Smartphone contact tracing has failed everywhere | Hacker News Reader

Smartphone contact tracing has failed everywhere

eclecticlight.co

172 pointszdw195 comments

I'm surprised this isn't mentioned in the article or any comments, and I'm wondering whether I'm missing something about the significance of this.

But I thought the biggest problem was that Google and Apple didn't build a contract tracing app - they built a framework for local governments to build apps on top of. This leaves the work of marketing the app and driving adoption to each government (as well as building and operating the service, which is also significant).

When I first heard about this, I thought they were going to build a pair of apps for Android and iOS. It would come as part of an OTA update, and everyone around the world would be presented with a yes/no dialog asking whether they wanted to participate. Local governments would then be provided access to a SaaS that would let their contact tracers enter the tokens of known positive cases.

I'm fairly sure that this would've resulted in significantly higher adoption rates.

I have no idea what the point was, to require every government build/market/operate their own version of the exact same app. Maybe so that the backends could be independent? If so, I imagine there would be other ways to work around that, like offering a cloud service and/or an open source backend implementation for governments to self-host.

They didn’t want the PR risk of owning the app

Exactly this! My spouse asked me the other day if Apple had released their contact tracing app yet. It was difficult to explain in lay terms that Apple was not releasing an app, just the tools to make an app.

Ask me if I will volunteer to give apple or google any more information than they already collect and my answer will always be no. I don't care what the reasoning. Germany did it right.

So they’d have to just force it then?

Or do it like Germany, no centralized info store.

The German approach doesn't give your information to a German centralized info store, but apparently it does require agreeing to feed your location data to Google's own databases on Android devices: https://www.nytimes.com/2020/07/20/technology/google-covid-t...

Germany adopted the Apple/Google framework, which is exactly what an Apple/Google app would use. The whole point of the design is that it’s decentralized and you wouldn’t be giving Apple/Google more information.

True. Except that the German app turns on EVERYTHING - LTE, WiFi, Bluetooth, GPS. And the carrier gets it all. I had the app installed for all of maybe 2 minutes because it did exactly what it claimed to do, but I'm not giving the carrier even more granular location info. The only thing I leave on when I leave the house is mobile data.

I'm not in Germany and I don't have compatible phone. But from all I have read the claim about turning on GPS is plain wrong.

German android user here. This is absolutely wrong. I suspect you are misinterpreting the permission message on Android. The app does not turn anything on. I suggest you to learn how androids permission system works before throwing out wrong accusions.

I stand by my post.

Since the contract tracing api doesn’t give information to Apple or Google, it’s hard to see what relevance this comment has.

The whole reason for Apple-Google getting involved in the first place was a technical issue that prevents Android from seeing iOS. Instead of solving that issue to allow a variety of solutions to be developed, they forced the entire world to create the apps in a certain way.

It's not that their privacy-centric approach was wrong (although this article details its major shortcomings), but the suppression of trial & error definitely was wrong.

Compounding this was Google-Apple's insistence that only government bodies can release exposure notification apps and you have a total absence of real innovation. It's no surprise that nothing has succeeded.

The whole debacle is a case study in the effect of gatekeepers on innovation. As manual contract tracing teams here in the US become overwhelmed, how many lives could have been saved by a successful exposure notification app?

If there were no gatekeepers on this, how much contact tracing fraud and malware would there be?

These would be good problems to have because they'd mean the apps were successful in the first place! Problems are solvable if we have the chance to solve them.

How would they mean the apps were successful?

Why wouldn’t the outcome be that people didn’t use contact tracing apps because a bunch of them were scans and malware?

I think the individual apps on top of the same framework are not identical in the way the data is collected and stored. AFAIK in some countries they have a centralized database, whereas e.g. in Germany all contact IDs are kept locally and only compared to a published (but anonymized) list of infected IDs.

No, that's not the difference. The contacts are stored inside the system's framework.

The difference is in how people report themselves as infected. That has to match the country's process for verification of the result.

There are two parts where local authorities need to be involved: troll-proofing the way people flag themselves as infected and translating exposure into actionable instructions/suggestions (e.g. different testing capacities require different testing strategies).

I agree that Google/Apple could have done a lot more, like an OS-branded App with extensive functional localization in cooperation with local authorities. But looking back at how pretty much every country was initially trying very hard to avoid working with the OS makers Google/Apple might not be to blame at all for merely providing a minimal API instead of a complete turnkey solution. Governments all over the world were only coerced into adopting the API by malware countermeasures already present in the operating systems, almost like a sudden vindication of Lessig's old "code is law" claim.

Idk, maybe Google and Apple could do more, but I thought it was almost a wonder how fast Google and Apple came up with a workable framework.

Probably because they were already using it internally for other purposes.

Because it is not location tracking. It is simpler. It just records nearby pings of other phones.

Apple and Google are probably stuck between a rock and a hard place with this contact tracing.

Between them, they have exact positions of a vast majority of individuals, at least in western societies. They could have done useful contact tracing at the press of a button, even historically, for every major event such as large concerts, churches, night clubs which we know were the most important situations to contact trace. They could have done this with the data they already have.

This would however set a bad precedent on how this data is shared. Law enforcement is one thing, medial tracing is another. So instead they set out to build this BLE tracing toolkit, which is something that at best is intended for future use, when everyone has the requisite hardware and software installed. It wouldn't reach more than a minority of users today which severely limits its usefulness, all for the possibility of reaching into situations such as bus rides, where nobody really knows how contagious these situations are because we simply do not have enough knowledge of the virus yet. Real world measurements are also likely to be noisy (where someone carries their phone in their hand and another in their backpack with a water bottle) even if we could set a hard limit on a safe distance, which we can't.

So maybe we will get something useful in the future, for the price of not exposing the data already available today.

It is amusing that the BLE tracing toolkits were sold as a way of not having to expose your location data to Google and Apple, the exact entities who already have fine grained location data on most people.

>They could have done useful contact tracing at the press of a button, even historically, for every major event such as large concerts, churches, night clubs which we know were the most important situations to contact trace. They could have done this with the data they already have.

Apple definitely could not have done this because they don't have this data.

Even assuming for a second that Google stores the location of every user (they didn’t store mine), how would they do contact tracing when they don’t have access to data on iOS devices? Even assuming they did, what key would they join on?

But no, a confident blanket assertion is made without providing any evidence.

They definitely store location for the majority of users who use Google Maps, their location history is both very accurate and opt-out buried in settings menus. I don’t have numbers on percentages given that Google likely doesn’t share this data, but I feel safe in assuming that less than 5% of Google Maps users have turned off the location history feature.

Many potentially dangereous contacts happen inside where positioning doesn't work. Maybe in a restaurant the location could be inferred because you enter and leave through the same door. But in the subway/metro/underground? Also every high-raise building would create lots of false possitives by people that did not get close.

Google location is still very good in buildings and subways because they wardrive open wifi routers to help triangulate you. So when I'm near a wifi router with a particular MAC address that google has seen before, they've got me.

Agree with you on high rises and false positives, but then again, if air is circulated in the building or everyone uses the same elevators, might be worth notifying them.

https://support.google.com/maps/answer/1725632?hl=en

Phone barometers can be used to get a pretty good idea which floor of a building you're on.

https://www.popsci.com/gadgets/article/2011-10/so-um-why-doe...

https://www.engadget.com/2012-09-06-stmicroelectronics-detai...

> It is amusing that the BLE tracing toolkits were sold as a way of not having to expose your location data to Google and Apple, the exact entities who already have fine grained location data on most people.

I think they were sold as a way of not having to expose your location data to government authorities. Also, Apple makes a fair amount of noise about not collecting fine-grained location data and other PII on their servers; as far as I know, at least, they simply don't do the kind of server-side logging that would let them do the kind of historical reconstruction you're describing in your first paragraph. I'm not entirely sure Google does, either, for that matter, even though they keep a lot more server-side.

