Article updated on 05/26/2021 - The TousAntiCovid application now hosts a new feature called Signal which aims to facilitate contact tracking in places where social distancing is difficult to apply, such as bars and restaurants. It is in fact the digital version of the reminder book used last fall in these establishments. Instead of writing your contact details in a notebook, you can now scan the QR Code of the establishment attended with TousAntiCovid. We have updated the information in this guide accordingly, but to learn more about this, we invite you to also read our dedicated article.

Since October 2020, the StopCovid application has been replaced by a new version: TousAntiCovid. In reality, if the name and the interface change and new features have appeared, it is more of an update to StopCovid than a new application per se.

After the failure of StopCovid, both on a technical level (few alerts had been sent) and on the total number of downloads (just over 2.4 million in three months of existence), the government wanted transform its application into a "hub", that is to say a platform bringing together several digital services. At the end of May 2021, the application was downloaded in total more than 16 million times, but in March 2021, Cédric O, Secretary of State in charge of digital, communicated a total of barely 100,000 alerts sent to users. It is difficult to speak of success with such results, but in any case it represents a significant acceleration.

However, the principle and technological basis of TousAntiCovid remain the same as StopCovid. This is to warn users in the event of (prolonged) contact with a person tested positive for Covid-19 and to inform about the pandemic, but indeed, the application has been greatly enriched since its beginnings and now covers d fields other than "contact tracing". Here is everything you need to know about TousAntiCovid.

:

1. TousAntiCovid, what is it?
2. How does TousAntiCovid work?
3. How does contact tracing work?
4. A mandatory application?
5. And for those who don't have a smartphone?
6. Who designed TousAntiCovid?
7. What data is used and stored?
8. Is it possible to geolocate you?
9. Is contact tracing really reliable?
10. What about the risk of piracy?
11. What does the CNIL say?

Before getting to the heart of the matter, if you want to download TousAntiCovid, just click below:

Download > TousAntiCovid - StopCovidTousAntiCovid is the application set up by the French government during the coronavirus pandemic. It provides information on the situation, makes it possible to create travel certificates, and, above all, to identify contact cases.

1. What is TousAntiCovid?

As we told you in the preamble, basically, TousAntiCovid, then called StopCovid, is a "contact tracing" application (contact tracking) whose sole purpose is to send you an alert on your smartphone when you have been near a Covid-19 positive person. Once alerted, the user concerned is invited to self-isolate in prevention.

Of course, it is not a question of warning users in real time, but afterwards, in order to encourage them to be tested. Thanks to such a system, the government hopes to more easily trace “contact cases” and better contain the virus. A concept acclaimed by the government but also criticized by some privacy advocates and derided for its lack of reliability and efficiency.

Image of the old StopCovid

From now on, TousAntiCovid is thought of as a platform centralizing the various government services and information in the context of the fight against the Covid 19 pandemic. The "contact tracing" system is still there, very active, but there is also advice practices, information and key figures on the number of new cases detected in France each day, the number of people vaccinated, the tension in intensive care in hospitals...

In addition, a part is now devoted to vaccination. It allows you to know if you are eligible and to know the vaccination centers near your city, by entering your postal code. By the way, know that we have produced a complete guide to vaccination, which can be found by clicking below:

TousAntiCovid also offers you to generate derogatory certificates in digital format for your travels during curfew/lockdown periods. To do this, the application has integrated the government certificate generator, which remains accessible via the website of the Ministry of the Interior. If you are not comfortable with digital, we invite you to visit our tutorial on this subject, it will help you fill in your documents and provide you with some very useful tips. It's this way :

Certificate generated via TousAntiCovid

The health pass on TousAntiCovid

Another novelty of the application in test since Monday April 19 as part of the European health pass project for travel, TousAntiCovid allows you to import your PCR test results and your vaccination certificate in order to facilitate checks at airports. Agents will be able to scan your phone in the blink of an eye, or rather the QR Code displayed on TousAntiCovid, which will tell them whether you are in good standing or not.

Called Notebook, the function is currently limited to certain flights to Corsica and the DOM-TOM but it will soon be extended to other destinations and in particular the other countries of the European Union from July.

