On Contact Tracing and Hardware Tokens | Hacker News Reader

On Contact Tracing and Hardware Tokens

bunniestudios.com

70 pointsrvense18 comments

> With exposure notification, carriers with mild to no symptoms such as Person 1 would get misleading notifications that they were in contact with a person who tested positive for COVID-19, when in fact, it was actually the case that Person 1 gave COVID-19 to Person 4. In this case, Person 1 – who feels fine but is actually infectious – will continue about their daily life, except for the curiosity that everyone around them seems to be testing positive for COVID-19.

I didn’t completely understand the part I’ve quoted in italics. Why would Person 1 just go about their daily life after being notified of an exposure? Isn’t the purpose of notification meant to be used by responsible people who will isolate themselves? If people won’t be responsible (which is common), then how would a full graph tracing scenario with a hardware token with no GPS be accurate enough or more effective in comparison? People in those scenarios could also behave irresponsibly, including not carrying the tokens or not checking for exposure.

I’m sure I’m missing something very basic in this article.

That's my read, too. I think they are in error, at least the way described. Maybe what they are trying to say is that Person 1 wouldn't think they were the cause, and so wouldn't register on the app as having Covid, and so they wouldn't be backtraced further to notify others? That makes more sense.

Yes, that is the meaning. Person 1's individual time line looks like this to Person 1:

- Person 1 contracts the virus, becomes infectious, but shows no symptoms.

- Person 1 gives the virus to Person 4.

- Person 4 becomes ill and shows symptoms, thus seeking testing.

- A positive test result causes Person 4 to report the exposure. This causes their key to be flagged in the exposure database.

- Person 1 downloads the updated exposure database and then receives a notification that they were exposed due to a match to Person 4's key.

- The next step is up to Person 1. However, a perfectly reasonable scenario is Person 1 now thinks, "I feel fine, but I will be extra vigilant and in case I feel symptoms I'll go for testing right away!"

In this case, Person 1 would never register on the app as positive because as an asymptomatic carrier they would never suspect they have the virus, and thus never go for testing even though they are infectious.

Without the graph, Person 1's subjective timeline is probably much like this:

"Oh, that Person 4, whom I met five days ago, has become infected. However, at that time she probably wasn't infectious and I'm showing no symptoms anyway."

My reading of this, in context with the previous bit, has a subtle difference:

With contact tracing, you get contact data from person 2 and you keep that data. Then you get contact data from person 3, and you keep that data too, and by the time you get to person 4, you have fairly strong evidence that person 1 is an asymptomatic carrier and you can do that without quarantining anyone asymptomatic.

With exposure notification, you get contact data from person 2, and tell everyone they were in contact with, and then throw away that data. Then you get information from person 3 and you notify everyone they were in contact with, and then throw away that data too. As a researcher, even after person 8 you don't have any evidence that person 1 is an asymptomatic carrier (because you threw that evidence away at each step) and the best responsible asymptomatic people can do is assume they're asymptomatic carriers whenever they receive an exposure notification--they'll never actually know.

The key differences (which I italicized above) are:

1. With contact tracing you keep all the data you collected. With exposure notification you throw away the data after notifying contacts.

2. With contact tracing you have to have proper security to store a bunch of private medical data. With exposure notification you don't.

3. With contact tracing you can identify asymptomatic carriers. With exposure notification, only the asymptomatic carriers have the information to identify themselves (assuming they keep all their exposure notifications).

4. With contact tracing, people don't have to assume they are an asymptomatic carrier, because the person doing the tracing will notify them if they are. With exposure notification, your only option is to assume you're an asymptomatic carrier for two weeks after every exposure, because no one person has enough information to identify asymptomatic carriers.

Exposure Notification just lets you know you were exposed. No other details are revealed to anyone else, including health authorities, so it is entirely up to the judgment of the exposed if they should go for testing or to isolate. The presumption is if you feel fine you're likely to write the notification off as a false positive, or not be very proactive about seeking testing immediately (I'll go tomorrow after my important lunch meeting...I feel fine after all...)

