12 ms·

Me on Covid-19 contact tracing apps

167 points by generalpass 6y ago

kolbe 6y ago
I have a rather cynical prediction for these apps: they will be mandatory for us to have to use various public services, and they will cost absurd amounts of money. This will be regardless of the efficacy because the goal isn’t safety or surveillance, but extracting rents for the politically-connected people who will be “approved vendors.”
- generalpass 6y ago
  I suspect there will be multiple flavors of bootleggers and multiple flavors of baptists.
Gravityloss 6y ago
The points are worth discussing and putting some numbers on. What false negative and false positive rates, installation percentage among population and other things are acceptable for still useful contact tracing? And how does it tie to testing availability etc.
- tastroder 6y ago
  https://twitter.com/eredmil1/status/1255934130753204224 https://twitter.com/eredmil1/status/1255934130753204224 this had preliminary results on questionnaires w.r.t. user acceptance . This https://science.sciencemag.org/content/early/2020/04/09/science.abb6936 https://science.sciencemag.org/content/early/2020/04/09/scie... paper looks at how effective it is given N% of the population using it and I've not seen any info that it hurt the situation in Singapore.
  - Gravityloss 6y ago
    https://medium.com/@tomaspueyo/coronavirus-how-to-do-testing-and-contact-tracing-bde85b64072e https://medium.com/@tomaspueyo/coronavirus-how-to-do-testing... This article argue why it's not very likely to be good, compared to manual contact tracing. I don't agree with all the points, but it is a valuable read. There is a lot of other good things there as well.
    - tastroder 6y ago
      When discussing the paper I linked this article says "That sounds hard. The good news is that, done well, this measure alone could stop the epidemic. But even if you don’t do it well, it contributes." and correctly calls for combination with other measures. That's my main point, even if it's not as good as manual contact tracing the allegation that this is "tracing app" vs. anything else is just a pointless debate that Schneiers post seems to further. Like the article you posted seems to say, we should improve manual tracing and testing as well but I haven't seen anything in there that would support the Schneier viewpoint on first glance. Looks like an interesting read for later though, thanks for sharing!
TechBro8615 6y ago
I’m glad to see Schneier come out with an opinion against these apps. Up until now, it’s seemed like the privacy community has been almost excited about the idea of these tracking apps. Maybe because it’s a cool academic problem? I don’t know. Take this DP-3T project for example. It’s really interesting tech, and a great group of people behind it. But the government doesn’t care for this nuance of what is privacy preserving tech and what is not. For now, maybe at the beginning, privacy will be emphasized. But the important part is conditioning citizens to be okay with the underlying idea of technology assisted self-surveillance, and compliance with notifications on their phone telling them to stay inside. Schneier raises the point of false positives, which is important with regards to this idea of conditioning. What do you do when you get a notification that someone “nearby” tested positive? Do you take time off work and isolate yourself in your house for two weeks, just because some beacon passed within two meters of you within the past two weeks? Even if you have no symptoms at all? Just because you got a notification on your phone? This just seems unrealistic to me. My other worry is the classic “slippery slope.” Maybe people are okay with these apps in their current form, if they’re privacy-preserving. (Personally, I doubt anyone outside tech can recognize the difference anyway, but let’s assume the wider populace takes its lead from us). Isn’t there a risk that eventually people will forget about the underlying details and privacy will be deemphasized? “You were okay with TrackingApp 1.0, why wouldn’t you be okay with TrackingApp 2.0?” If we give an inch now, will the government take a mile later? Who’s to say the emphasis on privacy will remain in place? Heck, it’s not even clear whether it will be in place from the beginning. The NHS is already saying they don’t want to use it, choosing instead to build their own centralized solution. Again — it’s extremely concerning to me to see the general vibe of excitement coming out of the tech community around these apps. I’m really disappointed and would expect to see more skepticism. So, kudos to Schneier for going against the grain here.
- svdr 6y ago
  And what if you can easily get tested if you get notified?
  - xorfish 6y ago
    The Swiss COVID-19 Science Task force recommends a test at the beginning and the end of the Quarantine and if someone shows symptoms. https://ncs-tf.ch/en/policy-briefs https://ncs-tf.ch/en/policy-briefs --> Contact Tracing
brenden2 6y ago
Another take: all these things (shutdowns, contact tracing, social distancing) are measures to give people a sense of security, and make them feel as if the PIC are doing something useful. At the end of the day, the virus will do what the virus does, with or without apps. Until there's herd immunity or a vaccine, this will remain a politically charged issue and there will be constant jockeying for political clout (and I'm using the term 'political' in a sense that includes private entities trying to win favours in the eyes of the public). I agree with Bruce, the contact tracing apps are goofy and I don't see how they will make the virus stop spreading without other changes such as widely available cheap home test kits.
- dchyrdvh 6y ago
  TBH, the real solution will be reopening the economy with masks on and social distancing. Vaccine is a pipe dream and by the time it might be created, everyone will have been infected a few times. My conspiracy theory is that the government understands that very soon everyone will wear masks and sunglasses and all the face-recognition tracking will become useless, so to compensate for that, they are pushing hard for alternatives. Once masks get normalized and the infection rate drops to manageable levels, the opportunity to push this app surveillance will be lost.
  - brenden2 6y ago
    I'd agree that qualifies as a conspiracy theory.
kohtatsu 6y ago
I really think the equivalent of paper journals is the way to go. As well as some way to report to grocery stores etc you've visited after testing positive. Heck an answering machine at the grocery store that reports known cases, which everyone calls each Sunday would be enough.
tastroder 6y ago
