Reveries of a Human

Belgium's MyGov app does not work on GrapheneOS

Some background: MyGov.be is the official app covering all the federal public services in Belgium and allows access to official documents and works as an authenticator for official websites. In particular the authenticator function is important, as realistic alternatives are either using an e-ID identity card reader or Itsme, the latter being a collaboration between leading banks and telecom giants.

Oddly enough, the Android app - developed by the federal government using taxpayer funds - is fully reliant on Google Play Services. More recently, it flat out refuses to load if you use GrapheneOS. The official reason for this is 'security'. I cannot help but find this laughable, for the very simple reason that the same app can be installed on a device running Android 10 without security updates.

It is peculiar that the commercial alternative Itsme works perfectly fine on a device running GrapheneOS without Google Play Services. Either Itsme is taking an significant security risks, or the security concerns - assuming they are even valid - are greatly exaggerated.

It pains me to see Belgium (and the EU) spending billions of taxpayer funds in order to become 'more technological independent', while simultaneously developing new critical infrastructure which is fully reliant on the blessing of a US multinational, both for its installation (Google Play Store) and use (Google Play Services).

Are the developers to blame? In all likelihood not. Developing the Android app without Google Play Services dependencies requires taking managerial risks: the development cost will likely be higher if you cannot rely on the Google Play Services stack and, more generally, the ‘Nobody ever got fired for hiring IBM’-principle. If something goes wrong which could have been avoided by fully relying on Google Play Services, some manager will have to defend why this decision was made, especially if the actual userbase of GrapheneOS users was incredibly low. I would nevertheless argue that one of the key functions of a government in the digital realm is ensuring that its citizens can easily access its resources, even when those citizens happen to reject being surveilled by US multinationals.