(Foursquare, of all companies, could probably do it. But only for a too-small subset of people.)

From personal experience in this industry, the issues are mostly pragmatic, i.e. legal, and then about authoritarian regimes. There are some ideological issues concerning 'personal information' that varies from company to company and we linger a lot about that in the Western press and on HN, but that's really not it.

It's very simple: if your ABC company has the ability to 'trace' people, and you allow 'friendly country' XYZ to use it - then 100% of 'baddie countries' will immediately full court press for access as well, with the possibility of banning your tech if you don't.

And then the political/power haggling ensues: dictators actually do have to worry about popularity, so what would it mean to invalidate all the iPhones in Saudia Arabia ... probably not good, so there's that. On the other hand, being able to 'trace everyone', especially my political enemies is also exetentiayly powerful so ...

I don't know what would happen if this were not the case - if this were 40 years ago, we were not as technically globalised and Apple was just selling to US/Canada, we may see different outcomes.

But as it stands, most governments in the world are 'completely untrustable' with the tech, and so it's almost like it renders moot the question of whether Switzerland, Sweden, Japan, or the US can have it and 'play well'.

Yes, this is likely the hard problem here. If one were to be cynical, one would say that it is also the strategy that makes the most economical sense for everyone. It's just a bit comical from a certain viewpoint.

And to be clear, this is not just a problem of the Apples and Googles of the world. Many more face similar issues, starting with the telcos themselves. The point is that location tracing is something that is routinely done for other legitimate reasons, but the recent pandemic suddenly forces everyone to be specific about how and why we allow it.

A better term than 'economics' is just power, where money is one factor.

Putin wants more power vis-a-vis his proles and if he can strong-arm a company into doing something, he will.

Apple and Google have a certain kind of power, governments do, but most companies have very little flex.

Specifically 'up and comers' i.e. startups must have to face some weird challenges there, certainly in the area of 'content filtering' and government access we are only scratching the surface.

I can only imagine what kind of deals FB has made with various regimes, and he lengths they will have done through to obfuscate it.

I believe this isn't correct. Contact tracing can't work using location data, because it's far too coarse and unreliable to be useful. Too many false positives.

The point isn't to figure out where the contacts were. It's to figure out who they were.

This has privacy implications and is ripe for abuse. What then? The gov't forcibly quarantines those people? Displays the info on a public web page so neighbours can bolt their doors shut like it happened in Wuhan? Maybe it's just me but I can already think of a Minority Report kind of scenario.

The Google/Apple concept deals with the privacy implications pretty well.

I may be misremembering details, but the idea is that everyone's phone stores its own database of unique identifiers of other devices its come into close proximity to. Then an alert goes out saying "anonymous device XY123 tested positive", and if my phone has that ID in its list of people who may have been close enough to infect me I'd get an alert, but the alert wouldn't tell me who it was who tested positive, and the central system doesn't know who has come into contact with who, it just knows when someone says "hey, my ID is this and I just tested positive" (which is no worse privacy wise than using your real name when going to get tested).

As to how gov reacts if/when they know someone has Covid... well that debate will exist in any country where there aren't 0 tests taking place, because "what will they enforce on me if they think/know I have covid" is happening more from people who test positive than from contact tracing. So it's a different subject, but frankly anyone who does have symptoms or a positive test should be staying the hell away from anyone out of decency without needing any government enforcement.

> Law enforcement is one thing, medial tracing is another.

Dragnet location use is vastly more justified for pandemic tracing than for law enforcement. I'm not sure how this could set a worse precedent than we already have. Just trading one for the other would be a boon for privacy.

>Maybe so that the backends could be independent?

Funny, I misread 'backends' as 'backdoors'.

Ignoring the headline, it seems like the article equates quick, widespread adoption of these apps as “success”, and anything else as “failure”. Although it does note:

> Conventional contact tracing methods also haven’t been faring well.

Despite this, it doesn’t even bother to identify the many reasons tracing apps might not be widely adopted yet, in particular privacy concerns (although it does mention that “draconian” approaches are the only ones proven to work so far, as if that proves that privacy respecting approaches can’t be useful at all.)

Even more fundamental than privacy, though, is do people even know that these apps exist? Personally I’ve only heard some rumblings about the Google/Apple api, and not much more, and I’m guessing I’m far more aware of the existence of these apps than many people.

Ultimately, it’s far too early to declare “failure” on this front.

Edit: According to 9to5 Mac, there are still no apps in the U.S. using the Apple/Google API as of June 18. https://9to5mac.com/2020/05/19/how-to-turn-on-off-covid-19-c...

The vision of smartphone tracing apps in April was that they were going to be a cheap and low-manpower silver bullet for contact tracing. If all they represent is a slow, limited, and mildly effective supplement to normal contact tracing, I don't think they're worth the privacy concerns in the first place.

The privacy concerns were addressed in the design of the frameworks.

During the lockdown people were paying close attention to news and gov. got all the attention it wanted.

In particular for France, regulations were passed to allow or deny activities, set curfew etc. with hefty fines associated, all of that at a few days notice at most. So, not closely following the news was not an option, and the tracing app got plenty of air time.

Now, it came after a month or two of bullshit from the health dept (“you don’t need masks, also go vote in person, it’s fine”), which itself came after half a year of protests against the gov, so most people weren’t sold on gov’s good intents on not abusing the app, especially as Apple/Google’s privacy focused solution was not adopted.

Agreed. And I hate headlines like this that mislead their audience. Headlines must be stand-alone true as >90% of the people who happen to see the headline aren’t going to read the article. A headline like this will leave many with the impression that contact tracing apps don’t work, not that they just haven’t gotten much buy-in.

(Which of course becomes self-reinforcing... If the vast majority of people who see the headline are led to think the apps don’t work, then they won’t want to adopt them... and low adoption is, of course, the very “failure” discussed in the first place...)

This may seem like a small thing, but the apparent license-to-lie-or-at-least-use-half-truths-in-headlines that many media editors (because editors, NOT journalists, control the headlines) believe they have is maybe the biggest problem in media accuracy we have. We are bombarded with 10-100 times as many headlines as we can possibly hope to read, which is a constant background noise of half-truths.

And yeah, of course a headline won’t be able to tell the full story. But it should be accurate enough and not misleading. The excuse of “but you have to read the full article or you’re just lazy” is a ridiculous cop-out for a license to lie.

" A headline like this will leave many with the impression that contact tracing apps don’t work, not that they just haven’t gotten much buy-in."

That would be an entirely accurate impression, contact tracing apps have a proven track record of not working so far. That one contributing factor is the lack of buy-in in the population does not detract from that point.

> Even more fundamental than privacy, though, is do people even know that these apps exist?

Speaking for Ireland the app was heavily publicised, and there's even a prominent "Share app" feature in the app itself.

I live in Ireland and our contact tracing app (using Google+Apple tech) seems to be doing well. There was about 1 million install 1-2 days after it launched, currently standing at 1.4 million installs (population is 4.9 million), along with some positive contacts reported:

https://www.bbc.com/news/technology-53525712

It was also donated to open source.

https://www.nearform.com/blog/ireland-donates-contact-tracin...

While that is useful I think each country will face its own challenges with adoption.

Indeed, and it's early days yet.

From the article:

> It also reveals that, whatever the people of Ireland have been told, their app is collecting centralised data on them.

The signup flow has a very obvious and well written opt-in for collection of anonymised data to help track how well the app is working, which was mentioned by the BBC article linked. I don't think people are being mislead.

I personally decided not to enable that, but did give the app my phone number to be shared in the event I'm a close contact.

