News for hackers. Stuff that matters.
Re:Me on Covid-19 contact tracing apps by quicklime on Friday May 01, 2020 @09:32AM (#23041796)
> Assume you take the app out grocery shopping with you and it subsequently alerts you of a contact. What should you do? ...the alert is useless.

This feels like the mask debate again. It doesn’t guarantee safety, so it’s useless.

But there are plenty of things you could do.

You could carry on but avoid visiting your elderly parents, and cancel your plans to attend a crowded event. You could start walking or driving to work instead of taking the train. Or work from home more often.

It’s not a choice between quarantine or complete freedom, there are grey areas in between.

Get one of these alerts? Start taking more precautions. Get many more? Start taking more extreme caution.

Re:Me on Covid-19 contact tracing apps by mstolpm on Friday May 01, 2020 @09:53AM (#23041969)
Some of the problems: If you get an alert, are you personally responsible if you aren't going to self-quarantine immediately and perhaps infect others after being notified? What use would a tracing app have if anyone could ignore alerts at will, because s/he has no symptoms and is afraid of job loss if quarantining?

On the other hand: What about people not using the app or just disabling bluetooth because they are afraid of being helt responsible? What if your employer, your supermarket or your health insurance demands that only users of the app are served/welcome? Are they allowed to check that you conform, even if the use itself is volontary?

I'm not against a tracing app, but lots of unsolved questions aren't even discussed openly.

Re:Me on Covid-19 contact tracing apps by quicklime on Friday May 01, 2020 @10:21AM (#23042229)
I would probably err on the side of making it opt-out and not mandatory. You’ve got a valid and interesting question, but my comment was in response to Schneier’s claim that contract tracking apps are “useless”.

> What use would a tracing app have if anyone could ignore alerts at will, because s/he has no symptoms and is afraid of job loss if quarantining?

I think this is another example where things are a bit too binary. If anyone could ignore the alert, then some probably will and the rest won’t. The fact that the rest are taking this seriously still helps to avoid some number of transmissions.

Re:Me on Covid-19 contact tracing apps by tastroder on Friday May 01, 2020 @10:03AM (#23042065)
> I'm not against a tracing app, but lots of unsolved questions aren't even discussed openly.

Weird, I see the points you made brought up in many discussions that are tad more professional than a Twitter argument.

Your first point is addressed by the fact that these apps are developed in tandem with health authorities. You don't just get locked away for two weeks because your phone popped up a notification. Just like there's stages for isolation there's ways to make this more compatible with regular life and still maintaining an impact on hindering the spread of this pandemic, e.g. getting you tested quickly instead of automatic isolation. Of course from an epidemiological standpoint one might argue that immediate isolation would be advisable but I doubt that would go over well in most democracies. The job loss argument seems like the economic impact argument brought up a lot over the last few weeks. On a population scale, an asymptomatic superspreader is likely far more expensive than somebody not going to work for a few days until they got tested so it could/should be addressed by policy makers. If your politicians can't figure out how to make mandatory sick leave happen during an active pandemic I'm not convinced a contact tracing app is the problem.

The debate on voluntary or mandatory usage will surely be interesting, though I don't see how making it mandatory would not lead to people actively avoiding it's use and thus lessening the efficacy.

Re:Me on Covid-19 contact tracing apps by AlanSE on Friday May 01, 2020 @02:56PM (#23045325)
> On a population scale, an asymptomatic superspreader is likely far more expensive than somebody not going to work for a few days until they got tested so it could/should be addressed by policy makers. If your politicians can't figure out how to make mandatory sick leave happen during an active pandemic I'm not convinced a contact tracing app is the problem.

That's pretty much the endpoint of the discussion.

We've already established there is no magic bullet for this. Even the most promising therapeutics, in the best case, will not return us to normal by the fall. Source - https://www.gatesnotes.com/Health/Pandemic-Innovation

We are counting on vaccines, but the timelines already have a huge amount of optimism backed into them. We can hardly stand 18 months more of this, but yet rollout may drag on longer than that if the trials encounter setbacks.

If we don't ramp up and improve testing then we're screwed. No matter what else happens, that banishes us to isolation with no end in sight. Thankfully, testing is one area where we can and probably will come up to snuff in the summer months. That doesn't get us back to normal or normal-ish.

The app would be a tremendously powerful tool. If you take this seriously, then you will value even meager tools that help move the needle in the right direction. People still holding out hope for that magic bullet are delusional, and they need to wake up to reality.

Re:Me on Covid-19 contact tracing apps by sroussey on Friday May 01, 2020 @11:25AM (#23042929)
Indeed, if you don’t quarantine after notification, then what is your liability?

If someone gets sick and dies and tracing leads back to you?