> [...] and Bluetooth -- just aren't accurate enough to capture every contact. Did I miss his paper on the matter? There's dozens of groups working on this and even with a regular free space model the results seem "good enough" in <2m,15min scenarios for an additional data point. Most of this seems to leave out that digital contact tracing is not a cure all but a tool to help manual efforts. I somewhat hate the simplification people bring here, that every additional identified contact helps, but dismissing it as "plain dumb" seems rather shallow as well. Sure, false negatives will be a thing, the false negative rate of not doing digital contact tracing at all would be higher by definition. Most of what he outlined can occur in manual contact tracing as well and we still do that, simply because it's necessary. I haven't seen anything so far that would suggest that digital contact tracing in the poster child Singapore had any of the negative impact he brings to the table here and studies like Ferretti et al. [0] seem to make a pretty good case why it would at least not hurt the overall epidemiological goal. > It's not accurate enough for you to quarantine yourself for two weeks. And without ubiquitous, cheap, fast, and accurate testing, you can't confirm the app's diagnosis. So the alert is useless. The time frame and assumptions on testing capability is US centric I assume? If you can get a quick test it would not be two weeks, it's likely quick tests will become more prevalent if this sticks around long enough and testing capability will be raised to sufficient levels. Otherwise yes, false positives would quickly diminish usage. Of course some of his points are valid and need to be addressed by OS vendors, apps and policy makers, and evaluation of efficacy will be just as critical as teaching the public that having an app does not mean things can go back to normal. There's also plenty of opportunity for abuse even with the commonly decentralized architecture that is at the moment widely agreed upon but none of that supports the allegations of this particular article imho. The comments similarly bring up things like "surface transmission" as if that mattered at all. If you treat a contact tracing app as an additional data point it becomes much more sensible. [0] https://science.sciencemag.org/content/early/2020/04/09/science.abb6936 https://science.sciencemag.org/content/early/2020/04/09/scie...
- nocturnial 6y ago
  What percentage of the population should install and use this before it becomes useful? The latest survey in my country said less than 50% were willing to adopt it and the number in the article mentions only 20% in Singapore.
buboard 6y ago
It doesn't matter; politicians already love it because they appear to be “Doing Something(TM)”, and the ~~commecial arm of NSA~~, er, big tech are excited to provide yet one more surveillance tool. What could go wrong? This year it will be for covid, next year for influenza, then u re just going to have to learn to live with it.
dangoor 6y ago
I think the point of contact tracing is not that it's a silver bullet used alone, but rather a piece used alongside more widespread testing to help lower the rate of transmission. It may be reasonable to argue that these tracing apps alone aren't valuable, but once you add in greater test availability, it seems like they can help. https://ethics.harvard.edu/covid-roadmap https://ethics.harvard.edu/covid-roadmap
- deeringc 6y ago
  Right - this is just a way of helping to prioritizing who gets tested. Given that testing kits will always be a limited resource (you can't simply test everyone, everyday) it makes a lot of sense to find sub-populations who are more likely to be positive. That doesn't mean you don't test anyone else (eg. those with symptoms, those in sensitive jobs) - it just lets you use a certain percentage of your testing capacity one those people who have been in proximity with confirmed cases. As you say, it's not a silver bullet but in combination with a slew of other approaches can help reduce the rate of transmission rate.
quicklime 6y ago
> Assume you take the app out grocery shopping with you and it subsequently alerts you of a contact. What should you do? ...the alert is useless. This feels like the mask debate again. It doesn’t guarantee safety, so it’s useless. But there are plenty of things you could do. You could carry on but avoid visiting your elderly parents, and cancel your plans to attend a crowded event. You could start walking or driving to work instead of taking the train. Or work from home more often. It’s not a choice between quarantine or complete freedom, there are grey areas in between. Get one of these alerts? Start taking more precautions. Get many more? Start taking more extreme caution.
- athenot 6y ago
  The counterpoint is that those are things to be done regardless. Because the absence of an alert doesn't make visiting my elderly parents any safer.
  - alistairSH 6y ago
    Not wrong, but also doesn't allow us to get back to normal in any meaningful way. That said, I don't believe we're at the point in the curve where we should be returning to normal. Contact tracing apps feel much more useful when we're into the tail end of the pandemic, where infection is far less likely. And only of value if usage of the tracing apps is very high.
    - tigroferoce 6y ago
      I think that we won't go back to normal (like pre-COVID normal) for a long time. Unfortunately there is no silver bullet yet, and we should prepare to live without one for a while; in the meanwhile we will adopt a number of means to keep the virus diffusion low, and the lockdown away. A contact tracing app (like a mask or washing hands) is among those things. If it is not privacy intrusive and it has some effectiveness, it's OK for me. I'm happy to reduce the infection rate, even if it's just a few decimal points. I really don't understand all these discussions about something that might save lives. IMO the real discussion should be whether these app are privacy preserving enough. Are there (realistic) attacks on these apps? How can we mitigate them?
samwillis 6y ago
Thinking "its not accurate enough" should not EVER be a reason to decide not to try something that could potentually help in this unprecedented situation. It may well not work well enough but we won't know unless we try! Each individual incremental activity, process, treatment, protection or APP that takes us a little closer to successfully fighting this thing should be done and done in conjunction with the others.
- eli 6y ago
  Especially when you have no particular knowledge or citations as to what an appropriate standard for "enough" might be.
  - deeringc 6y ago
    Exactly - I have huge respect for Bruce Schneier when it comes to matters relating to cryptography. But apart from commenting on the security, privacy and other technical aspects of these apps, I'm not sure on which authority he's giving these opinions on matters relating to epidemiology. At very least I'd like him to give some supporting scientific citations. But as it stands, Bruce's opinion on the medical and public health efficacy of these apps is no more valuable than yours or mine.
- kxyvr 6y ago
