StopCovid: why Bluetooth is the least intrusive solution for tracing our movements

In a race to keep up with, and thus halt the flow of new Covid-19 cases, the French government is working on a digital tracing solution. The StopCovid app will use Bluetooth. Let's take a look at this technology to better understand the device that will potentially be used during deconfinement in France.

The StopCovid application will use Bluetooth

The government is developing an application called StopCovid which is envisaged as a solution to supplement the system currently in place to fight against the coronavirus (Covid-19). This application could be available from May, if the government decides to deploy it on a large scale.

To go furtherHow the digital certificate generator works

Unlike other solutions used in Asia, StopCovid does not use GPS or cellular geolocation, but the Bluetooth of our smartphones.

How does Bluetooth work?

Most of us use Bluetooth to send files between devices, connect a wireless mouse or listen to music wirelessly. However, the use of Bluetooth for proximity tracking has been practiced commercially for over a decade.

Bluetooth tracking is performed by measuring the Received Signal Strength Indicator (“RSSI”) of a given Bluetooth connection to estimate the distance between devices. Simply put: the stronger the signal, the closer the devices are to each other. Bluetooth LE (BLE) devices can also change their transmit power, which means they can further limit signal range. Bluetooth 5.1, released in late 2019, supports direction finding ("RDF"), which means it can achieve an effective accuracy of about 1 cm.

Bluetooth is present on all smartphones

A key feature of Bluetooth LE that's interesting when thinking about location or interaction tracking is that, like many aspects of smartphones, Bluetooth LE is noisy. It's like a person in an open space who can't stop talking. Bluetooth LE devices use this "hustle" to announce their presence to other Bluetooth LE devices - it's as if you're in the middle of a crowd, regularly shouting "I'm here" to anyone close enough to hear it. hear. Messages are broadcast at a fixed time interval, which can be set between 10 ms and 10.24 seconds depending on the urgency of these connections.

Since the radio frequency range used by Bluetooth (2.4 ~ 2.48 GHz) is incredibly congested – by Wi-Fi, wearables, garage door openers, baby monitors, cables unshielded USB 3.0 and even microwave ovens, among others – Bluetooth transmits this data in three different parts of the spectrum (the start, the end and the middle, avoiding the WiFi channels) in order to try to overcome all the interferences.

Bluetooth contains extremely useful information for tracking. It contains information about the device (including device type and MAC address). In the case of monitoring for Covid-19, the application uses a unique universal identifier called UUID for Universally Unique IDentifier.

A UUID is a series of 128 digits, represented in hexadecimal notation. UUIDs are (usually) generated in two ways: either randomly generated, or derived from a property of the device – for example, a phone number, MAC address or even the IMEI. These UUIDs are generated by the application itself, but can be generated by a remote server.

To go furtherHow to find your IMEI number and what is it for?

These UUIDs are great for consistently identifying and referring to a single device, and therefore a single individual. However, it is obviously not that simple.

Bluetooth: what disadvantages and what risks?

Of the various tracking technologies, Bluetooth certainly has the potential to be one of the least invasive purely due to its relatively low transmission range, but there are downsides and a few risks.

The UUID must be centralized to be effective

As mentioned earlier, Bluetooth LE (and Bluetooth in general) is incredibly loud. But what does “noisy” mean? Take your smartphone, open the Bluetooth search on your phone and count the number of devices you can observe. There are many.

If you have Bluetooth enabled, your phone will broadcast its MAC address. A MAC address is a unique identifier used by network devices. This identifier is physically defined in your phone's Bluetooth chip. However, the applications you use in Bluetooth seek to anonymize the identity of the smartphone by sharing and storing only a UUID instead of sharing the MAC address.

These UUIDs can be regularly regenerated, i.e. you will not always have the same identifier. It is therefore complicated to simply use this UUID without foreseeing its operation.

In order to keep track of changes while being able to tie them to an individual device, these UUIDs need to be generated centrally – so they need to be generated and pushed by a remote server (the government one or an external entity) to your phone or be generated on the device itself and saved to the app.

The government could therefore opt for a method of decentralization, in the case where the application generates and stores the UUID, or for centralization, where the UUIDs would be generated and stored on a remote server. However, it seems more efficient to opt for the UUID centralization method, even if the latter requires that the data be stored and shared by a third party.

In the case of the TraceTogether application used in Singapore, which uses Bluetooth connections to connect other nearby phones like what is envisaged for the StopCovid app in France, it works by alerting those who have been in the vicinity of a user tested positive for Covid-19. This means that if you test positive for Covid-19, your UUID will be stored and shared with everyone you come across. Potentially thousands (and even millions) of people will share their UUID. The government could choose to anonymize the UUIDs stored, and therefore not to link them to a telephone number for example.

Beware of other apps

But other risks exist, and some are related to the apps you use. Using Bluetooth for proximity tracking requires people to leave Bluetooth on at all times. Although the effective range of Bluetooth is around 10 meters, it is (actually) greater than that. Bluetooth can potentially transmit up to 100 meters, depending on your device's Bluetooth standards and the environment (noise around you). Because (as said above) Bluetooth is noisy, it means anyone nearby can track/is able to pick up the data Bluetooth is sharing.

To go furtherHow to secure your smartphone, tablet or PC? The ultimate guide!

This means that if our Bluetooth is constantly on and we are constantly streaming data, we will have to be very mindful of what other apps on our smartphone are using this information, what permissions have been granted to them and how this could benefit a tracking business for example.

The faults of Bluetooth

Regularly, the security of Bluetooth is compromised – certain security flaws can cause malicious people to execute any software remotely or to collect personal data – without any interaction from the user. It is therefore important to keep your smartphones and applications up to date, as Google and Apple use anti-tracking techniques and regularly deploy security patches.

To go further Android: a critical security flaw affects Bluetooth

Should we be wary of StopCovid and the use of Bluetooth?

Bluetooth has the ability to be both the least intrusive of tracking technologies (based on proximity between people who choose to use the app), while also perhaps being a bit too precise in tracking movement and interactions (due to its proximity).

In this global crisis, we must be very aware of the limits of the choices available to us. It's also important that technical and legal frameworks around data processing and storage — particularly where that data can be used to lift anonymization — aren't circumvented or ignored as the government rushes to deploy technology, too. well intentioned as he may be. It is also important to ensure that there is a real need to use a digital tracing system, which must be validated by scientists and experts.

Alternatives to using Bluetooth are much more intrusive, such as GPS and Wi-Fi location data or cellular geolocation data from mobile operators. Despite the disadvantages of Bluetooth, such as these UUIDs which can change which therefore requires centralization, it is a method of tracking much less intrusive than the other alternatives available for a digital tracing.

To follow us, we invite you to download our Android and iOS application. You can read our articles, files, and watch our latest YouTube videos.