ME and the Tracers

This is a text automatically translated from Italian. If you appreciate our work and if you like reading it in your language, consider a donation to allow us to continue doing it and improving it.

The articles of Cassandra Crossing I'm under license CC BY-SA 4.0 | Cassandra Crossing is a column created by Marco Calamari with the "nom de plume" of Cassandra, born in 2005.

Of this excellent article by Cassandra we would only like to add that the application I, unlike for example CieID, works without Google services active.

This article was written on June 6, 2023 from Cassandra

Cassandra Crossing 545/ I and I tracers

The IO app is entering ordinary use, and the executive has big expansion plans for it. But how is his respect for fundamental principles?

Don't worry, this is not an article about Cassandra's personal concerns about tracers, and not even a rumination on the recent launches of space missions towards the moons of Jupiter (and the only one that will not be explored).

Instead, it is a short note for us and, with the utmost respect, for the Guarantor, on the current state of the IO app and its future developments.

In fact, the IO app will soon be used for experiments on the future European wallet of Italians' credentials; with the prospect of the IO app becoming the Italian implementation of theEuropean Digital Identity Wallet Cassandra would like to be reassured... or rather, no, Cassandra claims to know the suitability of the IO app for such an important task; for starters, on the privacy and security fronts.

In fact, IO is well known for containing three libraries tracers, Google Firebase Analytics, MixPanel and Facebook Flipper; contained them on September 27, 2022, in version 2.15.0.4, and at the current version 2.33.0.2 still contains them.

Precisely, on September 27 last year Cassandra's alter-ego, while trying tosolar the IO app using Shelter, had found those tracers, and promptly reported via PEC to the Guarantor for the Protection of Personal Data.

There was no response, but this is entirely reasonable given that reports do not necessarily require a response, otherwise a complaint must be made. It is even more reasonable, given that the Guarantor unfortunately has very limited resources, and is overburdened with tasks and responsibilities.

But adoption of the IO app is growing, and planned future developments could make it the cornerstone of Italians' digital lives. Sorry if it's not much.

For this reason, maximum attention must be paid to this app, and it must be noted that after nine months the situation of tracers still hasn't changed, it should raise some alarm.

Yes, Cassandra knows perfectly well that system crashes must be analyzed, that user interactions must be studied to optimize the app itself (do it, given that for now it is decidedly cumbersome and not very intuitive), and that some information, given the role of the application, must be tracked.

But should this be done with the libraries of personal data collecting companies based outside the EU (and more precisely in the United States), especially in light of the SCHREMS II ruling of the European Court of Justice?

Furthermore, considering that the information publicly available on the app does not inform the public about:

1) The actual need for the processing carried out by the aforementioned libraries in a non-commercial app that aims to centralize the delicate relationships between citizens and Public Administrations;

2) the minimization of data processing carried out by these libraries;

3) the possible export of personal, particular or sensitive data, both actual and potential, to areas outside the EU and in particular to the United States.

And also given that the FAQs and licenses contained in the app are very generic (to use a euphemism) and "authoritative", and never go into the specifics of the information flows of an application which can already contain payment methods , a question arises spontaneously:

When very important problems of the IO app, such as those of tracers, and the privacy of citizens' data, will they receive information and answers worthy of the role envisaged for this app?

Marco Calamari

Join communities