Tech Friend: Choosing apps for technological sovereignty

Tech Friend is our advice column covering cybersecurity, privacy, and everyday technology. Email your question to techfriend@expressvpn.com. If you have questions about your ExpressVPN subscription or need troubleshooting help, please contact Support.

Late last year, the French government banned employees from using WhatsApp, Telegram, and Signal. Are their claims of “security vulnerabilities” credible? Government workers are instead encouraged to use Olvid and Tchap, both from France, as alternatives. How do they compare against the banned ones?

Submitted by: Brad

France has probably banned the most apps on government devices than any other low-censorship country. On the banned list are Candy Crush, Netflix, Twitter, TikTok, Instagram, Snapchat, and dating apps. These services can be seen as time-wasters and highly distracting—which is why the banning of reputable messaging apps WhatsApp, Telegram, and Signal came as a greater surprise. 

French officials have mentioned “security vulnerabilities” as a concern with the messaging apps, but the reasons and issues behind the mandate are more complex.

Why are some apps banned on government employee devices

There are various types of app bans for government workers. It’s widely publicized that TikTok is banned on government devices in Australia, UK, India, Norway, Canada, and many other countries. The claim is that TikTok, owned by a Chinese company, poses national security and espionage risks for other countries through its data collection.

In the example of France, however, the latest ban is on messaging apps especially known for security and privacy protections. And while security and confidentiality have been raised as concerns, the prime minister has also said the decision is a step toward “greater French technological sovereignty.”

Within the European Union in particular, technological sovereignty has become a growing focus driving countries’ decisions to encourage the use of homegrown apps.

Technological sovereignty: Why it matters

Technological sovereignty refers to a country’s ability to develop, control, and provide critical technology used by its own people in order to avoid reliance on foreign suppliers. When no such technology is available, then the preference is for products from reliable allies. Discussions about technological sovereignty intensified—especially in the EU—during the height of the Covid-19 pandemic, when many supply and value chains were disrupted.

There are several risks with a population overly relying on apps or devices made by a foreign countries:

Loss of access. If countries have a falling out or there’s some kind of supply chain disruption, that puts the population at risk of no longer having access to those products they’ve come to rely on. 

Foreign interference. If people are very reliant on a foreign product, that means to some degree, that foreign country has control over those people and can make decisions that will affect them. 

Economic effects. The countries that aren’t producing the latest tech could fall behind in innovation and entrepreneurship, negatively affecting the local economy. Staying competitive is a major driver for technological sovereignty.

National security. Data privacy and cybersecurity become concerns, as app and device makers have access to user data and, potentially, their sensitive information.

In the face of these risks, it’s no wonder that some countries are pushing for greater use of homegrown tech products. The primary method to support technological sovereignty is money—governments injecting funding for research and innovation. 

However, this could mean limitations for users who must contend with bans of apps that they might actually prefer to use (although in most countries it’s mainly government workers who are affected so far).

Do WhatsApp, Signal, and Telegram really pose security risks?

WhatsApp and Signal are regarded as two of the most secure messaging apps, thanks to their use of end-to-end encryption. E2EE means no one can intercept communications, not even the service providers themselves; only the sender and receiver can read them. 

Telegram does not use E2EE by default, but it does offer end-to-end encryption for one-to-one calls and messages if you select the Secret Chats option. Telegram is still considered secure through other forms of encryption. 

Both Signal and Telegram are open source—an important factor that greatly enhances their reputations. WhatsApp is owned by Meta and it collects data on how you use the app, so this does pose some privacy risks.

Read more: Signal vs. Telegram: Which is better?

The most important aspect about France’s choice of Olvid and Tchap is that they are French-made apps, meaning from a national security standpoint, the risks are reduced for French users. The French government can also more easily vet them for security robustness. Moreover, other French tech companies would be encouraged to step up their products, with the view that they will be similarly favored and supported by their own country.

Tchap is designed and managed by the French government and is only used for internal communications between government members. As for Olvid, it stands out by not requiring any user information, not even a phone number, to use it. Users add contacts by scanning each other’s QR codes or by sending an invite link. With this system, no personal information is ever sent to the app maker’s servers. Moreover, messages sent over Olvid are end-to-end encrypted.

If you are French and support the country’s goals of technological sovereignty, then Olvid would make sense for you. But there are very few reasons to claim security risks of using WhatsApp, Signal, or Telegram, other than the fact that they are foreign products. And with much larger user bases for the mainstream apps, you’ll certainly find greater convenience in using them to connect with friends and family around the world. Some would also argue that the longer existence of a product like Signal is reason enough to trust it more than Olvid for now; new apps need to prove themselves over the long run.