> it has been in use, it is claimed to have resulted in 91 “close contact exposure alerts”, which is remarkably few.

That they know of, as those users either opted in to the anonymous tracking or (possibly) gave their phone number. It'd be useful to know how the install base per the usual Android/iOS stats compare with the anonymous tracking enablement, but those numbers haven't been shared as far as I'm aware.

Right now our overall case numbers are low enough (around 20 per day) that it's likely hard to tell how effective the app is. However our R is currently estimated at 1.1, so even a little help from the app could help keep us below 1.

Does your Irish app require the app to be open on iOS?

Not that I’m aware of. The app just reads the data your phone is already collecting.

It’s making use of the api that Apple and Google added to iOS and Android. Which I believe once enabled is using Bluetooth beacons to keep a list of other phones you have been nearby. That’s all done by phone, not the app.

If you test positive, then you are expected to use the app to upload the list of phones you were in contact with. Notifications will then be sent to all those phones through the app.

No, reportedly it was the first app to use the Google/Apple framework from the very start, which doesn’t suffer from that issue.

Does installed mean active? Here, the local app had good penetration, but daily activation was rather low and constantly decreasing.

One of the concern is that it impacts battery life, so people turn it off most of the time unless they plan to go to a public space. Then they forget to turn it on.

You’re right, it doesn’t mean active.

It’s possible many of those users did not grant the contact tracing permission on the phone when installing. But I’m assuming anyone who went to both of installing would be open to allowing it. They could also have uninstalled 10 mins later. I don’t know how the number is being calculated.

I’m on iOS and keep app installs on my phone to a minimal but haven’t noticed battery drain so far. Android my differ.

Also your phone can collect the data by enabling in Settings > Privacy > Health > COVID-19 without the app at all.

If the German app would have been less privacy aware, it wouldn't even had 16 million downloads in Germany. The decentralised approach was and is the only one which at least worked a little bit.

Contact tracing apps were NEVER going to work. There are numerous fundamental technical problems but those aren’t even worth getting into, because people won’t use this shit.

Smartphone contact tracing is an absurd silver bullet pipe dream from a bunch of hammers who see the world as full of nails. It won’t work, can’t work, and will not ever work.

How much more effort are people going to waste on this?? Every time this comes up on HN the horde mass downvotes anyone who dares to dissent. It’s been almost five months now.

Can you name those fundamental technical problems? From my understanding, the problems are adoption and states being slow in implementing the apps. I don’t have any exact numbers, but I would say even with some false positives it will be much more directed unlike testing everyone daily.

I agree that it won’t work in Europe or the US and it was absurdly over-hyped, but mobile-based helpers have been effective in Asia. The critical difference is that Asian countries can mandate this sort of thing, since their populations seem to be culturally more willing to accept a higher degree of illiberal state control over their lives (for the good of society at large). If the app had to be installed and configured in every smartphone sold, and you were forced to show it to police spot-checks on the streets, adoption rates wouldn’t be a problem.

This is obviously unfeasible and undesirable in most Western countries (at the moment...) so we’re left with a voluntary scheme that is only as effective as typical voluntary schemes (i.e. not much).

Grouping as "Asisan countries" is wrong.

Did I miss something or are low adoption rates and bluetooth issues the only indicators that decentralized tracking has failed, as pointed out in the article?

The lack of statistics about success/failure otherwise seems to imply more of a "we don't know for sure"?

Specifically, it seems that adoption rates are so low as to render the application nearly useless.

Yeah, the overall conclusion is that smartphone contact tracing probably isn't working, but we can't know for sure because the megacorps who designed it did so in such a way that makes it almost impossible to measure if it's actually working. The only app we know has definitely been ineffective is Australia's centralized solution, in large part because they do actually have the ability to collect statistics on its effectiveness.

We do also know that Germany's app was just outright failing to send alerts to users of many common, popular devices due to limitations on background tasks: https://www.dw.com/en/germanys-coronavirus-tracing-app-criti... Obviously there's no way to know exactly how many people should've been sent a warning and weren't either, by design.

It’s trivial to tell whether it’s working with some ordinary surveys and research.

No “megacorps” have done anything to make it impossible.

It's just like mask usage -- nearly useless unless a critical number of people are wearing them.

Seeing that even the Bay Area, where you'd expect people to be relatively compliant with masks, not attending gatherings, and social distancing, is seeing a case surge, I'm not convinced than anything non-essential indoors will reopen, and masks aren't making a big enough difference to change that.

That said, I've seen very little data about where people are getting it (outside of medical settings, meat processors, and prisons), and you'd think this would be pretty important to managing the spread.

Very wrong. Smartphone contact tracing is successful. (e.g. in South Korea.) It's only decentralised smartphone contact tracing that failed.

"Only draconian access to personal data, as used in South Korea, seems to have brought any positive results."

The article quickly glosses over this fact (and leaves out Taiwan) and labels this successful system for stopping COVID-19 spread as draconian. I imagine that the NSA/CIA/FBI already has such a system in place that maybe it would just needs to get scaled up to cover everyone in the US. It's too bad the people in the US can't trust their government to ramp up and use such a tool to stop COVID-19 and then shut down the system afterwords. The Patriot Act proved that once given special powers any limited time provisions just keep getting extended forever. Some people born after 9/11 are adults at this point.

If you have google maps installed on your phone and location turned on, every time you visit a restaurant you already get the message of "how did you like xyz, please rate and help other visitors"

You are already living in a surveillance state. The difference is unlike in other places in the world you can complain and shout about it.

Another difference is that you aren't using this data (which are collected anyway) to contain the epidemic. I can't figure out why.

My hopeful guess is that their APIs and policies make the data impossible to access in anything but an aggregated format.

It has to be policy. If they only had aggregate data, they couldn't do the whole timeline thing.

They did release some results on peoples' movement patterns during the pandemic "lockdown" (https://www.google.com/covid19/mobility/).

They don't have the X is infected part and the data is also aggregated.

At least for now, I also have the choice to not have Google Maps on my phone and keep location disabled, which I do. So there's definitely room for things to get worse.

Just because you chose to sacrifice your privacy for convenience doesn't mean it should become a baseline for what we expect. Especially nor for government services.

Reason 5,431 why I carry a 3g flip phone (with the battery often removed).

You should start looking into LTE flip phones. There aren't many (the Alcatel Go Flip comes to mind), but carriers are starting to phase out 3g. E.g. AT&T is killing 3g in 2022.

Good. Why are people suddenly okay with building likely-permanent surveillance systems for temporary outbreaks? How would Apple ever reasonably remove this feature?

Well, the Apple/Google mechanism is not useful for surveillance.

It’s optional and opt-in now. Do you trust it to stay that way once the framework is in 99% of people’s pocket? I sure don’t.

Yes I do - because everybody is watching.

This feels like a "slippery slope" argument. If so then I would argue the situation demands us to take a small step further towards the start of the slope.

It doesn't matter, the technology doesn't provide any means for central tracking.

If Apple or Google are going to introduce a non-optional surveillance mechanism into their devices, there’s no particular need to build it off of their contact tracing platform.

You’re thinking the contact tracing platform somehow paves the way for an actual surveillance system, but it doesn’t. If they want to build a surveillance system then they will, and the success/failure/adoption rate of their contact tracing platform won’t affect that at all.

> there’s no particular need to build it off of their contact tracing platform

Building surveillance off the contact-tracing platform would allow the three-letter agencies to track movement of a single device regardless of whether or not you try to sever its connection to the cellular network. You might be able to hide a single device from the network, but would you be able to hide all the other devices around you that are trying to snitch on you?