The digital reminder book

Finally, as we told you at the end of May, the Signal function of TousAntiCovid has been added for test purposes (in particular in the restaurants of the Rungis market) and will be generalized to all restaurants, bars and other places where compliance with barrier gestures is not possible from June 9th. It is in fact a reminder book like those that restaurant customers had to fill in with their contact details last fall, but in a digital version.

Instead of entering your name and phone number, from June 9, you can simply scan the QR Code of the establishment attended with your smartphone and the TousAntiCovid application. If a person present the same day, at the same time as you and in the same restaurant or bar subsequently declares himself sick on the application, you will receive a notification to inform you and invite you to go get tested.

A more practical and secure system in theory than notebooks in paper format (which will remain available for those who do not have smartphones), but the effectiveness of which can already be doubted knowing that few people think of report sick on TousAntiCovid. This is undoubtedly the reason why few alerts were issued by the initial TousAntiCovid contact tracing system.

2. How does TousAntiCovid work?

The handling is quite simple, the user must first confirm his intention to participate in the operation. A brief summary helps to understand how the application works. After a reminder of the barrier gestures and the activation of the authorizations necessary for its operation, the application takes you to the main menu. For contact tracing to work, however, it will need to be enabled from the main menu.

TousAntiCovid main menu

The home page or main menu of the application is simple, there are from top to bottom:

Everything is well explained and using the main functions shouldn't be too much of a problem. To properly generate your certificate, we invite you once again to consult our dedicated guide.

3. How does contact tracing work?

When two people who have installed the application on their smartphone meet in the street for a certain time (15 minutes) at a “close” distance ( within a radius of 1.5 meters ), their devices are detected by the Bluetooth wireless link . Their “meeting” (their respective identifiers, which are anonymized via an encryption method) is then automatically recorded on each of the telephones. If both people don't test positive for coronavirus and have no symptoms, nothing happens.

If one of the two is contaminated, the other person crossed in the last 15 days as well as all the others who have been in contact (we are talking about prolonged contact of 15 minutes once again) with the patient will receive a notification. They don't know who they met, or where and when exactly. Due to the inaccuracy of Bluetooth, a statistical model is also used to determine if contact has taken place. An algorithm then calculates a “score” of risk of contracting the virus. According to Cédric O, Secretary of State in charge of digital, the system is in “link with a health third party” to guarantee that the declared cases are really positive.

Image credit: Inria

Let's go into a bit more detail. In fact, what happens when a person declares themselves (the approach is based on volunteering) positive for Covid on the application, the latter sends the information as well as the user's contact history ( a list of identifiers therefore) to the central server of TousAntiCovid. This allows the server to draw up a "black list" of identifiers of infected people and contact cases. As for other users, the TousAntiCovid application installed on their phones will regularly go through the “black list”. If it finds its own identifier in the list, it means that the owner of the phone is the contact case. From then on, the notification is automatically sent to prevent it.

Last thing to know, server data and data on users' phones are automatically deleted after 14 days.

4. A mandatory application?

TousAntiCovid is not compulsory and therefore based on voluntary action, the person who tested positive declaring himself as such and agreeing to disseminate this information anonymously to the authorities and to others. Ditto for the Notebook, Reminder Book or Certificates part, the associated documents can also be used in paper format. See the section on the CNIL's opinion to find out more about this.

5. And for those who don't have a smartphone?

The application is based on Bluetooth Low Energy (BLE) which has an energy consumption 10 times lower than the usual Bluetooth. BLE makes it possible to integrate this technology on other equipment such as watches, medical monitoring devices or sports sensors. At launch, the government was considering integrating the TousAntiCovid system into other devices. Cédric O indicated via the Medium site (before the launch of TousAntiCovid) that the teams in charge of the project were already considering wearing the system on connected bracelets or boxes.

In order to solve the problem of the digital divide, many people (30% of the population) not having smartphones, “keys” which would be distributed massively to the citizens were also under study. Germany has also designed an application of the same type, Corona Datenspende, which relies on connected watches to collect physiological data from users. However, no sign of these devices for the moment in France.

