No tracking. No cookies
Subscriptions
Subscriptions
Jacopo Iacoboni of La Stampa reports on how concerns about anonymisation, data sharing and procurement haunt Italy’s COVID-19 tracking app.
First published in La Stampa. Translated for Byline Times by Kamin Mohammadi
Italy’s COVID-19 Immuni app is now veering from an original centralised concept to a different decentralised system, which will make data collection less invasive and the app itself probably also more stable and resilient.
The move actually recognises at least one of the criticisms coming from the IT community. But we can also reveal that Copasir, the Italian parliamentary committee overseeing the activities of the intelligence agencies, has raised crucial questions about whether the app was chosen in place in beta phase, without property security validation.
La Stampa is able to make this report thanks to several related sources, speaking on and off the record. Those who have been part of the working group of the ministry are bound by a strict non-disclosure agreement.
Stefano Zanero, professor of cybersecurity at the Polytechnic of Milan, was one of the first to raise concerned of the Immuni app selected by the Ministry of Innovation. Firstly he stressed the need for an open-source code (a need that has now has been accepted in principle by the Italian government) and, secondly, that decentralised model would be preferable, leaving data only on citizens’ devices and not on a central server.
Now Zanero has written that he has learned “from direct sources” that the “Ministry of Innovation has already decided to veer towards the new model of decentralisation” in light of the widespread criticism in recent days.
Will there be a temptation to pass it on to other parties, perhaps behind the screen of a mixed system, and with the disguise of academic motivation or of private-sector efficiency in data management?
“The solution that best guarantees the minimisation of data is the ‘decentralised’ one created by the European consortium DP-3T which is, not surprisingly, also compatible with the Apple-Google framework (with minimal modifications),” Zanero observed. “This last point is very important because — questions of privacy apart – only compatibility with this framework will allow an app to work effectively and efficiently on the vast majority of smartphones in circulation,” he explained.
Zanero concluded that a decentralised solution of this type would also guarantee greater ‘inter-operability’ between different mobile phones, fundamental for such a product to succeed.
Anonymity and Data Management
The difference between the original Immuni app model which the Innovation Minister Paola Pisano first planned with the new one is one of possible de-anonymisation of data. Each cell phone generates an anonymous identification code, and in the decentralised model, this long sequence of numbers stays only in the device itself, without central registration, and therefore with much less risk of the data being de-anonymised.
The problem with a central register is whether the current Italian Government can be trusted and its potential conflict of interest over data management. The data operations of Italy’s largest party, the Five Star movement, are run by Davide Casaleggio. He is described as the Eminence Grise of the party now in government, and the “mystery man who runs Italy’s Five Star from the shadows”. He is also president of a small web and data company.
Paradoxically, it is the larger tech companies such as Apple who had focused on the security and privacy of data on their systems. “In the end, I think we will use this Apple-Google standard”, one Italian expert explained, adding: “It came out after we finished ours.”
“The issue to look out for is not so much the app itself”, another scientist familiar with the subject matter to explained “but the backend of the app, the data of the health system.”
“It’s a good question whether this health backend will remain managed at a public level,” the scientist told La Stampa “or will there be a temptation to pass it on to other parties, perhaps behind the screen of a mixed system, and with the disguise of academic motivation or of private-sector efficiency in data management?”
The question of the central server containing this data remains unclear. Domenico Arcuri, Commissioner for Emergency, continually refers to a server located not in the cloud but Italian government infrastructure. How can this be reconciled with the U-turn on ‘decentralisation’?
The Procurement Process
These fears about the Immuni appt not dispelled by a series of apparently inconsistent communications on the method by which it was selected.
On 17 April, when Commissioner Arcuri issued the Ordinance adopting the Immuni app, an official statement from the Ministry of Health said that “the software is among those selected by the experts of the task force established by the Minister for Technological Innovation and Digitisation in agreement with the Ministry of Health, and the one deemed most suitable in the end.”
However, La Stampa has established from several sources among the working group, that Immuni has not been “deemed the most suitable” by the 74 experts involved in the working group. In fact, as early as 21 April, the Innovation Ministry itself expressed caution: “The working group has concluded indicating among all the solutions examined, this is the most valid and suitable solution to be tested to eventually be adopted in this emergency situation.”
Many of the experts, on condition of anonymity, explained that they “did not select an app” as written in the Commissioner’s Ordinance, but had just indicated a course of verification and asked for clear and detailed decisions about the policy, but were ignored.
The Innovation Ministry’s 21 April press release writes of solutions “suitable for being tested” and therefore not ready for distribution. And finally, it says “possibly” which means that before deciding, technical and functional checks were still needed.
At this point, it is in the national interest to read the experts’ reports, which are not currently public, even if the Copasir committee is taking an interest in the matter and could obtain them. There one would be able clearly to see how the experts advised Innovation Minister Paola Pisano. One of the outstanding questions would be whether anyone in the Government insisted on the choice of adopting an app while still in beta and without validation tests and security checks?
This issue is not just one of computer science but becoming one of national importance.
This article was first published by La Stampa newspaper in Italy.