Surveillance is more than just the technical means of data collection but also the societal framework in which it occurs. Contact tracing, if it worked, would have been a bunch of "good PR" for surveillance in general, and that affects how people will react to similar increases of data collection in the future. How to you think the FBI's 2015 case against Apple would have gone if there was already precedent for unlocking devices if the owner was thought to be infected?

> would allow the three-letter agencies to track movement of a single device regardless of whether or not you try to sever its connection to the cellular network

They can do this without the contact tracing platform.

Regarding PR, that too can be done very well without a contact tracing “success story”. Also, forcing people to unlock their devices is not an element of the the contact tracing platform.

I’m not sure why you’re convinced the contact tracing platform is a necessary or even helpful step for any of these things you worry about. But it isn’t. You will be able to take more fruitful actions against these things once you understand that.

My understanding is just fine, thanks. I see a surveillance system that has demonstrated no value to me, presented in a very short time by parties who rarely-if-ever cooperate, with no end date for the system's removal. It doesn't pass my sniff test, I don't like it, and I don't need anyone to tell me I'm allowed to think that way :)

It is. It just requires additional beacons and at least one point where a real identity can be matched.

So, theoretical attack relying on non-existing deployments to get a person's past position, even with several other ways of obtaining the same information (for example: cell tower tracing, collecting info from cameras, cctv, card purchases, etc)

Thanks I think I'll keep using the app

Our parents did not write that you shouldn't use some app.

There was a very specific claim about the Google/Apple approach and its usefulness for surveillance and someone objected by teasing a possible pathway for using proximity tracing for surveillance.

One can acknowledge an approaches inherent risks without making absolute judgements about the approach in general.

It is, though. If you're not infected you retain your privacy, but once you're infected and give up your contact tracing key, everyone can know whether you have been near them or not. Combine this fact with a network of Bluetooth beacons at fixed locations and a malicious actor can basically track where anywhere an infected person has went.

"everyone can know whether you have been near them or not."

For a very broad definition of "you" and for an unconventionally small set called "everyone". If you are forced to quarantine, a lot of people will know about your infection anyways, completely without any convoluted mental gymnastics about theoretical deanonyzation possibilities. Epidemic control has always been a very low privacy endeavor and app-based tracing following the Google/Apple model doesn't change that the tiniest bit. In fact of it was fully deployed it could replace a lot of far more invasive tracing, causing a net increase in privacy.

I wish I could believe some new form of surveillance would ever "replace a lot of far more invasive tracing" and not just increase the overall scope of collection. This type of BT-based "offline/historic" mass-snitching just gives privacy-conscious people another thing to have to hide from in addition to the cellular network itself.

Random Bluetooth identifiers rotate every 10-20 minutes, to help prevent tracking [1]. (Of course it's always possible to track phones with their radios on for some time and distance.)

[1] https://covid19-static.cdn-apple.com/applications/covid19/cu...

That's irrelevant because once you're infected, you give up your daily keys[1], which allow your random ids to be correlated together.

[1] technically this is optional, but not doing so also means you're not reporting your infected status to others, which kills the point of contact tracing.

The medical facility that diagnoses you does not get your keys, if I'm understanding the system correctly. They give you a key that you give to your phone, and your phone then uploads the daily keys. Unless your phone includes identifying information with that upload, the daily keys are still anonymous at that point.

The hypothetical malicious actor would need to have (1) listened at some location where you were and captured the key you were broadcasting at the time, (2) identified you by some other means, such as face recognition, while you were at that location, and (3) infiltrated the server where your phone uploaded its daily keys so they could find out what other keys came from the same device as the one they captured and correlated with you already.

If they do all that then they could tell which other locations they were capturing key broadcasts at that you visited.

If they have not gained access to the data at the upload server, then all they get from matching your key to your real identity at one location is what other key listening location you visited before the key rotated.

They could put the face recognition systems (or whatever they are using) at their other key listening stations...but then they don't need the keys.

This seems like a lot of effort for little gain on the part of the malicious actor.

You're right, I wonder why they didn't harden it just a little by transmitting less and listening more, or by changing keys more often.

It is if you build Bluetooth scanners everywhere in a city and correlate the scan data with other surveillance data, as simple as pointing a camera at whoever passes by a scanner.

Indeed, if you start with the contact tracing platform, add a mass surveillance system to it, you end up with a mass surveillance system. Note that a surveillance system like the one you propose doesn’t need the contact tracing platform to work.

But it does make it a heck of a lot cheaper to build and scale. You need far fewer cameras and can spread cheap bluetooth beacons densely across the area. And you can put beacons in places you can't use cameras.

Wait, so how are you matching the beacons (cryptographic random values) back to individual users?The back end only gets that information if a user tests positive and agrees to submit the data.

Even then there is no reason to store that linkage so server compromises won't leak this information.

You’d have to have a pretty sophisticated setup to do so, considering the identifiers are randomly changing all the time. It would be far easier to use the existing identifying cell tower data that already exists. Your paranoia isn’t justified IMHO.

You do realize that the scanning of bluetooth is already in place? For example http://www.libelium.com/products/meshlium/smartphone-detecti... or https://www.cnn.com/2020/04/04/tech/location-tracking-florid...

The contact tracking system does not add anything that is not present for tracking individuals. What it does provide is for two anonymous individuals to determine if they were in contact with each other for some period of time in the past.

The ability to do surveillance to see if an individual is in a particular place at a particular time is neither aided nor hindered by the contract tracing framework that Apple and Google provided.

"I'm sure it'll only be used in opposition to my political opponents" - Says, unfortunately, everyone on all sides.

Korea did this successfully but you have to give up a lot more privacy. This protect my privacy, and expecting it to work great is some fallacy.

Maybe, but privacy is worth protecting, more than ever.

Over lives?

think of the children argument

This is the same argument as justifying the NSA's mass surveillance with terrorism. Because lives are involved, it's propagated like a killer argument. Fact is, you don't know if even worse things aren't going to be enabled with this technology.

Cell location is already available to criminal investigation by law enforcement agency under warrant. It's a simple matter of legislating to make it available to epidemic investigation by health agency under warrant-like procedure. South Korea made such law after 2015 MERS epidemic. It does not enable NSA-like mass surveillance. Just do it now, so you can use it the next time.

An important part of the NSA problem is that terrorist conspiracies are a largely imaginary boogeyman. The vast majority of its collection is unwarranted. But the pandemic is real, we know that the damage it does is directly related to the effectiveness of contact tracing, and we know that anyone having contacts outside the household is doing an unusual and extremely dangerous thing.

This is more like tailing people who buy bombs and visit crowded public places with them.

You are not only surveilling those that do "unusual and extremely dangerous things" as in they get within a few meters of other people, you are surveilling everyone. This is not just tailing people who buy bombs.

The moment you start seeing regular people as terrorists, that's when you've lost the plot ;-)

Terrorists dream of inflicting as much damage as "regular people" do when they continue acting like regular people in a pandemic.

This technology is designed in the open in a privacy sensitive manner. Your phone tells far more to your cell phone provider, Apple/Google, all the apps providers you have, and credit card companies than this technology ever will.

Better losing privacy over lives than over social media participation. Oh, wait...

It's a false choice.

But even if it were true, yes, over lives. People already died fighting for my liberal rights, I'm not willing to trade any of that for some temporary safety.

I'm from a Warsaw pact country. Seeing westerners so willing to give up their rights these days is so deeply disappointing.

It's easy to give something up when you don't understand the danger of losing it. And we live in times where it's easier to give up your privacy than ever before.

This resonates with my experience having grown up in a dictatorship. The loss of privacy can be insidious and feel ‘not a big deal’.

The false choice here is actually that you can sacrifice lives and still expect to have freedom.

The alternative to not giving up privacy for contact tracing or similar measures is to be locked into your home medieval style while the plague runs wild in the streets, which is a significantly stronger limitation of freedoms.

