A summary on Immuni

This is a text automatically translated from Italian. If you appreciate our work and if you like reading it in your language, consider a donation to allow us to continue doing it and improving it.

We waited until today to write something about the Immuni application because the news was very confusing. We deliberately tried to avoid the effect FOMO (Fear ORf Missing ORut) on something so important. Now the waters have calmed down a bit, some things have been clarified and perhaps it is the right time to do something a summary on Immuni, the application of contact tracing chosen by the Government.

Let's try to do some order, also going back in time to understand how we arrived at what we are discussing today.
This article, like others of this genre, it is also and above all a good excuse for leave you lots of interesting links to read and share.

Let's start from April 16, 2020, when we discover through an ordinance that the application chosen for contact tracing is Immune, developed by the company Bending Spoons. There was a moment of initial panic because the resolution is really unclear and he never talks about Open source except to say that the code will be given to the State and that's it.

A summary on Immuni

The entire IT world revolts against this decision. In reality it was all very smoky, no one had ever openly talked about closed code. But no one answered the questions. They even started to circulate rumors about whether they would limit your movements of those who did not want to install the application.
Let's summarize: on April 20th all the clues led us to believe that Immuni it would have been a state surveillance application to closed code, pseudo-obligatory And with a centralized server.
The problem was this. Not the contact tracing application itself, it is really important to understand this difference. In Norway, for example, they have made a closed code application and it didn't go very well.

The April 21st (5 days later) Minister Pisano publishes an update on the application Immune. Where it is explicitly said that the code will be Open source and precisely under license MPL 2.0. For some this is good but not great (more effort could have been made with an AGPL3 license) and, in fact therefore, this is not free software. However, it is a huge step forward compared to what was initially hypothesized.

A summary on Immuni: it will be Open source and decentralized!

Pisano's update is important because it also specifies that the protocol has not yet been decided, when instead the first rumors they were talking about using the PEPP-PT protocol. The choice of protocol is the second crucial point of this operation. Let us try to summarize further:

With the protocol PEPP-PT all data is managed by a centralized server which, once the presence of a possible infected person has been revealed, sends a warning to everyone.
Nobody who cares about people's privacy at all likes this system. The possible problems are enormous and a any dangerous data breach is around the corner (and in Holland it has already happened).

All other protocols, however, they are decentralized. Included that of Google and Apple. What does it mean? It means there is always a server behind everything (in fact, no one has ever talked about blockchain), the difference is where the data resides. The data remains on your mobile phone and it will be the application (and not the server) that tells us that we have come into contact with someone possibly infected. The difference is enormous: in this way the risk it's only on the single device, not on the server. You could get a malware that steals all your data, but this malware will not be able to access the data of all Italians.

Finally, the update of the last few hours formalizes the use of a decentralized protocol. Hurray! (⌐■_■)

But what happened?

How did we get to all this? Nobody knows. Many speculate that these were not the initial plans and everything changed on the fly Stefano Epifani or Raffaele Angius who rightly asks: “Because this app looks like we're making it on Twitter. And it is terribly similar to other projects that were rejected from the tender“. In short, why was Immuni chosen if there were other applications that already had these features from the beginning?
Because Immuni was born in a different way and now things are changing on the fly. The sun 24 hours Indeed He says That the beta version of Immuni uses a centralized server.
The COPASIR will also investigate this, it is in fact essential "verify in depth the relationships, especially economic and financing, that the company awarded the contract for the creation of the app has established in recent years“.

Another interesting thing to read is the nice thread/rant by Matteo Flora.

Facebook games have nothing to do with it

In all this chaos, then, we also had to take stock with those who complain about those who want to protect privacy. Like the professor for example Burioni when he says that: “This is not the time to fuss over privacy” or the economist Cottarelli: “Never mind if anyone knows... where I go shopping“.
Don't misunderstand: they are both among the best professionals in their field. However, Burioni, for example, has always complained about people talking about things they don't know and the fact that he is an excellent virologist it does not automatically also make him a constitutional expert or data protection expert. It's an important thing: the principle of authority it must always be rejected, not only when it is convenient. Furthermore, and it is important to underline this because many have brought up the topic, Contact tracing has nothing to do with Facebook games.

The problem, in fact, it's not a choice between sacrificing privacy and fighting the virus. The problem is doing something that respect privacy And at the same time you help us fight the virus. You can do both and there's really no reason to sacrifice privacy in favor of a similar application.

A summary on Immuni, the words of Antonello Soro

It is for this reason that, instead, we waited the words of Antonello Soro, current President of the Guarantor Authority for the protection of personal data. Furthermore, we are pleased that even someone like Shy (from Breaking Italy) you think this way.

We had also spoken to you in the past about the doubts ofEFF (a authority when it comes to online privacy). Very active translated that article, here it is for those interested.

Finally, we leave you with the Wikipedia page of all COVID-19 applications in the world to be able to make some comparisons.

Join communities