Very practical for health pass holders, the TousAntiCovid application collects statistics including a very detailed event log. It records and time-stamps user actions for transmission to statistical analysis servers. Even if these data are made anonymous, by carrying out cross-references it is possible to identify individuals and their relatives by name.
After a difficult start due to his centralized protocol Robert and concerns related to confidentiality data, theapplication StopCovid mobile, which later became TousAntiCovid, has changed in nature. The application which retains its tracing skills, if this function is activated, is used today mainly to present the famous sanitary pass in its digital form. Practical, but since an update deployed in June, a statistics collection function would hamper the protection of users’ private data, according to the analyzes of three researchers.
According to their publication on GitLab, while it was supposed to assess the use and effectiveness of the application, this collection can also succeed in retrieving enough confidential and private information and consolidating it to draw conclusions about people. In addition to the protocol Robert which only works when Bluetooth is activated and which allows a person to be recognized via an anonymous unique identifier, is added another protocol called Cléa. It ensures the follow-up of the places by the certificates In the format QR-Code. These are nominative when they are analyzed by the certificate converter, which will check their validity.
But on the application statistics data side, they are sent anonymously to the application’s servers. But now, because of this timestamp and cross-checking with the unique identifier of the Robert protocol, the statistics can easily make the link between an anonymized identifier and the real identity of the person. What if several people went to the same place at the same time, like Facebook we can deduce that these people, whose names can be identified, know each other.
When anonymization is lost with the collection of statistics
That’s not all, if a person who tests positive leaves Bluetooth tracing active, only the Robert protocol will stay on, since this individual must not frequent public places. By default, we can therefore consider that the person is sick, by the lack of activity on the Cléa protocol. In the end, this study clearly shows that these statistical analyzes are far from being developed in terms of the confidentiality of personal data.
That said, the TousAntiCovid application allows you to disable this statistics collection function. To do this, from the application you have to scroll through the home page to reach the “Settings” section. This allows you to do a good cleaning session in the data collected, but also to delete this statistical collection by deactivating the “Statistics and audience measurement” switch and by touching “Delete my data”.
Interested in what you just read?
.