The choice isn't between liberty or safety, just as it isn't between economic health and lockdown, it's between intelligent and proactive measures or carnage. Without public health there's no liberty. If our systems fail to protect the health of our populations those rights will go out the door sooner or later because it proves that those values are useless.

It's completely paradoxical to argue that I'm free although I can't go to work, I can't safely go to the restaurant, I can't meet my friends without being afraid of contracting a deadly disease, but I'm free because I have privacy.

Locking yourself up for fear of a <1% chance of dying is very much a choice.

That 1% depends on a wide variety of contexts. It isn’t 1% for everyone, 1/3% of those who didn’t die seem to have debilitating persistent problems, and even if everything is fine with you, you can pass it to someone who passes it to someone who dies from your unwillingness to act for the greater good. To do anything but protect yourself is fundamentally selfish.

It isn’t 1% for everyone

True. If you're younger (really, under 60) and healthy it's much less than 1%.

1/3% of those who didn’t die seem to have debilitating persistent problems

Unclear if you mean 1/3 of all infections, which is far too high, or 1 to 3 percent, which is possibly reasonable, although again it's going to be skewed towards older and unhealthy people.

even if everything is fine with you, you can pass it to someone who passes it to someone who dies from your unwillingness to act for the greater good

At some point people have to be responsible for themselves. If you're severely allergic to peanuts, then that's something that you have to watch out for; we don't ban peanuts for the general public. If you're at high risk for COVID then you should take appropriate precautions, but it's unreasonable to demand that everyone else be forbidden from seeing their friends and family for months or years.

Any levels of fatality is relative to how overwhelmed the health care system is, and the access to care that people have. We’ve seen it as high as 15% already in some places. This is a GLOBAL pandemic; any spread within your community can eventually make it to the Amazon in Brazil where it’s ravishing local communities that don’t have access to modern hospitals.

Your statement seems to emphasize that the focus should be on the youth, who are also dying of this disease. But the careless nature of dismissing the fatality rate of those over 60 or with co-morbidities is really unbelievable. So my parents, who are otherwise healthy and I expect to live for DECADES more should die now so you can go out and see your friends? Or those who are young with diabetes that might otherwise have an entire full life? The level of selfishness of such a statement is just off the charts.

If you were to kill just ONE person and be caught you’d be in jail for many years, purposefully (murder) or by accident (manslaughter). Yet passing a disease that has brought the world to its knees around is somehow ok? When did those who get affected by your actions get to weight in and vote on this? Or do you feel you can just unilaterally decide that it’s fine for others to die _unnecessarily_? And for businesses to suffer because the disease keeps going and others DO care about their own safety and those around them?

Furthermore, the CDC just acknowledged it may be as high as 1/3 of those recovered with persistent issues [1]. Even if it were 1-3%, why is that ok for that 1-3%? 1% of the global population is approximately 80 million people. How many of these would have solved climate change, found a cure for covid, or otherwise positively impacted the planet? That’s worth not just saying indoors collectively for a short period to prevent? It keeps going because people DON’T do what’s in the best interest for all of society, or even their future self.

You’re basing your assumptions on an extremely short time span of data, but we know that many viruses can strike far later in life with devastating consequences, or a lifetime of flare ups. We simply don’t know, but Dr. Fauci has repeatedly warned people about such a possibility. How can you calculate such risks when they’re unknown?

Peanuts are something that can be easily regulated and limited to those who are allergic. They pose no global threat, and don’t hop between people. Those allergic can also carry epipens. There is no epipen for covid (yet?). Until then we have an unusually highly contagious virus that spreads from a very high percentage of asymptotic carriers.

Already in the US over 1/3 of Americans who died in WWII have died since March that largely wouldn’t have otherwise [2]. It’s July. Please reconsider your actions.

[1] https://www.cdc.gov/mmwr/volumes/69/wr/mm6930e1.htm [2] https://www.cdc.gov/nchs/nvss/vsrr/covid19/excess_deaths.htm

But the careless nature of dismissing the fatality rate of those over 60 or with co-morbidities is really unbelievable.

Exactly the opposite. By pushing the narrative of everybody being roughly equally vulnerable, we've failed to protect those who are most at risk. In a reasonable world, we would have locked down nursing homes immediately, with workers quarantined on site. (And paying them a ton of money in compensation). We also would have said that nobody over 60 or with health complications should be working outside of the home, even in essential businesses. Instead we panicked over young people going to beaches.

So my parents, who are otherwise healthy and I expect to live for DECADES more should die now so you can go out and see your friends?

Your parents, like mine, should take appropriate precautions. I'm not going to visit them or anyone else at elevated risk without a recent negative test, nor should they allow me to. But it's not reasonable to transitively extend the moral blame for infections back to patient zero.

The level of selfishness of such a statement is just off the charts.

Lockdowns cause massive harm to mental health, children's education, and people's livelihoods. And even physical health, as "elective" procedures like cancer screenings are cancelled. I could say that you're selfish for ignoring them, but instead I believe that we're all trying to do the best we can, and we have different conceptions of the costs and benefits of various actions.

Or do you feel you can just unilaterally decide that it’s fine for others to die _unnecessarily_?

Every day everyone does things that indirectly raise risks for other people. Do you quarantine yourself during every flu season? Do you ever take unnecessary car trips, thereby increasing the risk of other drivers and pedestrians suffering a fatal accident? If you want to argue that the current situation requires placing the entire country under house arrest indefinitely, you're going to have to show your work.

Furthermore, the CDC just acknowledged it may be as high as 1/3 of those recovered with persistent issues

"Persistent" as defined in that study is 2-3 weeks, which is not an unusual amount of time to recover from the flu.

That’s worth not just saying indoors collectively for a short period to prevent?

If I believed that a strict one month lockdown would eliminate the virus, I'd be all for it. I don't.

> 1/3% of those who didn’t die seem to have debilitating persistent problems

Source? All I've seen so far has been anecdotal evidence.

https://www.cdc.gov/mmwr/volumes/69/wr/mm6930e1.htm

2-3 weeks is not even remotely persistent.

That is the CDC’s survey. There’s plenty of data out there suggesting many people are experiencing more potentially permanent effects / damage.

That's a fine source if you want to prove that fully recovering from COVID often takes more than a few weeks. But that is not the question here.

> There’s plenty of data out there suggesting many people are experiencing more potentially permanent effects / damage.

Since you already know that data, would you please tell me where to find it?

https://medicalxpress.com/news/2020-07-covid-related-symptom...

A Google search will yield many results. It’s not hard to find.

So you can't. Got it.

I literally provided a link to you showing exactly that. Did you not read it? But I'll feed the troll, why not:

https://arstechnica.com/science/2020/07/two-months-after-inf...

https://www.prevention.com/health/a33432800/long-term-covid-...

https://www.healthrising.org/blog/2020/07/24/open-letter-cov...

https://www.usatoday.com/in-depth/news/health/2020/07/25/cov...

https://health.clevelandclinic.org/what-it-means-to-be-a-cor...

https://www.advisory.com/daily-briefing/2020/06/09/long-haul...

https://www.wbur.org/hereandnow/2020/07/21/covid-19-long-hau...

https://medicalxpress.com/news/2020-07-tail-coronavirus-prol...

https://www.nbcnews.com/health/health-news/covid-19-long-hau...

https://www.today.com/health/covid-19-long-haulers-doctor-ta...

Satisfied now?

10 articles of anecdotes are just as worthless as 1.

The Rome study linked was 143 people, not 10. It seems like you’re moving the goal posts. You said you can’t produce one, I originally did and followed up with many more. Then you say that’s worthless, which means you didn’t even read those links. You’re not discussing things in good faith, which is a violation of the norms here in HN.