  Actually, yes it should, but it depends on the numbers and this is a well studied area of statistics. One of the many issues is whether or not someone who flags positive is actually positive and whether someone who flags negative is actually negative. This depends not only the sensitivity (if someone is sick, will they flag positive) and specificity (if someone is healthy, will they flag negative), but on how prevalent a disease is within a population. That last quantity is constantly changing, which also means that this calculation is constantly changing, which can and should affect policy. Now, the issue is that if you start telling a bunch of healthy people that they're actually sick and want them to quarantine or that a bunch of sick people are actually healthy and that they're free to go there are consequences. One, people will lose faith in the system and stop listening at all. Two, healthy people who work in an essential area can now not actually do their job. Three, sick people in an essential area are now going back to work and getting other people sick. That doesn't mean that nothing should be done. However, it may absolutely mean that this particular method should not be done because it will cause more harm than doing the proverbially nothing. As for this particular article, it's not great because it doesn't actually work these numbers. It would be a good article if it actually calculated whether or not the app is worthwhile given a certain prevalence, sensitivity, and specificity. Personally, I don't know rate of prevalence of COVID-19 nor the sensitivity or specificity of the existing tests. However, I still strongly reject the premise that any test or contact tracing app is better than none at all. In order to fully beat a dead horse, here's the wiki that runs through how to calculate these numbers: https://en.wikipedia.org/wiki/Sensitivity_and_specificity https://en.wikipedia.org/wiki/Sensitivity_and_specificity I don't like their presentation, but it is what it is. Here is some Octave code that runs through their example with some more readable names: % Total population pop = 2030; % If someone is sick, will they test positive sensitivity = 0.67; % If someone is healthy, will they test negative specificity = 0.91; % Prevalence of the disease prevalence = 0.0148; % Works some numbers sick_pop = pop * prevalence; healthy_pop = pop * (1-prevalence); sick_pop_tested_positive = round(sick_pop * sensitivity); sick_pop_tested_negative = round(sick_pop * (1-sensitivity)); healthy_pop_tested_negative = round(healthy_pop * specificity); healthy_pop_tested_positive = round(healthy_pop * (1-specificity)); % Derive some useful quantities fprintf( ... ['Of those who tested as sick, percent of those actually ' ... 'sick (positive predictive value): %2.1f%%\n'], ... 100*(sick_pop_tested_positive / ... (sick_pop_tested_positive + healthy_pop_tested_positive))); fprintf( ... ['Of those who tested as healthy, percent of those actually ' ... 'healthy (negative predictive value): %2.1f%%\n'], ... 100*(healthy_pop_tested_negative / ... (healthy_pop_tested_negative + sick_pop_tested_negative))); > Of those who tested as sick, percent of those actually sick (positive predictive value): 10.0% > Of those who tested as healthy, percent of those actually healthy (negative predictive value): 99.5%
dustingetz 6y ago
If software is the new bureaucracy and this app can put you in a detention center, oof. How do you get out when the software is wrong?
feral 6y ago
This is a weak argument from Schneier. Most of his concerns (false positives, false negatives) also apply to contact tracing done by humans, which he advocates at the end of his article. If a medical professional interviews you about your contacts, you have to remember who they were. If you forget someone, or didn't know their name, that's a false negative. Someone you report you had coffee with, but who doesn't get the disease, is a false positive. Apps have different limitations, and need adoption to be useful, and that's a problem societies will have to consider. There's also legit privacy concerns. But the very broad argument made in that post is silly. You just don't need to stop every transmission to stop the disease. Even stopping 70%, via a range of measures, is about enough. You can tolerate some errors.
- mellow2020 6y ago
  The dichotomy isn't between the app or a medical professional guessing, based on contacts, whether someone might be infected and whether they should self-quarantine. The dichotomy is between guessing infection based on contacts and testing for infection.
  - pimterry 6y ago
    There isn't a dichotomy. We can use all these techniques. Testing is great of course, but given that you can't test everybody every day, testing is more effective when you can test the right people. If we can trace contacts, we can prioritize testing of people who've had a possible contact recently, and thereby find and quarantine infectious people faster.
    - mellow2020 6y ago
      > There isn't a dichotomy. I simply meant that this "without ubiquitous, cheap, fast, and accurate testing, you can't confirm the app's diagnosis. So the alert is useless." was turned into medical professionals asking someone about contacts, a la "Someone you report you had coffee with, but who doesn't get the disease, is a false positive" to show that getting asked about contacts by medical professionals isn't better than a contact tracing app, which is a straw man, i.e. Schneier didn't ask for medical professionals to ask those questions, he said those questions are useless without tests.
m3kw9 6y ago
If contact tracing can be better than 50-50 it will be better than knowing nothing like we are now when ever we go out. If it is les than 50/50 it could have fatal consequences where people lower their guards because of too much trust into the data that is probably wrong
finnthehuman 6y ago
>That loss of trust is even worse than having no app at all. Suddenly, for the first time, I'm sold on contract tracking apps. Lets build them and push them far and wide. If the hype cycle and subsequent arguments regarding contract tracking have shown us anything, it's that everyone needs to stop trusting claims of "it's for your own good."
ck2 6y ago
Half the population won't even voluntarily wear a mask or isolate. Some even go anywhere they want coughing constantly. So how exactly is voluntary contract tracing anything but an utter fantasy and hand waving that it "exists" so magically protects us?
zvrba 6y ago
For me it's both about the privacy and vulnerabilities in the Bluetooth stack such as https://www.armis.com/blueborne/ https://www.armis.com/blueborne/ According to the article, you need Sep 9 2017 security patch level, but my 5 year old phone is on Sep 1 2017 level. No way I'm going to have Bluetooth turned on in untrusted areas. While I'm unlikely to get hacked on the street or in a store, it gets more likely in places like a bus or a train (while commuting).
pimterry 6y ago