Contact tracing, in this context, means your identity is revealed to a health authority that can require you to be tested and isolated, even if you happen to feel fine. This is an invasion of privacy but it also may be able to reduce the number or severity of super spreader incidents.

> Why would Person 1 just go about their daily life after being notified of an exposure?

Imagine if you were a supermarket cashier, and as your job put you in contact with a lot of people you'd received notifications before. You work behind a plastic screen, so you've learned to take the alerts with a grain of salt.

Now imagine if you take two weeks off work to self-isolate it'll be unpaid, and you've got bills to pay and a family to look after.

Now imagine you have no symptoms whatsoever, you feel 100% fine, and also you know when you met Person 4 they had no symptoms.

The difference is here, without the graph, the message is much like, "you may have been infected, but, since you're showing no symptoms, probably not", whereas with the graph it's probably much more like, "you have been identified as a likely spreader of the virus". There's a subtle difference in the call to action.

>unlike an app, where too often uninstalling the app simply means an icon is removed from your screen, but some data is still retained as a file somewhere on the device.

What is this referring to? On iOS at least deleting an app means the app and its data is gone for good, except for keychain data. Same with android, except for on sdcard/internal storage. But in either case the developer would have to go out of their way to store data there. If they're being malicious they might as well upload the data to the mothership to begin with.

They are referring to the ways that contact tracing APIs are implemented at the iOS and Android level, and apps just utilize the API. I believe the article is speaking to the APIs (Android and iOS) and how they implement contact tracing independently of third party apps, which use the APIs.

> Furthermore, Person 2 is a hidden node from Person 4, as Person 2 is not within Person 4’s set of immediate notification contacts.

This is the system working as designed. What purpose would be served that Person 4 needs to know Person 2 was also a contact of Person 1? It's not a perfect system, but this is a strawman argument.

The Google/Apple system isn't perfect, and relies on people behaving like responsible adults. The real world isn't like that, as the Corrupted Blood bug shows.

Isn’t anybody else a little worried about how creepy this all is? The applications are endless, and I have this feeling that default on will become the norm, then the setting to turn it on and off and even see if you’re being contact traced will eventually disappear.

1. If you aren't careful, you are killing people

2. First amendment rights do not apply in an emergency

3. Don't compare covid19 to terrorism

4. Keep calm and carry on working from home

I think you missed the point of the parent post. What's to stop governments from having a perpetual state of semi-emergency with always-on citizen tracking "because we don't know when this could happen again"? I think some worry over this is warranted.

> What's to stop governments from having a perpetual state of semi-emergency with always-on citizen trackin

The same thing that stops companies from doing it continously and selling that data to the government, companies, bounty hounters, and ad sellers... I don't know what it is actually.

Oh dear god, people took my post seriously? I meant it as overwrought sarcasm. No wonder I got so few downvoters.

It is creepy and a valid cause for concern. However, one of the redeeming features of a hardware token (vs. a phone app) for contact tracing is that eventually, the battery goes dead and the token is useless. So even if you forget to deactivate the token after the 'all-clear', within a matter of months the entire network goes dark.

To clarify, it'll probably be a small miracle if the 1000mAh battery in the token lasts a full year...probably more like 6 months is a realistic lifespan for the token absent a battery replacement.

This is partly why I think contact tracing using physical trackers should have at least been considered.

Realistically only a certain subset of the population needs to be tracked (cost-wise).

The ethical concerns with a tag that goes in your pocket (or similar) are more obvious but come the end of the pandemic you can throw it in the sea whereas once the technology exists in the phones you can't trust the government not to keep it in some form.

Given the amount of processing power available to a state, and the amount of data collectable from a smartphone, it's getting increasingly possible to have a system like (in principle - not sonar or graphical but powerful correlations of sensor data from static WiFi hotspots and similar) that shown in The Dark Knight. Unfortunately no one will have the spine to say no.

Reply on news.ycombinator.com