The special commissioner for the health emergency, Domenico Arcuri, confirmed that the Immuni application for contact tracing will be ready “at the end of the month”, and not in the first days of May as he had announced last April. The creation of the app, which in its intentions should help reduce the spread of the coronavirus epidemic in Italy, is significantly delayed due to some hesitations by the government and requests for technical and bureaucratic investigations by institutions and control bodies.
Contact tracing
During an epidemic, contact tracing is useful for identifying people who may have been infected with a contagion . It is a delicate job that is carried out by interviewing people who tested positive for the coronavirus, with the aim of reconstructing which individuals they came into contact with and were therefore exposed to the risk of contagion. The operation requires time and adequately trained personnel, resources that are scarce during a pandemic.
To mitigate the problem, in recent months applications have been proposed and tested around the world that exploit various technological solutions and which should allow for more widespread and above all almost automatic contact tracing. Many of these solutions involve the use of smartphone applications designed to periodically check if you have been in contact with someone, who then tested positive for coronavirus.
The actual usefulness of these systems is still not completely clear, but the first experiences in some Asian countries such as South Korea have given some positive results, however, raising numerous privacy concerns. Interest in contact-tracking apps increased in mid-April, when Apple and Google announced they were working to put some sort of standard into the iOS and Android operating systems to make it easier to build contact tracing apps.
Immuni
The contact tracing via application in Italy must be carried out by Immuni, the application chosen by the government on April 16th and which was proposed by Bending Spoons, a company based in Milan and with a strong presence in the app market with some national successes such as “Live Quiz” and numerous other successful applications on the international market. The app is developed in collaboration with the Santagostino Medical Center (CMS), which in recent years has opened numerous clinics in Lombardy and Bologna, offering healthcare services at affordable prices and with a digital-oriented approach for patient management (reservations, payments, online assistance and medical records).
Things to know about coronavirus The Coronavirus Post newsletter updates you on the latest news: it's free and arrives every Thursday at 6pm. To receive it, write your email address here and press the button below. Having read the information, I agree to send the Newsletter The idea behind Immuni follows the prevailing one for digital contact tracking. Through the app, each smartphone periodically emits a unique and anonymous identification code (ID), which can be picked up by other smartphones that use the same app nearby, within a few meters. Data transmission takes place via a variant of Bluetooth technology (BLE), similar to the one we use when we connect wireless headphones to our smartphone. If one of the owners of the app reports that they have tested positive for coronavirus, the system allows you to notify the people they had been in proximity to in the previous days, so that they know they may have been infected (thus perhaps choosing to stay at home too. if they have no symptoms, and to consult your doctor).
According to the information circulated so far, Immuni will only use Bluetooth and will not keep track of its movements via GPS. Each smartphone will keep in an internal register, not shared with others, the IDs captured by the cell phones in its vicinity. It is still unclear how users who find they are positive will report their condition, nor if what they claim will be verified by health authorities before being marked positive for coronavirus.
The system is effective only if a large portion of the population installs and uses the application, and for this a promotion and awareness campaign on the subject will be required, on the modalities of which there is still no information.
The choice of Immuni
In the last few days, details have emerged on the modalities that led the government to choose Immuni, setting aside the other proposals received, and then accumulating the delays.
At the end of March, the Minister of Innovation, Paola Pisano, had launched a “quick call” for the identification of the app to be used for contact tracing: the idea was to act quickly in a phase in which Italy was in full emergency health care with hospitals crowded with COVID-19 patients and intensive care beyond their capacity.
Having received the applications, Pisano had set up a “task force” of 74 experts, divided into different groups, with the task of evaluating the proposals and providing indications for the choice of the app to be developed. Also in this phase the importance of acting quickly was highlighted, but many observers had raised doubts about the timing, given the large number of experts called to work on the selection. After some delays, in mid-April there was an acceleration with Arcuri's announcement on the choice of Immuni, which however surprised some of the experts who had chosen Pisano.
The reports prepared by the working groups had in fact provided more cautious indications, and advised not to follow a single approach for developing the application. To get an idea, it is sufficient to consult their reports, made public in an online archive (GitHub), in which it was suggested to choose two applications, in order to have a backup solution in case there were problems with the first.
In the report “Use of digital contact tracing technologies”, working group number 6 had explicitly indicated the need for redundancy:
In order to be able to adopt the most effective technological solution for contact tracing as an important component of the set of measures that must be implemented for the management of the emergency and post-emergency situation, a careful yet fast process of validation and implementation of the chosen technological solution, which guarantees the achievement of the expected objectives. For this reason, the implementation process should include the parallel test of the two identified technological solutions: Immuni, as a solution that appears at the outcome of this first more adequate assessment and CovidApp, as a good alternative and / or backup solution. .
The proposal was to develop and test both applications, in order to evaluate their strengths and weaknesses and then be able to focus on the most promising one. The report, however, signaled a state of development at a more advanced stage of Immuni than CovidApp, but did not exclude that both could be subjected to a test phase of about ten days before proceeding with the choice. All this took place in the first days of April, when the government still maintained that an application could be made in time for the start of the so-called “phase two”, which began last May 4. Things obviously went differently, as a contact tracking app is not yet available.
The quick call announced by Pisano had led to the presentation of over 300 proposals in a couple of days, quickly evaluated and skimmed up to 15 potential candidates. The working groups then worked on the evaluation of each proposal following different criteria, from the realization in certain times to the technologies used, finally arriving at five candidates:
• Immuni , of Bending Spoons with the collaboration of the company Geouniq specialized in geolocation systems and the Santagostino Medical Center;
• CovidApp , the result of a collaboration between computer scientists and based on open code and available to all;
• SafeTogether , supported by Microsoft;
• TrackmyWay , created by the Lombard company Antares Vision specialized in GPS technologies;
• ProteggInsieme , proposed by Whatif and with a setting that follows the app used with mixed results in Singapore and which is called TraceTogether.