Don't these arguments apply equally well for manual contact tracing? There will be very significant false positives and negatives there too. I would expect that a contact tracing app can actually make a much more accurate list. Trying to accurately remember who I was near and for how long over the last X days is difficult (given that I'm not confined in my house, of course) Even with intensive manual research, working out who it was that cycled behind me for 5 minutes this morning or who I coughed next to at the cheese counter is going to be remarkably difficult. Apps can plausible cover some of those cases. We'll need to tune the alerts for acceptable precision & accuracy, as a function of the signal strength & duration of each contact, but that seems like a tractable problem, and again seems very similar to judging the risk of manually collected contact events. Despite all these possible inaccuracies, AFAICT contact tracing has been shown to be very effective, and is a well respected technique. I don't see anything here about how apps will be significantly worse. This assumes a significant install base of course, but I think that's tractable.
- jerf 6y ago
  "Don't these arguments apply equally well for manual contact tracing?" No. They mostly apply to manual contact tracing, certainly, but they do not apply equally well. A human being doing it is much smarter. They do take into account the fact that someone was on the other side of a wall. They are not limited by whether or not someone installed the app. They can use their brain to solve little local issues that the app can't even perceive which cumulatively add up to a huge difference. The app has a few advantages over the human, too, but I don't think it's that surprising at all that when it's all summed up and accounted for it ends up heavily Advantage: Dedicated Human. The modest advantages are trashed by the massive disadvantages.
  - pimterry 6y ago
    I agree there's cases that humans will handle better, but there's also cases where the apps will do better too, and I wouldn't be surprised if it was a wash (soon hopefully we'll have some actual research on this!). For example, in most situations where you're near an anonymous stranger, manual tracing is going to have a lot of trouble. That's a _lot_ of cases. You're almost certainly not going to be able to hunt down the person you sat next to on the metro for half an hour, or a stranger who came into your shop to ask some questions yesterday. Apps plausibly could trace them. That's before you start thinking about simple forgetfulness. Who did you sit next to in the company meeting a week ago? Assuming people actually use contact tracing apps (TBC...), then many of those otherwise untraceable contacts can be picked up.
rswail 6y ago
Unlike "Security Theatre" of the TSA et al, this is a little different. Contact tracing is proven to be effective in reducing the number of infections and locating and treating infected people earlier in their infection. These apps are aids to that tracing, not a solution. They help both those that were in contact with someone who is diagnosed, by getting tested and treated earlier, they are more likely to stay healthier. But if they also quarantine themselves and are infected, they are less likely to spread the infection further. So it's a win-win.
eli 6y ago
No offense to Bruce Schneier but he seems to be making an argument based on the apps' epidemiological value, an area that is outside his expertise. Surely all contact tracing methods have false positives and false negatives. Do they all have "no value"? Technologists have a duty to explain the limitations of the technology, but I don't think they should be drawing conclusions and making public health recommendations.
- dchyrdvh 6y ago
  Yes, they all have no value. Let's assume someone got bankrupted by a hospital over a severe coronavirus case. This means that someone has been wandering around for weeks infecting others. Let's assume there is a chain of 10 contacts between me and that someone. The probability of virus transmission is 1% (and I'm generous here) because more people wear masks, because people avoid talking and generally avoid interactions. Probability of transmission over 10 links is 10^-20 and we may stop right here, unless we plan to study quantum particles. Now let's assume I get a notification that I might have been infected over the past few weeks. The probability that the app is correct is abysmally low. But even if I get infected, I'm unlikely to get sick and I'm unlikely to transmit the virus to others because masks, social distancing and because I already assume I'm infected. So yeah, this app would be useless and is only good for surveillance.
  - sanderjd 6y ago
    I don't think you answered the question you're responding to. You're still talking about the app, the question is about all contact tracing generally. Actual epidemiologists appear to disagree with your (I'm assuming) amateur opinion that contact tracing, in general, is useless. They are aware of all the things you mention, and still believe it is useful. There also seems to be examples of success with contact tracing in conjunction with good testing regimes in countries that are faring much better than the US. It seems like arrogance to me to think that we can't learn anything from those successes. (But I'm very uneasy about these app-based approaches, and much more in favor of hiring tons of humans to do contact tracing instead, or at least as the primary mechanism.)
  - chasd00 6y ago
sigmar 6y ago
>without ubiquitous, cheap, fast, and accurate testing No one is arguing to do more contact tracing and stop building testing capacity. You need both. False positives are a big issue and should be reduced. but I don't see how having a better idea of which asymptomatic people to test would be a net negative on the whole?
jandrewrogers 6y ago
Schneier is correct in that the proposed method is almost worthless for effective contact tracing. However, he does not offer a viable alternative. There have been large-scale ground-truthing experiments run in cities like Manhattan for similar types of data models where population coverage was similar to the most optimistic projections for the proposed contact tracing method. We have a lot more data on the effectiveness of this type of tracing than most proponents and bystanders know, and it provides plenty of reason to believe the bluetooth proposal is an exercise in futility. Methods that would likely produce an effective data model exist but they are much more difficult to navigate as there is no legal framework for it, though technically possible. Discussion of contact tracing has been taken over by armchair experts who have a naive understanding of the complexities of the problem, particularly when a disease is already endemic. Technical implementations that would have broad efficacy in a country like the US are at least a year away, and several governments are aware of this. Some governments are rolling out contact tracing programs they know have low efficacy for the sake of appearances.