We saw the same pattern with far bigger studies with SARS. The fact of the matter is this is all very new, and conclusive data will take time. But there’s plenty of evidence already to suggest that for some it behaves like SARS and that’s very concerning. We also don’t know if this will behave like herpes or chickenpox and cause problems later in life even for those who “recovered.” There’s a reason why the world world is taking this seriously.

Right, I didn't read all those links. I checked one at random, saw it's anecdotal bullshit and decided not to sift through the rest in the hope there could be something valuable in there.

But hey, spamming links is a step up from "Google yourself, there's plenty of evidence [I don't bother to cite].

The chance of ending up in a hospital is much higher (about 15 times higher), and so are the chances for complications in general like loss of smell or neurological or heart/lung damage. And if you have pre-existing conditions (like a sizeable amount of people) those risks only go up.

As can be seen in slumping economic stats many people are avoiding that risk which makes complete sense. It's absurd to frame this as a 'choice', it's a gigantic societal and civilisational failure to not be able to stop this disease.

In particular in the US though framing collective failure of preventable harm as cost for freedom has become the norm. You can pick anything that doesn't work or that could have been prevented and within five seconds someone will tell you it's the price for freedom. I think the real explanation is much more sinister. As a society people have given up, so now every harm or burden is rationalised in this way.

1% chance is for you. But if you are able to infect another person, that is no longer 1% as a whole.

While I understood lockdown measures, know that this is your privilege talking. You can stay in lockdown because you're middle class living in a wealthy country. In countries like India lockdown can cost far more than what Covid-19 can do.

I'm not arguing against public health measures, when the cost to me is low or when accompanied by evidence.

So where's the evidence that tracing apps work? That South Korea does it and South Korea manages to keep Covid-19 under control, that's not evidence. Plenty of confounders like the massive testing they did, their discipline in wearing masks, etc.

And note that I'm not a denier. I do think 1% mortality is unacceptable, plus it appears that's not the only problem. High hospitalization rates, permanent heart and lung damage, etc.

Still not willing to trade my privacy away, sorry.

You're free to do that but I'm willing to fight for mine.

> 'm not arguing against public health measures, when the cost to me is low or when accompanied by evidence.

Sometime there are no clear evidences, just suppositions - or the individual cost is not insignificant.

In that case you should not be surprised to be forced to stay at home, similarly to not being allowed in a school when not vaccinated.

You decide to pose a risk to society - you must face the consequences.

My wife is immuno-depressed so people, for their comfort and freedom decide to be a danger are my personal enemies. I want to make sure they are forced to stay at home with their liberty with them.

Only when you cooperate with society "for the greater good" then you are free to express your freedom publicly.

This is not something philosophical - it is life at stake for some people.

I'm sorry for your immuno-depressed wife. I also have family members over 60 that would be at higher risk if they contacted Covid-19. And I'm an asthmatic and asthmatics are at higher risk.

But that's still not a reason to have my privacy traded away.

And if you're going to treat me like the enemy, willing to trade my freedoms away, for your safety, then don't be surprised if I'm going to treat you like an enemy too.

---

I'm totally fine with vaccination btw. That's a really poor analogy b/c vaccination is the best evidence-based strategy we have for fighting viruses and it's a one time cost to pay.

To be honest, even if contact tracing apps had evidence that they work somewhat, I'd still not trade my privacy away. I only pointed out the lack of evidence because it is absurd to give up your freedoms on something that may or may not work.

In any case, I'd rather catch the virus.

> And if you're going to treat me like the enemy, willing to trade my freedoms away, for your safety, then don't be surprised if I'm going to treat you like an enemy too.

Yes of course, this is normal. And that's why I am actively working for a legal framework to coerce people into staying at home in these cases. I highlight the word "legal" as otherwise it will be chaos.

> That's a really poor analogy b/c vaccination is the best evidence-based strategy we have for fighting viruses and it's a one time cost to pay.

In some cases we need to be proactive without string evidence. In the case of COVID-19 this is not a matter of being psychologically comfortable (as opposed to, say, religion where anything goes for me, at least until it does not directly hits others). It is a matter to use that until we have better solutions.

> In any case, I'd rather catch the virus.

This is your choice. Please just make sure to keep it to yourself and also to realize that you will be using a medical facility overloaded by people who not only caught it willingly, but also those ones who did not.

But no matter what I really do hope you will not catch it :)

It's not my privilege talking I don't think. In my country we're down to a few hundred cases per day and I have gone physically back to work since early June, business is looking up again.

That's the wrong trade-off I'm talking about. Yes, the lockdowns and measures hurt both privacy and economics, but not dealing with it hurts people more, both privileged and non-privileged, there are no winners.

Imagine in a country with 300 million people, if covid is not controlled it will cause tens of millions of hospitalizations, heart/lung damages, millions of stroke victims, the damage to liberty and prosperity is immeasurable. In a country like India there will not even be resources to appropriately care for everyone.

I also don't have a strong opinion about the apps in particular, just the general point. In Taiwan they gave everyone phones and manually checked on them every day. Quick, temporary restrictions have already enabled them to go back to normal life.

> Yes, the lockdowns and measures hurt both privacy and economics, but not dealing with it hurts people more, both privileged and non-privileged, there are no winners.

For western countries, we agree, economists are pretty much in agreement that the lockdown measures have been good (although the long term outlook isn't looking good).

For poorer countries, like India, that's simply not true.

When you've got a country of young people that are literally dying of hunger if they can't go to work, a 1% fatality rate starts to sound pretty good ;-)

And this is even true for the poor in the US as well. People are freaking out because they lack a social safety net and even the less fortunate in the middle class have burned through their savings. Good luck explaining to them that it's for their own good, because it isn't. It's for your own good, not theirs. It's privilege because you and I can afford to stay at home. People also judge such measures via what they can and can't afford. It's not bad to be privileged, but we need to recognize the position we are in.

And if you want to force people to stay at home, fine, but be prepared to pay the bill for it ;-)

> The false choice here is actually that you can sacrifice lives and still expect to have freedom.

To the contrary, lives sacrificed is necessary for liberty.

Personally, I would rather die of covid (or terrorists) than be locked in my house (or have my movements surveilled) by a government that fetishizes safety above all else. To hell with safety.

Why is it a false choice? The article mentions the success of South Korea’s system, and China has also had a lot more success controlling COVID-19 than most western countries.

I very much do not want to become China—yes, even at the cost of lives—but it’s worth looking seriously at what we’re giving up, and where we might (!) meet in the middle in times of extraordinary crisis.

Privacy is a fundamental part of freedom. If we don't have it, being technically breathing lacks value.

Privacy invasion is usually a lose-lose anyway

What is the life worth without privacy?

https://www.youtube.com/watch?v=eXWhbUUE4ko

When they come searching for you, privacy equates lives.

As the first generation to live in freedom after dictorship, I rather vote for privacy.

Yes. Protecting privacy is a better cause than most wars have been fought over.

That’s why the Apple/Google process was setup to not track your location.

Example of the success of the German app: https://www.lra-bgl.de/t/das-landratsamt/aktuelles/details/n... (sorry German)

In the region of Berchtesgaden a asymptomatic person for a warning from their app and was confirmed positive. Due to the app that person didn't spread further.

Now we can argue how many of such cases we need for calling it a true success and then we can discuss if a single case makes the news if that's a bad sign ... on the later it's important to mind that certainly not every case makes that news and it's from a region with low virus load to begin with.

Italy’s Immuni wasn’t downloaded enough to be a significant sample; people are too worried about their bloody battery performance and “what if I’m flagged and gub’mint makes me isolate home”. The National Health Service’s effort to run a population wide serological sample was also declined because “what if I’m positive and I need to stay home”. The fucking chemical reagents expired in the meantime.