Re:Me on Covid-19 contact tracing apps by spuz on Friday May 01, 2020 @12:45PM (#23043921)
Presumably, if you decide to install the app, it's because you are willing to consider altering your behaviour based on the alerts it gives you. You might find forcing people to install it has little benefit because of the point you mentioned but I don't think anyone is talking about making it mandatory.
Re:Me on Covid-19 contact tracing apps by oliver2213 on Friday May 01, 2020 @01:22PM (#23044350)
From what I've read, apple and google appear to be working on rolling out APIs for contact tracing on their platforms, and apps you explicitly install are supposedly just the first stage, with later in-platform functionality presumably to come with regular OS updates. So It might not always be a deliberate choice made by users in the future, for good or ill.
Re:Me on Covid-19 contact tracing apps by AlanSE on Friday May 01, 2020 @02:59PM (#23045370)
That sound really speculative. What exact wording did you see that makes you think this?
Re:Me on Covid-19 contact tracing apps by tinus_hn on Saturday May 02, 2020 @03:33AM (#23050088)
No, the OS updates provide apis that apps that you voluntarily install can use. They don’t work on their own.
Re:Me on Covid-19 contact tracing apps by timkam on Friday May 01, 2020 @09:51AM (#23041957)
Masks directly help prevent spread, the app does not. It's essentially a decision-support system, and I agree with Schneier that on an individual contact tracing-level, it's probably not a good one. But _perhaps_ it helps if it's well-designed and presents aggregates of probabilistic information well. If its underlying models are good it can, for example, inform a user where not to go because the infection risk is too high, after it has gathered data of frequent close encounters between otherwise "distanced" people in a location.
Re:Me on Covid-19 contact tracing apps by AlanSE on Friday May 01, 2020 @03:05PM (#23045430)
Comparing it to the alternative of health professionals doing contact tracing, in addition to the fact that it's vastly better at its job, it would also be a privacy-protecting system.

Say that I have close contact with a co-worker named Joe on a regular basis. I get diagnosed positive. I don't have Joe's phone (it's not all that normal to exchange personal phone numbers with co-workers). So now I'm asking sick time from my manager John and talking with someone performing contact tracing. Now this health professional has to play phone tag to get Joe's number, and John will obviously put 2-and-2 together and know what happened. So will others in the phone tag.

Re:Me on Covid-19 contact tracing apps by athenot on Friday May 01, 2020 @09:35AM (#23041823)
The counterpoint is that those are things to be done regardless. Because the absence of an alert doesn't make visiting my elderly parents any safer.
Re:Me on Covid-19 contact tracing apps by alistairSH on Friday May 01, 2020 @09:53AM (#23041973)
Not wrong, but also doesn't allow us to get back to normal in any meaningful way.

That said, I don't believe we're at the point in the curve where we should be returning to normal. Contact tracing apps feel much more useful when we're into the tail end of the pandemic, where infection is far less likely. And only of value if usage of the tracing apps is very high.

Re:Me on Covid-19 contact tracing apps by tigroferoce on Friday May 01, 2020 @10:06AM (#23042082)
I think that we won't go back to normal (like pre-COVID normal) for a long time. Unfortunately there is no silver bullet yet, and we should prepare to live without one for a while; in the meanwhile we will adopt a number of means to keep the virus diffusion low, and the lockdown away.

A contact tracing app (like a mask or washing hands) is among those things. If it is not privacy intrusive and it has some effectiveness, it's OK for me. I'm happy to reduce the infection rate, even if it's just a few decimal points.

I really don't understand all these discussions about something that might save lives. IMO the real discussion should be whether these app are privacy preserving enough. Are there (realistic) attacks on these apps? How can we mitigate them?

Re:Me on Covid-19 contact tracing apps by jgraham on Friday May 01, 2020 @11:57AM (#23043357)
> I really don't understand all these discussions about something that might save lives. IMO the real discussion should be whether these app are privacy preserving enough. Are there (realistic) attacks on these apps? How can we mitigate them?

The problem is there's likely a pretty direct tradeoff between preserving privacy and efficacy. So I think people whose main concern is privacy are taking the position that the apps can't work, without being clear about the fact that it really depends on what assumptions you make around enforcement.

Clear disclaimer: I'm not anything like an expert here. Much of what I've written below is likely wrong or misleading and I'd welcome corrections.

A simple, bad, toy model is that the fraction of infection chains you prevent is (fraction of people using the app)^2 x (fraction of transmissions detected) x (fraction of people who comply). So if your model is "app usage must be opt-in" and "it must be impossible to tell who is complying with the app's recommendations" you do indeed find that the app only detects a small fraction of transmission chains (e.g. assuming 50% of the population opts in, 80% of transmission events are detected, and there's 50% compliance rate, you only stop 10% of infection chains). But if it's mandatory to use the app, and there's a mechanism to ensure enforcement you can do much better e.g. with 80% of people using it and 95% compliance you're closer to stopping 50% of transmission chains.