gregwebs 6y ago
This is a false dichotomy. Professional contact tracers must be in charge. Contact tracing apps help them do their job more effectively. His arguments also seem to assume that testing will remain scarce. But testing capacity keeps increasing and as lockdowns continue demand goes down. Schneir seems so out of his element here to the point that his arguments devolve into name calling. Unfortunately this is going to taint his future credibility on contract tracing. It would have been nice to have his input on the security and privacy concerns of this issue.
newacct583 6y ago
This is very wrong, to the point of being deliberately misleading: > Assume you take the app out grocery shopping with you and it subsequently alerts you of a contact. What should you do? It's not accurate enough for you to quarantine yourself for two weeks. And without ubiquitous, cheap, fast, and accurate testing, you can't confirm the app's diagnosis. So the alert is useless. YES, of course we need pervasive testing. Everyone knows we need pervasive testing. That's why it's called a "test and trace" regime! We don't have it, and that's a major problem. But we know we have to get there. And once we do, the alert isn't useless anymore. Tracing is one requirement of a successful mitigation strategy. Testing is the other. We need both. Having one side refuse to cooperate because they don't think the other will is just a recipe for disaster. I mean, imagine if the medical community started refusing to do tests because they thought the privacy folks would block attempts at tracing. That's what this logic amounts to.
senectus1 6y ago
Schneier is too close to the binary nature of security. This is an organic problem, not his specialty and will take a multilayered response.
dchyrdvh 6y ago
With 95% infected not showing any symptoms, contact tracing is pointless, as it will be about tracing contacts of those few severely ill. With this in mind, contact tracing is really just a way to sell survelliance to people and then seal it in laws.
- xorfish 6y ago
  But it is more 5-40% of infected that don't show any symptoms. It is also not clear how infectious people that don't show symptoms are.
  - dchyrdvh 6y ago
    They are doing well. The symptoms are the same as mild flu or allergy, and the effects are nearly non existent except in already old and sick. If half of infected got severe complications, it would be a blood bath with military on the streets already.
    - xorfish 6y ago
      Average life expectancy based on age and comorbidities of the people who die is around 10-13 years. That is not an insignificant lifetime reduction. 0.5%-2% of the people who get it, die. That is much worse than the flu that kills 0.04-0.1% of the infected. The flu itself is already pretty deadly and this is much deadlier.
      - dchyrdvh 6y ago
        But it's not deadly enough to reverse the climate change. Humans are smart animals: they will adopt to the virus real quick, restart the dirty economy machine, get their previous life expectancy back and suffocate in dirty air, water and unbearable weather. But they will die on their terms, with pride and dignity.
- turdnagel 6y ago
  > With 95% infected not showing any symptoms Got a source for that? I believe I've read it's somewhere closer to 50%.
chasd00 6y ago
what these apps would be most useful for is keeping OCD types and concern trolls busy while the rest of us get on with our lives. EDIT: and think about this, users of this app will open and engage with it every time they're shopping or any venue. It will be the most effective add delivery platform ever made. I think that's the real motivation.
mirrorlake 6y ago
Two big things he seems to miss. Correctly identifying (and quarantining) just a few newly infected people in the early stages of an epidemic is a huge win. It's the same as compound interest. Early investment pays handsomely. Secondly, this article is written as if better testing won't be available in the future. Better tests will eventually exist, so that can hardly be a reason why we shouldn't lay groundwork now. Bonus point: we aren't just trying to help the current pandemic. Perhaps this infrastructure could help prevent the next pandemic of a far deadlier disease where every extra quarantined person saves multiple lives.
syrrim 6y ago
An important part of the criticism is that the apps being proposed won't tell you who or where you had a contact, just that it occured anywhere. This leaves you with no capacity to judge the actual danger of being infected. An app being used to augment practical contact tracing, for example by reminding you who you'd been in contact with, would be potentially useful, but that isn't what's proposed. Another way that such apps become useless is their voluntary nature. Ie that use of the app, and self-quarantine in response to an alert, are an individual's choice. Obviously, if you passed by a sick person in the grocery store, you do have a chance of being sick, and therefore quarantining is still useful. But most people will feel silly about quarantining themselves in response to such a low probability event. Having even a small fraction of people act on these alerts would therefore require enforced compliance of some sort. Note that I'm not per se advocating either that the app be less privacy aware, nor that compliance be enforced, just expanding on the source of the impotency schneier talks about.
- chasd00 6y ago
  also, even if compliance was enforced, at best, the apps can only track phones. For example, I leave my phone at home by mistake all the time...
coucou 6y ago
I think there is more to the ContactTracing app then what Schneier mentioned. Understand how to define a close-contact of infected. It requires a constant 30 minutes Bluetooth-strong-signal (geographically near) to the infected person, not just because your "ID" being captured on the infected person. The app helps find these close-contacts around you and eventually notifying them to isolate themselves and test. Imagine this process chained. Of course, this will need a scale of people downloading the app. But better-having this auto-logged than human-effort asking infected 1 by 1 (10,000+++ infected VS 100 contact-tracer)!
bybjorn 6y ago
Add ubiquitous & fast testing into the mix - is contact tracing valuable then? Because testing on demand is what a lot of governments are looking at. I’m thinking the app giving me a notice of close contact with a confirmed covid case will also increase my chances of getting a test even before we reach that scenario.
bfung 6y ago
The crux of it is: “... it's just techies doing techie things because they don't know what else to do.” All the comments here, esp HN, should think about if this is even a useful app, before debating other stats. Will ordinary people install and use this app? Example scenario: will SIP protestors use this app? Force install with opt-out?