It’s these times when I have to make an effort not to praise regimes for their efficiency in enforcement... or it’s just theater and marketing and human nature is rotting their process to the core as well..

Comments like "what if I’m flagged and gub’mint makes me isolate home" makes me think of people who object that the problem is idiot users who don't recognize a clearly superior product. If people don't trust the government, that's a failure of that government.

We’ve seen the same phenomenon across countries as different as Norway and Italy. Some fears are primal.

> the reliability of distance estimates using Bluetooth signal attenuation

Take a look NOVID [0] the app CMU professor and graduate students built.

It uses ultrasound to be accurate within 1m.

It also approaches the utility of contact tracing in a completely different way.

[0] https://www.novid.org/

Must be just lovely for pets at home or is it outside of the frequencies that cats can hear (up to 79 kHz)?

Also this thread is filled with people complaining about bluetooth spying capabilities and now you post an app with bluetooth always on AND microphone always listening?

Thanks for asking. I'm the founder of NOVID. Our app has a pet mode if your pet does not like it. This doesn't seem to have been a problem. The microphone is also not always listening. It turns on for 2 seconds when needed. The complete app source code has been given to a university security research team for review, and they will see that the microphone is used only for its intended purpose: to process ultrasonic frequencies.

Out of curiosity, why not make the app source-available?

Thank you for sharing this. I'm the founder of NOVID. The problem has been that no other app provided direct value to the user. Other apps are designed to protect other people from you if you get exposed (they then tell you to isolate to protect others). NOVID directly protects you from others, by anonymously warning you of COVID's approach along your relationship network.

This reversal of incentives is critical.

On top of that, NOVID also actually demonstrates the necessary accuracy to function. It is the only app which dares to report estimated distances to every user on their screen.

We are trying as hard as we can to let people know about these two major points of differentiation from the rest of the contact tracing app space. Thank you for helping!

> One of the potential advantages of a centralised model is that it would allow the use of machine learning to adapt thresholds to minimise error...

This is a cop out. Machine learning isn’t magic. If the proximity measurement doesn’t really work without ML then it’s probably not going to start working with ML. Besides, if you really wanted to do it in a decentralized app you could use federated learning, no?

ML could be an overstretch, but centralised approaches definitely do allow for more analysis and a deeper rules-based approach.

The thing that still blows my mind about the whole contact tracing solutions in Europe is that the servers do not federate with themselves, and that you can only keep a single country specific app active at the time.

This leads to the situation where people that usually cross the country's borders will only use a single app which may not track all of the contacts. So far, the current solution is IMHO useless - but I keep on using it.

In my case I just keep one app active at all time (the one from my home country), but it would be more effective if with a single app I was able to track the contacts with people from other countries too.

Stupid simple example: I live in Switzerland (SwissCovid), and ideally when I cross the italian border I'll need to activate the italian contact tracing app (Immuni), but contacts with people that use a different app won't be counted even if they are infected - which totally misses the point of having a contact tracing in the first place :(

There has to be a clever way of doing this that isn’t super invasive. Having businesses record their customers and retain the only copy seems like a good compromise except something like personal phone numbers would be abused.

Maybe best would be something identifiable only to the authorities but recorded and held only by businesses. Something like driver’s license date of issuance and first name. In theory that would be meaningless to my local coffee shop or grocer; but if I tested positive contact tracers could go there and get that info (maybe just the day of my visit, or afternoon, etc.) and then correlate and contact others who visited during that time.

South Korea already solved this problem: https://www.zdnet.com/article/south-korea-to-use-qr-codes-to...

There is QR code provider and QR code scanner. QR code provider includes Naver (Google in South Korea) and Kakao (WhatsApp in South Korea). QR code scanner is mandatory at venues. QR code is a random UUID. Venues keep UUID (but do not know real world identity), providers keep UUID-to-identity mapping (but do not know real world activity), KCDC gets feed from both venues and providers, join them, and do the contact tracing. In particular, it is legally mandated that only KCDC can do the join.

Asia has solved a lot of the issues surrounding the pandemic months ago. While American and European economies will be crushed by Corona (it's I bet it's not even half time) due to conspiracy theories, ignorance and egoists and adult babies crying about wearing a mask, Asia is getting back to ramp up their economies.

They are far more capable of shutting new clusters down AND CONTROL IT. When we send people into quarantine in the West, we plea for them to stay home and everything is trust based because we want to keep our free society. Effectively, only very large local outbreak cases enjoy oversight by authorities.

Taiwan's pandemic game was on point before WHO finally let the rest of the world know about what has been suppressed in China for weeks if not months. Due to China's pressure they aren't part of WHO or UN and had no "official" global way to tell the rest of the world. They did, but were dismissed due to the massive hubris in the West and the geopolitical game China is playing.

SARS 1 is still on everyone's mind in Asia while many Americans outright deny Corona's existence even in July 2020. It's nuts.

> …had no "official" global way to tell the rest of the world. They did, but were dismissed due to the massive hubris in the West and the geopolitical game China is playing.

What did they tell? It is frequently said that Taiwan sent an early email warning WHO about human-to-human transmission of what became known as SARS-CoV-2, and that the warning was ignored. This has been debunked and denied by Taiwan themselves[0]. On December 31, Taiwan and Wuhan Municipal Health Commission[1] both notified WHO about cases of pneumonia of unknown etymology[2], neither claiming human-to-human transmission.

That aside, I agree that a number of countries in East Asia, Taiwan included, fared much better than elsewhere in the world in terms of containing the spread of the virus.

[0] https://www.taipeitimes.com/News/front/archives/2020/04/12/2...

[1] https://www.who.int/news-room/detail/27-04-2020-who-timeline...

[2] Since WHO was contacted by both on the same day, it’s imaginable that Taiwan privately reached out to China first with “what’s that coming from Wuhan? we’re going international on this tomorrow”, putting the latter under pressure to report in order to save face. That would place Taiwan in good light even if human-to-human was not mentioned; unlikely to be substantiated though.

Yes such a shame we can't focus on our economy, just because of outdated things like liberty and human rights.

The Economist’s Democracy Index as of 2019 rates favorably enough most East Asian democracies that have been handling COVID-19 well so far; some of them score higher than the US or half of European countries.

It doesn’t seem like “capable of containing a highly infectious disease” and “oppressive” go hand in hand.

Privacy issues aside (it’ll only take so long for any pile of PII to leak), this looks like an effective and quick to implement make-shift solution (smartphones are widespread enough and venue employees can enforce the scan), though I’m not sure of how much benefit these QR codes are in Korea.

In Seoul—among highest in the country in terms of new infection cases—coffeeshops, study cafes and restaurants are routinely really crowded. I have been working or eating out in one of such places here every day past two months, and I have never have been asked to scan a QR code or noticed one. I’ve only learned about it thanks to your comment.

(That said, I haven’t gone to karaoke, clubs or jjimjilbangs, and I can’t speak Korean well.)

I think restaurants and cafes are a highly underestimated vector of SARS-CoV-2 transmission in Korea especially, since many of the customers aren’t wearing masks (because they’re eating) and often speak quite loudly (perhaps to drown out the inescapable loud music or from being drunk on a semi-mandatory after-work party). Usually bothersome just to me, now it’s objectively problematic—as some doctor pointed out in an interview about a choir group infection, literally the louder you are the more of your potentially-infected saliva is flying around.

PII is to be deleted after four weeks. KCDC has no need to contact trace after four weeks.

I agree with everything you said about Seoul, but that needs to be put in context (which we know, but HN mostly don't). Confirmed case numbers of Seoul in last 7 days (7/19 to 7/25) are 10, 2, 18, 16, 11, 19, 11 (total 77). Since total over South Korea in the same period is 168, it does make Seoul hotspot. But it is also far better compared to other countries.

