The contact tracing application Radar COVID is in the crosshairs of the Spanish academic community. More than a hundred experts from various disciplines. Among them, Josep Domingo Ferrer , director of the UNESCO Chair on Data Privacy and the Center for Research in Cybersecurity of Catalonia; Itziar de Lecuona , Unesco Professor of Bioethics, University of Barcelona and member of the Multidisciplinary Working Group of the Ministry of Science; Ramón López de Mántaras , Research professor and founder and former director of the Institute for Artificial Intelligence Research at the CSIC; Daniel innerarity, professor of political and social philosophy and director of the Institute of Democratic Governance or José Molina Molina , president of the Transparency Council of the Region of Murcia. Also two members of the Artificial Intelligence Advisory Council of the State Secretariat for Artificial Intelligence (SEDIA): Carme Torras, research professor at the Robotics Institute of the CSIC-UPC, and Ricardo Baeza-Yates , Director of Data Science at the from Northeastern University in Silicon Valley and professor at Pompeu Fabra University.
All of them have signed a manifesto “in favor of transparency in public software developments”. The reason is the “ absence of documentation on the design of Radar COVID , on its implementation and on the integration process of the Autonomous Communities”, as well as the non-publication of the code on which it is developed. The signatories also fear that this way of proceeding creates a precedent that they qualify as damaging for the correct democratic functioning of the digital infrastructure.
The claim is not new: academics and privacy experts, activists and the media have been calling for more transparency for months . Radar COVID, which already has more than 3.4 million downloads , has been in the making since April . According to the Government, it was successfully tested in a pilot test on the Canary island of La Gomera between June 29 and July 31. Three days later, SEDIA announced the results and discussed the possibility that the appwas ready for use in various autonomies from August 10, something that was not fulfilled. For this, each autonomous community had to integrate its health system with Radar COVID, following a protocol that was notified after that date. Regardless, the app was already available for download on Android and iPhone mobiles.
Throughout this time, there have been requests to SEDIA to make public both the ins and outs of the application and the specification of the contract with Indra for its development, as well as the methodology used for the La Gomera pilot and more details about the results. The information has not yet arrived, although with regard to the code, SEDIA assured that it would be published in September . This has been criticized by the developer community for being an impediment to alerting about possible errors in the design of the app before causing possible damage. For example, thanks to the fact that the app codecontact tracker was open, a citizen discovered that it was sending users personal information to Google and fixed the bug .
In addition, Radar COVID is based on DP-3T technology (developed by the Spanish Carmela Troncoso and her team at the Federal Polytechnic School of Lausanne, in Switzerland), which is under the MPL 2.0 license . This license obliges whoever uses said code to share the parts of it that have been used and their modifications. In other words, the Government is obliged to make them public, something that it has not yet complied with.
Faced with this situation and given that the imminent release of the Radar COVID code is expected, the signatories in the manifesto that is now published request, among other things, that a repository be made public with the code that allows analyzing the version of all the elements of the system and future changes, as well as details about its deployment, governance and security measures adopted; the repository of the code used during development, including history from inception; a system design report with the analyzes that have led to the decision on the configuration parameters and use of the Google and Apple Notifications Exposure API, and the evaluation of the inclusion and accessibility of the design; a detailed report of the application’s monitoring mechanisms and to ensure privacy and compliance with data protection regulations and, finally, an impact assessment on data protection based on the design report and the analysis of risk associated with the application.
The signatories emphasize that, for the purposes of transparency, it would be desirable to clearly identify the involvement of private entities along with their role and responsibilities in the project. They also highlight that Radar COVID should always be considered as a support measure and not as a substitute for manual contact trackers and other measures to contain the pandemic. They also emphasize that, to guarantee the impact of Radar COVID, “it is necessary to adopt legal and budgetary measures of social support that allow users to follow the recommendations of the appwithout suffering economic, labor or social damages ”. Something to keep in mind, given that a large part of the population could not comply with an effective quarantine if necessary. The percentage amounts to 46%, according to a survey by the Data Science for Covid-19 group , led by the commissioner of the Presidency for the Valencian Strategy for Artificial Intelligence, Nuria Oliver.