167 points by generalpass 6y ago

I have a rather cynical prediction for these apps: they will be mandatory for us to have to use various public services, and they will cost absurd amounts of money. This will be regardless of the efficacy because the goal isn’t safety or surveillance, but extracting rents for the politically-connected people who will be “approved vendors.”

generalpass 6y ago
I suspect there will be multiple flavors of bootleggers and multiple flavors of baptists.

Gravityloss 6y ago

The points are worth discussing and putting some numbers on. What false negative and false positive rates, installation percentage among population and other things are acceptable for still useful contact tracing? And how does it tie to testing availability etc.

tastroder 6y ago
https://twitter.com/eredmil1/status/1255934130753204224 https://twitter.com/eredmil1/status/1255934130753204224 this had preliminary results on questionnaires w.r.t. user acceptance . This https://science.sciencemag.org/content/early/2020/04/09/science.abb6936 https://science.sciencemag.org/content/early/2020/04/09/scie... paper looks at how effective it is given N% of the population using it and I've not seen any info that it hurt the situation in Singapore.
- Gravityloss 6y ago
  https://medium.com/@tomaspueyo/coronavirus-how-to-do-testing-and-contact-tracing-bde85b64072e https://medium.com/@tomaspueyo/coronavirus-how-to-do-testing... This article argue why it's not very likely to be good, compared to manual contact tracing. I don't agree with all the points, but it is a valuable read. There is a lot of other good things there as well.
  - tastroder 6y ago
    When discussing the paper I linked this article says "That sounds hard. The good news is that, done well, this measure alone could stop the epidemic. But even if you don’t do it well, it contributes." and correctly calls for combination with other measures. That's my main point, even if it's not as good as manual contact tracing the allegation that this is "tracing app" vs. anything else is just a pointless debate that Schneiers post seems to further. Like the article you posted seems to say, we should improve manual tracing and testing as well but I haven't seen anything in there that would support the Schneier viewpoint on first glance. Looks like an interesting read for later though, thanks for sharing!

TechBro8615 6y ago

I’m glad to see Schneier come out with an opinion against these apps. Up until now, it’s seemed like the privacy community has been almost excited about the idea of these tracking apps. Maybe because it’s a cool academic problem? I don’t know. Take this DP-3T project for example. It’s really interesting tech, and a great group of people behind it. But the government doesn’t care for this nuance of what is privacy preserving tech and what is not. For now, maybe at the beginning, privacy will be emphasized. But the important part is conditioning citizens to be okay with the underlying idea of technology assisted self-surveillance, and compliance with notifications on their phone telling them to stay inside. Schneier raises the point of false positives, which is important with regards to this idea of conditioning. What do you do when you get a notification that someone “nearby” tested positive? Do you take time off work and isolate yourself in your house for two weeks, just because some beacon passed within two meters of you within the past two weeks? Even if you have no symptoms at all? Just because you got a notification on your phone? This just seems unrealistic to me. My other worry is the classic “slippery slope.” Maybe people are okay with these apps in their current form, if they’re privacy-preserving. (Personally, I doubt anyone outside tech can recognize the difference anyway, but let’s assume the wider populace takes its lead from us). Isn’t there a risk that eventually people will forget about the underlying details and privacy will be deemphasized? “You were okay with TrackingApp 1.0, why wouldn’t you be okay with TrackingApp 2.0?” If we give an inch now, will the government take a mile later? Who’s to say the emphasis on privacy will remain in place? Heck, it’s not even clear whether it will be in place from the beginning. The NHS is already saying they don’t want to use it, choosing instead to build their own centralized solution. Again — it’s extremely concerning to me to see the general vibe of excitement coming out of the tech community around these apps. I’m really disappointed and would expect to see more skepticism. So, kudos to Schneier for going against the grain here.

svdr 6y ago
And what if you can easily get tested if you get notified?
- xorfish 6y ago
  The Swiss COVID-19 Science Task force recommends a test at the beginning and the end of the Quarantine and if someone shows symptoms. https://ncs-tf.ch/en/policy-briefs https://ncs-tf.ch/en/policy-briefs --> Contact Tracing

brenden2 6y ago

Another take: all these things (shutdowns, contact tracing, social distancing) are measures to give people a sense of security, and make them feel as if the PIC are doing something useful. At the end of the day, the virus will do what the virus does, with or without apps. Until there's herd immunity or a vaccine, this will remain a politically charged issue and there will be constant jockeying for political clout (and I'm using the term 'political' in a sense that includes private entities trying to win favours in the eyes of the public). I agree with Bruce, the contact tracing apps are goofy and I don't see how they will make the virus stop spreading without other changes such as widely available cheap home test kits.

dchyrdvh 6y ago
TBH, the real solution will be reopening the economy with masks on and social distancing. Vaccine is a pipe dream and by the time it might be created, everyone will have been infected a few times. My conspiracy theory is that the government understands that very soon everyone will wear masks and sunglasses and all the face-recognition tracking will become useless, so to compensate for that, they are pushing hard for alternatives. Once masks get normalized and the infection rate drops to manageable levels, the opportunity to push this app surveillance will be lost.
- brenden2 6y ago
  I'd agree that qualifies as a conspiracy theory.

kohtatsu 6y ago

I really think the equivalent of paper journals is the way to go. As well as some way to report to grocery stores etc you've visited after testing positive. Heck an answering machine at the grocery store that reports known cases, which everyone calls each Sunday would be enough.

tastroder 6y ago

> [...] and Bluetooth -- just aren't accurate enough to capture every contact. Did I miss his paper on the matter? There's dozens of groups working on this and even with a regular free space model the results seem "good enough" in <2m,15min scenarios for an additional data point. Most of this seems to leave out that digital contact tracing is not a cure all but a tool to help manual efforts. I somewhat hate the simplification people bring here, that every additional identified contact helps, but dismissing it as "plain dumb" seems rather shallow as well. Sure, false negatives will be a thing, the false negative rate of not doing digital contact tracing at all would be higher by definition. Most of what he outlined can occur in manual contact tracing as well and we still do that, simply because it's necessary. I haven't seen anything so far that would suggest that digital contact tracing in the poster child Singapore had any of the negative impact he brings to the table here and studies like Ferretti et al. [0] seem to make a pretty good case why it would at least not hurt the overall epidemiological goal. > It's not accurate enough for you to quarantine yourself for two weeks. And without ubiquitous, cheap, fast, and accurate testing, you can't confirm the app's diagnosis. So the alert is useless. The time frame and assumptions on testing capability is US centric I assume? If you can get a quick test it would not be two weeks, it's likely quick tests will become more prevalent if this sticks around long enough and testing capability will be raised to sufficient levels. Otherwise yes, false positives would quickly diminish usage. Of course some of his points are valid and need to be addressed by OS vendors, apps and policy makers, and evaluation of efficacy will be just as critical as teaching the public that having an app does not mean things can go back to normal. There's also plenty of opportunity for abuse even with the commonly decentralized architecture that is at the moment widely agreed upon but none of that supports the allegations of this particular article imho. The comments similarly bring up things like "surface transmission" as if that mattered at all. If you treat a contact tracing app as an additional data point it becomes much more sensible. [0] https://science.sciencemag.org/content/early/2020/04/09/science.abb6936 https://science.sciencemag.org/content/early/2020/04/09/scie...

