Connectivity and territorial sovereignty

In his book Connectography, Parag Khanna pronounced the end of the Westphalian world of states with territorial sovereignty, and the start of the supply chain world consisting of global physical and digital infrastructures [1]. The term “Westphalian” refers to the peace of Westphalia of 1648, which ended the 30-year war in which European powers and kingdoms fought each other for dominance. No one could win. In the peace treaty European states promised to respect each other’s territorial sovereignty.

Covid-19 has proved Khanna wrong: Populations everywhere have turned to their local government to seek protection from an invisible enemy. Governments used their territorial sovereignty to issue and enforce rules of social distancing and self-quarantine.

And Covid-19 has proved him right: the Sars-Cov-2 virus travels to any place in the world in a day through our airway infrastructure. High-tech companies at the other end of the world develop a contact-tracing infrastructure that will be in your pocket regardless which country you are in, other than China.

The virus shows us that we live in a supply chain world. National responses to the virus show that we live in a Westphalian world. The essential problem we face is how to combine the two.

Let’s look at some of these responses. I start with the territory I live in: The Netherlands.

What happened in the Dutch polder

On  April 7, the Dutch minister of health announced that the government would develop a contact-tracing app to help control the spread of the disease. Privacy watchdogs were quick to raise alarm and researchers aired their concern about technical feasibility.

The government issued a call for tender on Saturday, April 11, the start of Easter weekend, with a closing date of Tuesday, April 14, the day after Easter. Over 700 proposals were submitted, out of which seven were selected by a team of experts who complained about the extremely short time available.

The seven apps were tested by the experts in the weekend of April 18 and 19, in an “appathon” that was streamed so that everyone could follow what happened. The online public could ask questions too. All proposals were rejected, one app inadvertently leaked data, and several experts left the committee because they could not take responsibility for the outcome.

Following the announcement of the app there was growing stream of protest, including an open letter sent to the government by concerned scientists on April 13 and a parliamentary hearing on April 22, where experts raised doubts about the technical accuracy, social desirability and legal acceptability of the app.

On April 21, the government rejected all proposals and announced the formation of an interdisciplinary expert group who would develop the app in a month.

Clearly, there is no time for the lengthy consensus-seeking process that the Dutch are used to. The government is in a hurry. It has set a goal, put the ingredients in a pressure cooker, and turned up the heat.

What did the neighbors do?

The neighbors did the same. Remember that in this connected world, most countries in the world are each other’s direct neighbors. The Far East is the near east, and the Near East is next door too. Singapore, Taiwan, South-Korea and Israel have introduced tracing apps in short order. Germany, France and the UK, among others, are developing one at high speed.

Meanwhile, European academics and business stakeholders united under the umbrella of PEPP-PT (Pan-European Privacy-Preserving Proximity Tracing)  have developed a centralized privacy-preserving solution. A group of security researchers have left PEPP-PT and started DP-3T (Decentralized Privacy-Preserving Proximity Tracing) with better privacy-preserving properties. There is a consensus among security researchers that decentralized solutions are the way to go.

At the other side of the world, Apple and Google published a decentralized solution similar to DP-3T that will run on both their platforms. This is not even next-door, it happens on the smartphones in our pockets. France, which is developing its own centralized contact-tracing app, has asked Apple and Google to make contract tracing data available to the government but Apple and Google have refused to do so.

Tech companies defending our privacy? Time to pause.

How to manage contact tracing chaos

The efforts of European governments may result in 27 different contact-tracing apps in our pocket. Plus a few more if we travel to our neighbors outside the European Union. But it does not have to be this way.

Apple and Google will make their solution available as a framework on top of which 3^rd parties can build their local solution. This will take a few months, there is plenty of testing to do. A simple way to reduce the contract tracing chaos is to build interoperable apps on top of this framework. This may reduce the number of apps to two: one for China and one for the rest of the world.

Putting that as the point on the horizon, a good way to start is for the European Union to create the legal framework for app development and deployment. Since the GDPR, the EU is world champion privacy protection. The EU is not an object of great loyalty of its citizens but it has proved its worth as protector of human rights. It can reassert its worth in the control of the Corona pandemic by facilitating the development of interoperable national apps based on Google & Apple’s infrastructure. It can ensure compliance to privacy-protecting protocols such as DP-3T and make sure the app is certified and audited. As a bonus, France may be reined in too.

For once, Europe and big tech can cooperate. Google and Apple will love the positive PR generated by a joint effort to control the pandemic.

Infrastructure power

In the 30-year war, European monarchs fought each other to exhaustion. Nobody won. The states that emerged from this played a game of military power balances for several centuries.

In the infrastructure world, power is not defined by guns but by economics. France cannot win its battle with Google & Apple to control information, even though France has an army of soldiers and Google & Apple do not. The power of big tech is created by the size of their user base and their wealth, and is effectuated by an army of lawyers that they can put in the field.

A mere country like France has trouble fighting this army. The European Union by contrast has the economic power to balance the power of big tech. As it has done before, it should use this power to create the legal framework for the development and use of technology, in this case of a privacy-preserving contact tracing app.

Managing contact misinformation

As I wrote in my previous blog, introducing a contact-tracing app is a technology imperative. At this point in time, the obstacles to achieving accuracy of Bluetooth and the uncertainties about the social impact of the app are not encouraging. This has not held back governments to introduce the app. That is an extra reason for the EU to create legal protection against possible misinformation generated by the app.

[1] P. Khanna, Connectography. Mapping the Future of Global Civilization, Random House, 2016.