EU states agree a tech spec for national coronavirus apps to work across borders

European Union countries and the Commission have agreed on a technical framework to enable regional coronavirus contacts tracing apps to work across national borders.

A number of European countries have launched contacts tracing apps at this point, with the aim of leveraging smartphone technologies in the fight against COVID-19, but none of these apps can yet work across national borders.

Last month, EU Member States agreed to a set of interoperability guidelines for tracing apps. Now they’ve settled on a technical spec for achieving cross-border working of apps. The approach has been detailed in a specification document published by the eHealth Network.

The Commission has called the agreement on a tech spec an important step in the fight against COVID-19, while emphasizing tracing apps are only a supplement to manual contacts tracing methods.

Commenting in a statement, European commissioner for the Internal Market, Thierry Breton, said: “As we approach the travel season, it is important to ensure that Europeans can use the app from their own country wherever they are travelling in the EU. Contact tracing apps can be useful to limit the spread of coronavirus, especially as part of national strategies to lift confinement measures.”

The system will involve a Federation Gateway Service, run by the Commission, that will receive and pass on “relevant information” from national contact tracing apps and servers — in order to minimise the amount of data exchanged and reduce users’ data consumption, per a Commission press release.

From the tech spec:

The pattern preferred by the European eHealth Network is a single European Federation Gateway Service. Each national backend uploads the keys of newly infected citizens (‘diagnosis keys’) every couple of hours and downloads the diagnosis keys from the other countries participating in this scheme. That’s it. Data conversion and filtering is done in the national backends.

“The proximity information shared between apps will be exchanged in an encrypted way that prevents the identification of an individual person, in line with the strict EU guidelines on data protection for apps; no geolocation data will be used,” the Commission added.

The key caveat attached to the agreed interoperability system is that it currently only works to link up decentralized contacts tracing apps — such as the Corona-Warn-App launched today by Germany — or the national apps recently released in Italy, Latvia and Switzerland.

Centralized coronavirus contacts tracing apps — which do not store and process proximity data locally on the device but upload it to a central server for processing, such as France’s StopCovid app; the UK’s NHS COVID-19 app; or the currently suspended Norwegian Smittestopp app — will not immediately be able to plug into the interoperability architecture, as we explained in our report last month.

Apple and Google’s joint API for coronavirus exposure notifications also only supports decentralized tracing apps.

“This document presents the basic elements for interoperability for ‘COVID+ Keys driven solutions’ [i.e. decentralized tracing systems],” notes the eHealth Network. “It aims to keep data volumes to the minimum necessary for interoperability to ensure cost efficiency and trust between the participating Member States. This document is therefore addressed only to Member States implementing this type of protocol.”

The Commission has been calling for a common approach to the use of tech and data to fight COVID-19 for months. However national governments have not fallen uniformly into line — with, still, a mixture of decentralized and centralized approaches for tracing apps in play (although the former now comprise “the great majority of national approved apps”, per the Commission).

It’s also playing the diplomat — saying it “continues to support the work of Member States on extending interoperability also to centralised tracing apps”.

Although it has not provided any detail on how that might be achieved in a way that’s satisfactory for both app architecture camps, given associated privacy risks/security trade-offs of crossing opposing technical streams.

This means that citizens in European countries whose governments have chosen a centralized approach for coronavirus contacts tracing may find, on traveling elsewhere in the region, they will need to download another country’s national app to be able to receive and send coronavirus exposure notifications.

Even decentralized national apps aren’t able to exchange relevant data yet, though. The interoperability architecture’s gateway interface still needs to be deployed — and national apps launched and/or updated before all the relevant pieces can start talking. So there’s a way to go before any digital contacts tracing is working smoothly across European borders.

Meanwhile, some EU countries have already started to reopen their borders to other European countries — ahead of a wider reopening planned for the summer.

This week, for example, a few thousand German holidaymakers were allowed to travel to Spain’s Balearic Islands as part of a trial aimed at restarting tourism. So EU citizens are already flowing across borders before national apps are in a position to securely exchange data on exposure risk.