nocturnial 6y ago
What percentage of the population should install and use this before it becomes useful? The latest survey in my country said less than 50% were willing to adopt it and the number in the article mentions only 20% in Singapore.

buboard 6y ago

It doesn't matter; politicians already love it because they appear to be “Doing Something(TM)”, and the ~~commecial arm of NSA~~, er, big tech are excited to provide yet one more surveillance tool. What could go wrong? This year it will be for covid, next year for influenza, then u re just going to have to learn to live with it.

dangoor 6y ago

I think the point of contact tracing is not that it's a silver bullet used alone, but rather a piece used alongside more widespread testing to help lower the rate of transmission. It may be reasonable to argue that these tracing apps alone aren't valuable, but once you add in greater test availability, it seems like they can help. https://ethics.harvard.edu/covid-roadmap https://ethics.harvard.edu/covid-roadmap

deeringc 6y ago
Right - this is just a way of helping to prioritizing who gets tested. Given that testing kits will always be a limited resource (you can't simply test everyone, everyday) it makes a lot of sense to find sub-populations who are more likely to be positive. That doesn't mean you don't test anyone else (eg. those with symptoms, those in sensitive jobs) - it just lets you use a certain percentage of your testing capacity one those people who have been in proximity with confirmed cases. As you say, it's not a silver bullet but in combination with a slew of other approaches can help reduce the rate of transmission rate.

quicklime 6y ago

> Assume you take the app out grocery shopping with you and it subsequently alerts you of a contact. What should you do? ...the alert is useless. This feels like the mask debate again. It doesn’t guarantee safety, so it’s useless. But there are plenty of things you could do. You could carry on but avoid visiting your elderly parents, and cancel your plans to attend a crowded event. You could start walking or driving to work instead of taking the train. Or work from home more often. It’s not a choice between quarantine or complete freedom, there are grey areas in between. Get one of these alerts? Start taking more precautions. Get many more? Start taking more extreme caution.

athenot 6y ago
The counterpoint is that those are things to be done regardless. Because the absence of an alert doesn't make visiting my elderly parents any safer.
- alistairSH 6y ago
  Not wrong, but also doesn't allow us to get back to normal in any meaningful way. That said, I don't believe we're at the point in the curve where we should be returning to normal. Contact tracing apps feel much more useful when we're into the tail end of the pandemic, where infection is far less likely. And only of value if usage of the tracing apps is very high.
  - tigroferoce 6y ago
    I think that we won't go back to normal (like pre-COVID normal) for a long time. Unfortunately there is no silver bullet yet, and we should prepare to live without one for a while; in the meanwhile we will adopt a number of means to keep the virus diffusion low, and the lockdown away. A contact tracing app (like a mask or washing hands) is among those things. If it is not privacy intrusive and it has some effectiveness, it's OK for me. I'm happy to reduce the infection rate, even if it's just a few decimal points. I really don't understand all these discussions about something that might save lives. IMO the real discussion should be whether these app are privacy preserving enough. Are there (realistic) attacks on these apps? How can we mitigate them?

samwillis 6y ago

Thinking "its not accurate enough" should not EVER be a reason to decide not to try something that could potentually help in this unprecedented situation. It may well not work well enough but we won't know unless we try! Each individual incremental activity, process, treatment, protection or APP that takes us a little closer to successfully fighting this thing should be done and done in conjunction with the others.

eli 6y ago
Especially when you have no particular knowledge or citations as to what an appropriate standard for "enough" might be.
- deeringc 6y ago
  Exactly - I have huge respect for Bruce Schneier when it comes to matters relating to cryptography. But apart from commenting on the security, privacy and other technical aspects of these apps, I'm not sure on which authority he's giving these opinions on matters relating to epidemiology. At very least I'd like him to give some supporting scientific citations. But as it stands, Bruce's opinion on the medical and public health efficacy of these apps is no more valuable than yours or mine.
kxyvr 6y ago
Actually, yes it should, but it depends on the numbers and this is a well studied area of statistics. One of the many issues is whether or not someone who flags positive is actually positive and whether someone who flags negative is actually negative. This depends not only the sensitivity (if someone is sick, will they flag positive) and specificity (if someone is healthy, will they flag negative), but on how prevalent a disease is within a population. That last quantity is constantly changing, which also means that this calculation is constantly changing, which can and should affect policy. Now, the issue is that if you start telling a bunch of healthy people that they're actually sick and want them to quarantine or that a bunch of sick people are actually healthy and that they're free to go there are consequences. One, people will lose faith in the system and stop listening at all. Two, healthy people who work in an essential area can now not actually do their job. Three, sick people in an essential area are now going back to work and getting other people sick. That doesn't mean that nothing should be done. However, it may absolutely mean that this particular method should not be done because it will cause more harm than doing the proverbially nothing. As for this particular article, it's not great because it doesn't actually work these numbers. It would be a good article if it actually calculated whether or not the app is worthwhile given a certain prevalence, sensitivity, and specificity. Personally, I don't know rate of prevalence of COVID-19 nor the sensitivity or specificity of the existing tests. However, I still strongly reject the premise that any test or contact tracing app is better than none at all. In order to fully beat a dead horse, here's the wiki that runs through how to calculate these numbers: https://en.wikipedia.org/wiki/Sensitivity_and_specificity https://en.wikipedia.org/wiki/Sensitivity_and_specificity I don't like their presentation, but it is what it is. Here is some Octave code that runs through their example with some more readable names: % Total population pop = 2030; % If someone is sick, will they test positive sensitivity = 0.67; % If someone is healthy, will they test negative specificity = 0.91; % Prevalence of the disease prevalence = 0.0148; % Works some numbers sick_pop = pop * prevalence; healthy_pop = pop * (1-prevalence); sick_pop_tested_positive = round(sick_pop * sensitivity); sick_pop_tested_negative = round(sick_pop * (1-sensitivity)); healthy_pop_tested_negative = round(healthy_pop * specificity); healthy_pop_tested_positive = round(healthy_pop * (1-specificity)); % Derive some useful quantities fprintf( ... ['Of those who tested as sick, percent of those actually ' ... 'sick (positive predictive value): %2.1f%%\n'], ... 100*(sick_pop_tested_positive / ... (sick_pop_tested_positive + healthy_pop_tested_positive))); fprintf( ... ['Of those who tested as healthy, percent of those actually ' ... 'healthy (negative predictive value): %2.1f%%\n'], ... 100*(healthy_pop_tested_negative / ... (healthy_pop_tested_negative + sick_pop_tested_negative))); > Of those who tested as sick, percent of those actually sick (positive predictive value): 10.0% > Of those who tested as healthy, percent of those actually healthy (negative predictive value): 99.5%

