software privacy gdpr security governmental-liability
Covid tracking app, forcing citizen to install it on insecure devices
<p>Here's the hypothetical scenario, which in some countries might not be hypothetical after all:</p>

<ul>
<li><strong>The app.</strong> Because of Covid-19, the government decides that some citizens must install an app on their smartphones to track the spread of the virus. It might not really be mandatory for everybody, however there will certainly be some citizens that will be required to have the app installed on their phones.</li>
<li><strong>The security.</strong> The app relies on bluetooth connections to be able to detect another person when a citizen is close to them. A lot of people own smartphones that are insecure because they are not up-to-date. In many cases they cannot even be updated because the vendor doesn't release the security patches on time, or the vendor only provides support for a few months after the purchase. Bluetooth is known to have had vulnerabilities in the past, and the latest one was fixed a couple of months ago. Examples: <a href="https://arstechnica.com/information-technology/2017/09/bluetooth-bugs-open-billions-of-devices-to-attacks-no-clicking-required/" rel="nofollow noreferrer">December 2017, billions of devices imperiled by new clickless bluetooth attack</a>, and <a href="https://www.zdnet.com/article/google-fixes-no-user-interaction-bug-in-androids-bluetooth-component/" rel="nofollow noreferrer">February 2020, Google fixes no-user-interaction bug in Android's Bluetooth component</a>. They can be pretty serious, and citing the last article, "if left unpatched, the vulnerability can be exploited without any user interaction and can even be used to create self-spreading Bluetooth worms, experts said." Yes, it is very ironic: an app developed to control the spread of a biological virus might lead to the spread of a software virus, by proximity! Very ironic.</li>
<li><strong>The precautions.</strong> The goverment and the app developers take no precautions to avoid the above-mentioned risks. The app will install and run without any warnings if the device is not up-to-date. The government doesn't warn the citizens that such application must only be installed if the device is up-to-date, and doesn't require citizens to buy a new smartphone if the current one cannot be considered secure. So unless a citizen is particularly tech-savvy, they won't have a clue they are exposing their personal data to a risk when they turn bluetooth on. On the other hand, a lot of people are clueless anyway and probably already have bluetooth on right now.</li>
</ul>

<p>The question is: is this legal? I'm not sure how much the GDPR is relevant here, because the app might not process much personal data. These kinds of apps might just exchange pseudonymous IDs, and might not record much data other than that. However the app will be installed in a system that is full of personal data (the smartphone), even sensitive personal data (think of emails, messages, social media), so it definitely has an impact on the overall security.</p>

<p>Jurisdictions: EU (but I'm also curious about the US, for comparison).</p>

<p>If and when some sort of contract tracing app becomes a key public health tool and is made mandatory in an EU member state, it would almost certainly be through some <em>ad hoc</em> law, possibly using emergency powers that parliaments have granted to the executive in several countries. That would set aside most existing legal hurdles and makes it difficult to think about the legality of such an app in advance.</p>

<p>Of course, even a very broad national mandate would still formally need to comply with EU law and possibly be open to some constitutional or ECHR challenge. But it's difficult to see how these could be invoked based on a theoretical impact on a limited number of phones. It should also be possible to dispose of many human rights objections with a proportionality argument and I suspect most courts would be happy to accept it.</p>

<p>Interestingly, article 23(1)(e) of the GDPR empowers national governments to set aside many obligations in the name of, <em>inter alia</em>, public health so the possibility to redefine what's legal or not at the national level is baked in. These restrictions are not absolute however and, in particular, do not cover articles 24, 25, 32 and 33 (which all have to do with data protection and security). Several governments could also seek some changes or a temporary regime at the EU level, as they are currently trying regarding Regulation 261/2004 on flight compensation.</p>