Thanks, this was worth pointing out.

I should rephrase: it is not that the issue is “not solved”, but rather that it is difficult to measure whether these QR codes make much of a difference considering apparently lax enforcement and the already-low infection rates.

It’d be interesting to see if, implemented in a stricter manner, they could make a difference in a country like the US; the concept does seem sound.

This is completely missing what is likely the primary obstacle to adoption, at least in the US. Apple and Google require an entire state to commit exclusively to using a single app. Even though they use a protocol that would easily interoperate across jurisdictions and apps effectively.

City governments which could move much faster are unable to do anything. States are on fire dealing with others things. They also all want some smaller scale trial to happen first, but no one can do that according to Apple/Google policies. So they are all stuck in a chicken and egg problem...

(This is all according my sources working directly on such apps which were ready to deploy 3 months ago — but were completely stopped by the policy; I'm interested to hear if anyone is aware of reasons why this might not be accurate).

I think this is intentional to prevent confusion/abuse. The national app also gets singled out on the Play Store.

I disagree with the failure claims except for lack of adoption.

How can unreliable distance measurements be an issue? Actual viral spread over distance is a much, much bigger uncertainty. Even improving distance measurements to the nanometer wouldn't make much of a difference considering transmission prediction. Sometimes the virus bridges tens of meters, other times it fails to make landfall in a prolonged skin on skin situation.

Measuring impact is a simple polling research problem: if you want to know this kind of thing (and I think you should) you need to accompany your PCR tests with a tiny little questionnaire collecting data about why the test was done. Failure to collect that data is entirely unrelated to the app.

Contact tracing has unfortunately also failed as in "is buggy": https://news.ycombinator.com/item?id=23947323

To be clear, I've installed the tracing app, having the idea that it can only help to isolate hotspots, which however is mainly the health authorities' task. And 16+ million downloads (of how many eligible smartphone owners?) in Germany still makes Corona Warn-App a chart breaker I guess.

Just pay each person a $100 if they download the app, or whatever. People react to incentives, and downloading the app brings no personal benefit. Change that.

Really, I bet $10 would be enough to get a high adoption rate.

There's no mention of China in this article. China had a pretty large-scale tracing system using smartphones. Has that also failed?

I'm pleased to see this. I'm privacy forward and there is no doubt this information will be abused by private and public entities. We simply need to deal with this another way without giving up yet another bit of privacy.

This is looking at it from a technological angle. However, what about the social/financial aspects?

If I am told to self isolate for any duration of time, will the government provide 100% of my lost wages? Will they support businesses who could be put in real trouble from someone having time off? What about potential repeated cases of isolation?

Most people (including myself) will do anything to avoid being on their radar, and will not cooperate under any circumstance due to the reality that losing money is simply not an option for me, or my employers (where I could be replaced within a day, and that's my job gone).

Sadly, most governments haven't got well thought out policies, thus reducing the potential pool of users who'd engage with contact tracing (whether done via smartphone or manual like the UK).

We desperately need a UBI, for everyone, every month, forever, regardless of status (though, if you earn over a certain amount I'd agree with limiting the UBI, like for million/billionaires).

Otherwise, as we saw recently, someone infected over 70 people because she didn't isolate, because she needs food and a roof, it was a case of infect people (and risk them dying) or...dying because she can't afford rent/basics?

Yeah...This pandemic has exposed that capitalism is fucked, and during the worst virus outbreak this century there's no support for those that need it.

Even if I wanted to isolate, I couldn't afford to. Therefore I cannot comply with any contact tracing efforts.

All of this is true if you test positive with or without an app. The app helps you know you might be asymptomatic and spreading it to people that you know or don’t know, who can then die from it or otherwise be seriously injured.

Classic collective action problem. For a while, China was paying people who tested positive as a solution.

"Contact tracing" was the new "blockchain" for a while. It is a technology with great potential, but I don't expect a truely effective, well-designed solution to be deployed at a large enough scale to be useful for years to come. I think it will eventually mature enough to be useful for future outbreaks - even for more benign disease. For now, though, I want to see the technology spend a little more time in the oven.

Do you actually have specific criticisms or is this just a vague feeling? To say it’s not well thought out is a baseless accusation.

I don't think it's poorly thought out. I just think the tech is immature and the current incarnations will have to quickly improve or be superceded by something significantly better in the next few years.

I find it odd how many people get paranoid with tracing but still use Facebook or google products...

It's because the privacy-at-any-cost camp, like the EFF, raised hell and prevented Apple from making an app themselves. So only cash-starved state governments can make apps, which is unlikely to happen.

They have blood on their hands.

Not possible until UWB is ubiquitous.

I was suspicious of the effectiveness of contact tracing apps, which have to rely on something as unreliable as Bluetooth to estimate distance across different kinds of hardware, different kinds of software drivers and in different situations. That got worse with some governments wanting to collect location information through the contact tracing apps 24/7 and centralize it.

> It would appear that no government has thought this out properly yet.

This seems to be true at least in India, where the app is a centralized one that doesn’t use the Apple/Google framework The app tracks the location of users at all times (it asks for that permission) and hence cannot use the APIs since Apple and Google prohibit such apps from collecting location information. Since it requires background location access and Internet connectivity, it’s a good addition to drain batteries quicker.

The government also famously declared that the app would be open sourced so that it could be improved and issues fixed. That turned out to be a farce with the source released only for the Android version, and that too for an older version of the app with some code removed (the code on the Play Store was newer). They stopped releasing updates of the source. They didn’t release the source of the iOS app, which was supposed to be “shortly” (that was around two months ago). They didn’t fix the issues that people raised on GitHub. Yet the government claimed that the app was effective and put out some numbers on it being useful (without any backing data or any way to verify those claims).

It gets even worse. The app being a platform for contact tracing is only one facet. The goal that wasn’t widely disclosed was to have private companies build on top of the app and its server side data to create platforms on health data collected from hundreds of millions of people. Note that India doesn’t have a data privacy or data protection law, leave alone anything to control health related data in the hands of crony capitalists and opportunists.

Now all talk about contact tracing and its effectiveness is muted or nowhere to be seen, though the app is being pushed as a requirement to give people permission to travel and for other purposes.

The platform has become, and is continuing to become, what some people feared...and that’s getting farther from handling COVID-19 or a public health crisis.

You don't want to install a tracing app for "privacy reasons" fine.

Just make sure you don't have any of: Google's location history turned on, any FB app (FB/Instagram/Whatsapp), TikTok, 4sq/swarm, Tinder, Happn, or any app that has fine-grained location permissions.

This!

"I care so much about my privacy!!!1!!1

- Sent from my android phone. "

go figure...

Ah yes, the waterproof "some bad things are happening, it must mean that this other bad thing happening is also fine"-argument.

"Most people infect their devices with malware from the internet, let's all preinstall malware to every device because it has the same end result."

> Ah yes, the waterproof "some bad things are happening, it must mean that this other bad thing happening is also fine"-argument.

Ah yes the good strawman fallacy argument

Funny how the contact tracing app requires no special permissions. None. Every extra data is completely optional.

Sure it is your choice to not install the C.T. app and install other data-hoarding apps but know what you're doing.

> Ah yes the good strawman fallacy argument

It isn't, that's literally what you said. That we should be okay with contact tracing if we have anything else that uses the fine-grained location permission.

Contact Tracing is not recommended (and basically pointless) for mild respiratory illnesses like Coronaviruses because for the vast majority of people, they are asymptomatic or lowly symptomatic, and the spread can be extensive.

Its only recommended for more serious viruses like Ebola.

Reply on news.ycombinator.com