6. Who designed TousAntiCovid?

The government led the project, but it was researchers from Inria and Germany's Fraunhofer Institute, as well as public and private sector developers, who designed the app. While Inria is responsible for steering, technology is at the center of a European project led by Germany, France and Switzerland, the “Pan-European Privacy Preserving Proximity Tracing” (PEPP-PT, for “Privacy-preserving pan-European proximity tracing”). It brings together more than 130 researchers from eight countries.

For their part, Apple and Google have joined forces to provide a common iOS and Android technical base to contact tracing app designers (all over the world). Several European countries do not rule out using the API of the two American giants. In France, Cédric O, Secretary of State in charge of digital, closed the door to the solution proposed by the two GAFA for a question of “sanitary and technological sovereignty”. TousAntiCovid is based instead on the Robert protocol, developed by Inria and German researchers.

Private companies involved in the development of the application include CapGemini for architecture and back-end development, Dassault Systèmes for secure cloud data infrastructure, Lunabee Studio for application development mobile or Withings. Note also the participation of Orange, Public Health France, Inserm and ANSSI.

7. What data is used and stored?

Contact tracing

TousAntiCovid follows the approach adopted by another application, launched in March in Singapore: Trace Together. This techno, promoted by the government of the island city-state and used by 620,000 people, is based on an open protocol (open source), in addition to volunteering. It does not access the user's contacts or geolocation data, which, according to its developers, allows privacy to be respected by making any traceability very difficult.

However, Trace Together and TousAntiCovid mix decentralized and centralized methods since, if they are only stored on smartphones for a short period, the data remains exchanged with a central server managed by the health authorities.

The Robert protocol is designed so that TousAntiCovid does not request any personal data : neither marital status nor telephone number. The data is anonymized , each being identified by a “unique code” encrypted and saved locally, directly on the smartphones. These are the famous identifiers we were talking about.

When launched for the first time, the TousAntiCovid application immediately ensures that it complies with the GDPR (General Data Protection Regulation) applicable throughout the European Union. Nevertheless, from the time of StopCovid, a researcher had discovered that the application “collects, and transfers if necessary to the central server, the identifiers of all the people who have crossed paths via the app”. The government was then justified by invoking technical reasons, explaining that the identifiers of users changed regularly and that thus, a contact between two people lasting 5 minutes and another of 12 minutes could in reality be a single contact of 17 minutes. To realize this, the government would have had no other alternative than to send the identifiers to the central server, the only one capable of linking them.

Certificate generator

The Ministry of the Interior indicates on its site that the certificate generator does not store any personal data, which seems to be corroborated by the analyzes of the code of the form, initially launched as a web page. The certificate generated is a QR Code that can be scanned by the police during a check. This code contains all the information you have entered via the form, it allows the police to respect barrier gestures, this prevents them from having to approach people in the event of a check or touching their smartphones (in case it would be necessary to zoom in on the certificate for example).

Still, keeping the data on the police device that scans the QR codes, namely Sony smartphones or tablets using a modified version of Android (Secdroid) and a specific application called CovidReader, is not technically infeasible. speaking. However, questioned by our colleagues from Numerama, the Ministry of the Interior assured that this was not the case. The Professional National Military Association Gendarmes et Citoyens also declared in a forum published during the first confinement that it precisely regretted this lack of storage. And then, not sure that a collection of this type, without the explicit consent of the persons concerned, pleases the CNIL, responsible for enforcing European regulations on the protection of personal data.

But if you are not reassured, nothing obviously forces you to use certificates on smartphones, or even TousAntiCovid. In reality, as in many cases with technology, it is a matter of trust.

Notebook, aka health pass

As for the Notebook function which allows you to integrate your PCR test results or your vaccination certificates, the device is intended to be encrypted and the government affirms that the data remains locally on the user's telephone. The latter also ensures that the code scanner application used does not store anything in memory.

Thanks to the use of these QR codes, the authorities or authorized personnel also only have access to information that is useful to them according to the government: "When you hand over your pass, the only thing that will appear on the screen will be green or red. No one will know if you can travel thanks to a vaccine or a PCR test,” said Cédric O, Secretary of State in charge of digital, on Europe 1.

However, PCR test results and vaccination certificates are still centralized on the sidep.gouv.fr platform so that you can retrieve them without going through the center or the doctor where you performed the PCR test or received an injection of vaccine. And as you may know, no computer system is foolproof. So there is always a risk, however small, that other people can access it.

