt Hancock says he now wants to stagger the two, and plans to deploy the app within the next fortnight.

Before then, NHSX is set to carry out a second phase of a trial of the software already under way on the Isle of Wight.

At present, the app solely relies on users self-diagnosing themselves via a series of on-screen questions. The next stage of the test will involve incorporating medical test results.

Other parts of the UK have still to decide whether to deploy the same app locally or take a different approach.