Of course that model is far too simple to be correct. But https://045.medsci.ox.ac.uk/files/files/report-effective-app... models this in more detail. Their simulation finds that you can suppress the overall transmission in the UK with 80% of smartphone users using the app (56% of population, comparable to the most popular apps), 80% detection of transmission, and 2% dropout rate per day on a quarantine period for all individuals flagged as contacts, which lasts up to 2 weeks. I don't know what they used to come up with that number for dropout rate, but it seems highly optimistic if the information about who has registered as a contact is kept private. They also find that up to half the population might be in quarantine at any one time, which I suspect is higher than most people are anticipating for a post-lockdown period. To combat this, they propose various going through a process of optimising the algorithm based on feedback, but again, if the most-privacy-preserving approach is taken for the data collection, performing such optimisations may become difficult or even impossible, since you won't be able to followup on individuals.

So, my — non-expert — conclusion at this point is that privacy-preserving digital contact tracing probably isn't going to be that useful because people either won't use it or won't follow the advice when doing so is inconvenient (e.g. because it puts their employment at risk). But digital contact tracing in general seems like it can help, if you can drive both usage and compliance high enough.

So there may be a pretty direct tradeoff here between our ability to trust the health services with personal data and our ability to prevent further rounds of unchecked exponential growth of this virus. And that is worrying, because — as a British person — I'm very unexcited about giving a government that has a history of using targeted data from social media to achieve policy ends even more data to work with. But I don't know that I can construct a satisfactory argument that it's OK for people to die, or even for those that don't to suffer an additional year of economic disruption, in order to avoid the privacy implications of a system of contact-tracing-with-enforcement. And I also worry that those who would be happy to collect this data will use the launch of an initial ineffective app, and a corresponding second wave of infections, as a way to make this kind of data privacy socially unacceptable.

Maybe there's an argument that by focusing on legal limits to the use of the data rather than to technical controls on its availability, we will end up in a better position in five years time, not just on the pandemic, but also on privacy.

Re:Me on Covid-19 contact tracing apps by spuz on Friday May 01, 2020 @12:55PM (#23044044)
> 2% dropout rate per day on a quarantine period for all individuals flagged as contacts, which lasts up to 2 weeks. I don't know what they used to come up with that number for dropout rate, but it seems highly optimistic if the information about who has registered as a contact is kept private

Sorry but I don't understand how keeping contact information private or public has any effect on the compliance of people to stay in quarantine?

> So, my — non-expert — conclusion at this point is that privacy-preserving digital contact tracing probably isn't going to be that useful because people either won't use it or won't follow the advice when doing so is inconvenient (e.g. because it puts their employment at risk). But digital contact tracing in general seems like it can help, if you can drive both usage and compliance high enough.

I don't understand why you think an app that can promise to keep people's personal data private would gain lower adoption than one that was explicitly collecting such data. Maybe I've misunderstood what you're trying to say here but it would make more sense to me that an app that can preserve privacy would have higher adoption, higher trust and therefore higher compliance levels.

Re:Me on Covid-19 contact tracing apps by jgraham on Friday May 01, 2020 @01:41PM (#23044574)
> Sorry but I don't understand how keeping contact information private or public has any effect on the compliance of people to stay in quarantine?

Because if you know who's supposed to be in quarantine you can take steps to verify that they actually are. And also because people are simply less likely to comply with rules when they know no one can tell if they're following them.

> I don't understand why you think an app that can promise to keep people's personal data private would gain lower adoption than one that was explicitly collecting such data. Maybe I've misunderstood what you're trying to say here but it would make more sense to me that an app that can preserve privacy would have higher adoption, higher trust and therefore higher compliance levels.

Again, because you're comparing "opt-in and private" with "opt-in and non-private". I'm comparing "opt-in and private" with "mandatory and shares user data with the health authorities" (which is different from "[opt-in|mandatory] and public" in that in the latter case any member of the public can get information about infections; I think South Korea are/were running a system with that level of sharing).

Re:Me on Covid-19 contact tracing apps by spuz on Friday May 01, 2020 @05:19PM (#23046616)
Thanks, I can definitely see how making either downloading and running the app or following the declared quarantine measures mandatory could backfire.

I'm already disappointed that the UK government feel it necessary to keep track of personal data (they announced recently they were not going to use Google/Apple's API for this reason). I really hope they don't try to force people to use the app or follow its directives.

Re:Me on Covid-19 contact tracing apps by jsight on Friday May 01, 2020 @10:02AM (#23042052)
Out here in the real world, people will not 100% avoid visiting the elderly for 12-24 months.
Re:Me on Covid-19 contact tracing apps by mnm1 on Friday May 01, 2020 @12:47PM (#23043958)
Or you might even take a test yourself to confirm and then isolate or not based on that. The fact that the author doesn't consider that as a logical next step destroys his whole argument. What an incredibly weak article. It doesn't even touch on the privacy implications, which would have made it interesting rather than garbage.
Re:Me on Covid-19 contact tracing apps by JoBrad on Friday May 01, 2020 @09:45AM (#23041910)
And if you have family at your house, you could self-quarantine away from them for 2 weeks.