Reminder Book aka Signal

Although the Digital Reminder Notebook, aka Signal, and TousAntiCovid's Contact tracing system are similar, they do not use the same protocol. No Robert for Signal but the CLEA protocol which we do not yet know very well but which is intended to be mixed centralized/decentralized. The government again assures that the functionality is intended to be secure and respectful of privacy.

Customer data does not leave the application, names or addresses of establishments are not requested and the information contained in QR Codes is encrypted according to the executive. Impossible to know the name of the establishment in which you may have come across an infected person. Finally, your history of frequented places is automatically deleted after 14 days but you can access it at any time to delete a place.

8. Is it possible to geolocate you?

The DP3T protocol, Robert as well as the solutions developed within the framework of the European Union do not use GPS, but only Bluetooth. This short-range technology relies on the proximity of the devices, which therefore prevents any geolocation. However, by using collection terminals such as those used by advertisers, or by cross-referencing data with those of other apps, as well as those of all users, it would theoretically be possible to reconstruct the comings and goings of a large part of the “volunteer” citizens. But between theory and practice there is a world and the task would undoubtedly be difficult...

9. Is contact tracing really reliable?

Uncertainties remain as to the ability of Bluetooth to provide precise data on the distances between users and therefore to deliver reliable results. To create a false sense of security?

In a “white paper”, the ACLU (American Civil Liberties Union) points out the limits of tracking apps, including Bluetooth . Contact detection via Bluetooth only works with the latest versions of this technology. However, asks the ACLU, is Bluetooth precise enough to distinguish close contacts, given that its range, which is generally about 10 meters, can in theory reach 400 meters with the 5.0 standard, and that does its signal strength vary greatly depending on the type of chip, battery and antenna? Obstacles can also disturb the waves , and the way the smartphone is worn by the user influences the signal.

In addition, the application will not be able to take into account any elements separating people located nearby since Bluetooth passes through walls. Two people in separate buildings can thus be perceived as in contact. And then, there is also contamination via surfaces (door handles, metro bars, etc.) which will not be taken into account, as well as brief contacts with the potential for contamination (a person sneezing next to another for example). To overcome these problems, the government is counting on the effectiveness of these health and statistical models.

Finally, for this function to be effective, 60 to 70% of the population should use it. But we now know that we are far from the mark.

10. What about the risk of piracy?

The StopCovid app is not free from the risk of hacking, as someone with malicious intent can potentially hack users' devices. Because you should know that Bluetooth, like NFC, is an insecure technology. There is also the possibility for a hacker to attack the central server, however it is easier to adequately protect the server than all of the users' smartphones. This is also Cédric O's argument to justify the use of a system that is not totally decentralized. Indeed, if no central server is used, then the list of patient identifiers will have to be stored locally on the smartphones of each user. It will therefore be more easily accessible and potentially more exposed.

Finally, note that fraudulent applications are already online. We advise you to check the publisher of the application you are installing or to go through safe links, such as the one we provided at the beginning of the article. In addition, be aware that there are third-party contact tracing systems but we advise you not to use them, especially since some are based on geolocation to work...

11. What does the CNIL say?

To set up such a contact tracing tool, the government could not do without the advice of the CNIL, the National Commission for Computing and Freedoms. She had immediately warned that “volunteering” was the red line not to be crossed, that she would ensure that the app did not work beyond the crisis and that the data was not stored improperly. . The CNIL warned in early April 2020 that the data should be deleted within a reasonable time, and that the consent should be "informed". The refusal to download the application should not reduce people's mobility either.

In its opinion issued on April 24, 2020, it considered the device to be GDPR-compliant , but warned the government and parliament against any temptation to provide direct or indirect benefits to those who agree to install it: “Public institutions or employers should not condition certain rights or access on the use of this application. This would also constitute discrimination (...) Under these conditions, the use of StopCovid may be regarded as truly voluntary. Different choices, which would be the responsibility of the legislator and whose strict necessity would then have to be demonstrated, would affect the right to the protection of personal data and respect for private life much more considerably.

Finally, the institution also validated the Signal device desired by the government to replace the reminder books in paper format.