Radboud Universiteit
Zoek in de site...

Zwaai.app is an alternative for corona apps that require Bluetooth

Datum bericht: 12 mei 2020

When there's talk about an exit strategy for the corona crisis, there's also debate about an app to track the transmission of the virus. Despite the possibilities of such an app, many experts have privacy concerns. Researchers from iHub, a group within Radboud University that focuses on the influence of digitisation on society, have therefore developed their own app. This app does not use Bluetooth, which would eliminate many privacy concerns. “The question remains whether an app is really necessary, but if it becomes part of the national strategy, this is the only workable solution in our view.”

“There is no such thing as an ideal corona app,” asserts Bernard van Gastel, security researcher at Radboud University. On 7 April, the cabinet announced that it was looking into technology to monitor the spread of the coronavirus in the population. This elicited a sceptical reaction among the researchers at iHub, which resulted in an open letter and reactions in the media. And yet the researchers became curious: if the government wants an app so badly, can we develop an 'acceptable' variant in terms of privacy?

Objection to Bluetooth

This was a topic that kept iHub employees very busy. The group has a healthy mistrust of the idea that technology by itself can solve all problems. And the fact that the cabinet seemed to be looking for an app with Bluetooth was also problematic. According to van Gastel, wireless technology has several disadvantages that become even more difficult in situations like this.

“The fact that most people do not really understand Bluetooth is already a problem for the acceptance of such an app. It operates in the background, it is sneaky and works without you noticing. As a user, you do not know what happens to your data and where the other data comes from. The Dutch satirical programme Zondag met Lubach (Sunday with Lubach) presented a good example of the potential problems: a shop owner whose phone app indicates that he is ‘infected’ with the corona virus simply has to walk past his competitors, and they will also have to close. The Bluetooth signal ensures that you can very quickly – and anonymously – cause problems for other people.”

“You are also at great risk of false positives and false negatives because Bluetooth does not determine your location very accurately. All kinds of factors, even including our bodies, have a major influence on the signals. According to the government, anyone who is more than 150 cm from you is not a problem. But if your phone is in your pocket with your hand over it, then the range of Bluetooth may suddenly be limited to only one meter, while your signal may have a range of five or ten meters when you are holding your phone in your hand.” If you are unlucky, you will receive a warning from your phone after a shopping trip, while the corona patient detected by the app was actually two floors higher and lying in bed.

During an on-line consultation, iHub colleagues identified other problems: limitations of Bluetooth on the iPhone, the complexity of data security and much more. To cut a long story short: there is no such thing as an ideal corona app, and a variant with Bluetooth is therefore certainly not ideal. But what are the alternatives? “Bart Jacobs (professor of computer security) proposed a variant with QR codes. The more we talked about it, the more it seemed that this variant eliminated as many problems as possible from the government's proposal.” A small group of four or five went to work on the QR variant and delivered an initial working version of the Zwaai.app, as the application is called, within a few days.

A warning you should take seriously

Zwaai.app uses QR codes. Users can share a personal QR code with anyone they meet. “As soon as you register a meeting, both persons will send a new random number to each other, using the QR codes, which together form a new number. That number is then only stored on both phones – not on a central server,” explains van Gastel. “Because you have to scan the code yourself, you only register deliberate encounters. You do not run the risk of accidentally making ‘contact’ via Bluetooth with someone who is walking five meters away from you. If you see a warning in Zwaai.app that you have been in contact with someone who is infected, then you also know that you have to take that warning seriously.”

A QR code can be printed for general areas such as shops, offices or public transport. This code contains the Internet address of a virtual Zwaai.app, with which codes are exchanged in the same way. This is actually the same as a direct meeting, but with one difference. You get a clear warning that you have been in the same room at the same time as an infected person.

Privacy is central to all components of the app. By default, all encounters and codes generated by this app are stored only on your phone. If you have caught the virus, you can voluntarily decide to upload all those codes to a central server to warn others, although this step is preceded by a health check. The app regularly checks whether the codes on your phone are also in the central database, but does not share those codes by itself. Some will claim that an app that is so transparent doesn't offer enough protection, while others may think that even this is a drastic erosion of privacy. “Some colleagues think that using any tracing app means already crossing the line. I am looking forward to the discussions we will have about this app this regarding legal, ethical, social and other concerns. "

The app self-destructs

For Van Gastel, the annoyance that QR codes cause for some users is actually an advantage. “This app is easy to maintain as long as we all have limited contact. But if the social distancing measures are relaxed at some point and we start making a lot of social appointments, no one will want to continuously scan each other's codes at every meeting and in every shop. I believe in human laziness: this system does not scale up, so it essentially self-destructs. You do not have the risk that the app will continue to collect user data in the background after the corona crisis, a risk that you do have with Bluetooth apps.”

“In our opinion, this is the best solution. It is not too complicated to use, it is not too complicated or expensive to build, and it collects only a limited amount of data. It still has certain risks and drawbacks. For example, some people may decide not to scan on purpose or all kinds of social consequences. For example can an employer view an employee's app? But those are risks that you will have with any corona app.”

However, it does not look like Zwaai.app will be used by the Dutch government. After experts criticised the government's first 'appathon' with external developers, the government decided to change the process and develop an app internally. Other countries or interested parties can still contact iHub, but if Zwaai.app is never used, Van Gastel will also be happy with that. “An app by itself will not get us out of this crisis. With Zwaai.app we have highlighted the problems caused by a Bluetooth app, and we offered an effective alternative. Ultimately, the coronavirus is not a digital problem, so you need an analogue solution.”

Image at the top of the article: Pexels