Thread by @mikarv

The Luca QR code Covid app, (for-profit system flogged to 🇩🇪 Länder) has been compromised (in a way that the official CoronaWarnApp’s QR system can’t be), through a website that lets you check in any phone number to wherever you want—even regional prime ministers! 🧵 on the saga:

https://twitter.com/peng/status/1389420397586694149

While hard to believe, Luca was adopted by Länder after huge lobbying from hospitality who convinced them that a hasty app w a 6 mo free trial for venues & big cost for health authorities would i) allow reopening, ii) help Länder win upcoming 🗳 by making national gov look slow

Luca’s slick PR campaign, where they became mostly known to health authorities by aggressive marketing w celebrities, meant that no-one discussed or scrutinised the technical details. Politicians have even admitted this, and DPAs accepted statements of ‘encryption’ as secure.

Despite it being an infrastructure they had no control or say over, local governments were already shelling out money which, in practice, was just subsidising Luca’s attempt to make a platform. It had even partnered with ticket companies! netzpolitik.org/2021/digitale-…

Luca was also careful to never mention the pandemic, coronavirus or COVID in its app description on app stores, as not to trigger extra checks (and in line with its platform dreams). Not that app stores should govern the world, but it betrays the firm’s mentality.

@thsStadler led an analysis of how misleading the app’s security claims were, even when you gave its under specified schematic (belatedly published) every benefit of the doubt arxiv.org/abs/2103.11958. A letter from hundreds of IT experts was published here digikoletter.github.io

If you speak 🇩🇪 or don’t mind translating, there’s an extensive and surreal thread on the Luca saga here from MP @anked

https://twitter.com/anked/status/1379665492739231744

More on some of the political and technical absurdity around Luca zeit.de/digital/datens…

There’s a legal angle too. Unlike in England, where the law states that those using the official QR code that permits notification do not need to manually provide details, in Germany, regional laws (eg Bavaria GVB 562 (23 June 2020) s 3 verkuendung-bayern.de/baymbl/2020-56…) do not permit this

(I’ve written on the English QR code legal regime here michae.lv/law-of-qr/)