Times
After evaluating the progress of the works and the quality of the proposed solutions, the experts had finally chosen Immuni and CovidApp, recommending their development in parallel to have precisely a stock solution. The hypothesis was to make preliminary versions of the apps within twenty days for the first tests, followed by tests open to specific groups of people (such as Civil Protection personnel) in limited geographical areas.
However, on April 16 it became clear that Pisano intended to select a single application, perhaps in order to shorten the time. Immuni was therefore chosen between the two options, with confirmation by Arcuri on the evening of the same day.
Delays
The development of Immuni is proceeding slowly, compared to what is projected by the reports of the experts, due to various technical insights that the government wanted to carry out and which seems to have been underestimated in a first phase. Until app features and specifications are decided, Bending Spoons will not be able to complete system development.
The delays accumulated when it became evident that the government still did not have clear ideas on how to proceed to ensure the security of the system, both from an IT and privacy point of view, given that information on people's health will have to be managed.
After some internal discussions, it was decided to involve the two public companies Sogei and PagoPa, in order to try to keep the control of data within the State as much as possible.
Sogei (General Information Technology Society) is controlled by the Ministry of Economy and deals with the development of information systems for the public administration, such as the recent system for the so-called “730 precompiled”. The company should take care of the management of the infrastructure on which Immuni will run, making sure that smartphones periodically receive updates on the application users who have tested positive, so that other users who have come into contact with them can receive warnings about having been exposed.
PagoPa would have a coordinating role for the initiative, especially as regards the resources to be allocated to the creation of the infrastructure to manage the application by the parties involved.
Sogei and PagoPa should allow data management to be kept internal to the State, thus offering some more guarantees for privacy to users, as also requested by the Guarantor for the protection of personal data. Arcuri also explained that the sole responsible for the management of personal data will be the Ministry of Health, and that all information will be removed at the end of the health emergency.
What Paola Pisano says
In recent days, Minister Pisano participated in a hearing of the Parliamentary Committee for the Security of the Republic (COPASIR), the Parliament that is responsible for controlling the activities of the secret services in our country. Pisano explained that the government chose Immuni – leaving out CovidApp despite the advice of the experts – because he believed that this could reduce the time and also the costs of the initiative. Pisano added that this choice had been shared by the Ministry of Health and that of the Interior, with the involvement of Gennaro Vecchione, head of the Information Security Department (DIS).
Vecchione, however, provided COPASIR with a different version: he claimed to have been consulted when the choice for Immuni had already been made. Its involve also took place to design the application security assessment phase, in order to verify the possible need for new interventions to make it more secure from cyber attacks.
Next week COPASIR will listen to Pisano and Vecchione again to compare their versions, and receive some more explanations on the conflicting information they provided.
Changes in the race
Many observers have pointed out that in recent weeks there have been numerous delays on Immuni, mostly due to the change of different positions by the government. For days it was discussed whether the system should be centralized, with a user registry connected to the app, or decentralized and therefore with almost all the data stored on individual smartphones. Finally, the choice fell on this second option, considered more practical and safe for privacy, but this led to new assessments on who should be the data manager.
The delays were also due to some technical innovations that emerged in recent weeks, especially following the launch of the Apple and Google project. The changes to their operating systems will make it easier to use Bluetooth and therefore the possibility of the various versions of the app to communicate with each other, even if installed on different operating systems. Pisano confirmed that Immuni will employ the solutions that Apple and Google are perfecting.
Bending Spoons initially joined the Pan-European Privacy-Preserving Proximity Tracing (PEPP-PT) initiative, a collaboration launched at European level to establish common solutions for contact tracing, with particular attention to user privacy. The project was promoted by Chris Boos, an entrepreneur in the German government advisory groups for the digitization of Germany, but has lost credibility and relevance in recent weeks following several allegations of lack of transparency. Bending Spoons no longer appears on the initiative's partners page, but has maintained contact with Boos. Immuni is in fact based in part on Bluetooth technologies for contact tracing created by Arago, a company based in Germany founded by Boos himself.
Membership of PEPP-PT had been rated very positively by the groups of experts who had to evaluate the applications, because at least on paper it seemed to offer a system shared between different countries for tracing contacts. At the time of writing their reports, the criticisms against Boos for lack of transparency had not yet emerged, but the fact that Immuni had links with a company of the promoter of the same PEPP-PT raised some perplexities.
What happens now
After declaring that Immuni would be ready for the first days of May, Arcuri recently claimed that the application will be made available at the end of the month, but gave no other details. Right now Bending Spoons and its partners are waiting for clearer guidance from the government on the features to be developed within the application: in the absence of this information, there is no way to continue development.
There are still many outstanding points and the government is not providing timely information or updates: it is not known exactly how the decentralized system will work, it is not clear whether it will be up to individual users to report that they have discovered that they are positive and how, not there are details on any involvement of the National Health System to manage the reports and it is not known what other functions the application may offer by exploiting, for example, the other IT infrastructures of the public administration (for example via SPID).
Whichever technological choice will be made, contact tracing will still work only if the government draws up a coherent and effective plan. The experience of South Korea has shown that contact tracing is a useful resource only if integrated into a much broader strategy for detecting infections. As the Istituto Superiore di Sanità, which provides scientific advice to the government, has also reported on several occasions, an application must complement a structure capable of carrying out many tests among the population to detect positive cases and then go to research of the people with whom they came into contact, in order to reduce the new chains of infections as much as possible.