dustingetz 6y ago

If software is the new bureaucracy and this app can put you in a detention center, oof. How do you get out when the software is wrong?

feral 6y ago

This is a weak argument from Schneier. Most of his concerns (false positives, false negatives) also apply to contact tracing done by humans, which he advocates at the end of his article. If a medical professional interviews you about your contacts, you have to remember who they were. If you forget someone, or didn't know their name, that's a false negative. Someone you report you had coffee with, but who doesn't get the disease, is a false positive. Apps have different limitations, and need adoption to be useful, and that's a problem societies will have to consider. There's also legit privacy concerns. But the very broad argument made in that post is silly. You just don't need to stop every transmission to stop the disease. Even stopping 70%, via a range of measures, is about enough. You can tolerate some errors.

mellow2020 6y ago
The dichotomy isn't between the app or a medical professional guessing, based on contacts, whether someone might be infected and whether they should self-quarantine. The dichotomy is between guessing infection based on contacts and testing for infection.
- pimterry 6y ago
  There isn't a dichotomy. We can use all these techniques. Testing is great of course, but given that you can't test everybody every day, testing is more effective when you can test the right people. If we can trace contacts, we can prioritize testing of people who've had a possible contact recently, and thereby find and quarantine infectious people faster.
  - mellow2020 6y ago
    > There isn't a dichotomy. I simply meant that this "without ubiquitous, cheap, fast, and accurate testing, you can't confirm the app's diagnosis. So the alert is useless." was turned into medical professionals asking someone about contacts, a la "Someone you report you had coffee with, but who doesn't get the disease, is a false positive" to show that getting asked about contacts by medical professionals isn't better than a contact tracing app, which is a straw man, i.e. Schneier didn't ask for medical professionals to ask those questions, he said those questions are useless without tests.

m3kw9 6y ago

If contact tracing can be better than 50-50 it will be better than knowing nothing like we are now when ever we go out. If it is les than 50/50 it could have fatal consequences where people lower their guards because of too much trust into the data that is probably wrong

finnthehuman 6y ago

>That loss of trust is even worse than having no app at all. Suddenly, for the first time, I'm sold on contract tracking apps. Lets build them and push them far and wide. If the hype cycle and subsequent arguments regarding contract tracking have shown us anything, it's that everyone needs to stop trusting claims of "it's for your own good."

ck2 6y ago

Half the population won't even voluntarily wear a mask or isolate. Some even go anywhere they want coughing constantly. So how exactly is voluntary contract tracing anything but an utter fantasy and hand waving that it "exists" so magically protects us?

zvrba 6y ago

For me it's both about the privacy and vulnerabilities in the Bluetooth stack such as https://www.armis.com/blueborne/ https://www.armis.com/blueborne/ According to the article, you need Sep 9 2017 security patch level, but my 5 year old phone is on Sep 1 2017 level. No way I'm going to have Bluetooth turned on in untrusted areas. While I'm unlikely to get hacked on the street or in a store, it gets more likely in places like a bus or a train (while commuting).

pimterry 6y ago

Don't these arguments apply equally well for manual contact tracing? There will be very significant false positives and negatives there too. I would expect that a contact tracing app can actually make a much more accurate list. Trying to accurately remember who I was near and for how long over the last X days is difficult (given that I'm not confined in my house, of course) Even with intensive manual research, working out who it was that cycled behind me for 5 minutes this morning or who I coughed next to at the cheese counter is going to be remarkably difficult. Apps can plausible cover some of those cases. We'll need to tune the alerts for acceptable precision & accuracy, as a function of the signal strength & duration of each contact, but that seems like a tractable problem, and again seems very similar to judging the risk of manually collected contact events. Despite all these possible inaccuracies, AFAICT contact tracing has been shown to be very effective, and is a well respected technique. I don't see anything here about how apps will be significantly worse. This assumes a significant install base of course, but I think that's tractable.

jerf 6y ago
"Don't these arguments apply equally well for manual contact tracing?" No. They mostly apply to manual contact tracing, certainly, but they do not apply equally well. A human being doing it is much smarter. They do take into account the fact that someone was on the other side of a wall. They are not limited by whether or not someone installed the app. They can use their brain to solve little local issues that the app can't even perceive which cumulatively add up to a huge difference. The app has a few advantages over the human, too, but I don't think it's that surprising at all that when it's all summed up and accounted for it ends up heavily Advantage: Dedicated Human. The modest advantages are trashed by the massive disadvantages.
- pimterry 6y ago
  I agree there's cases that humans will handle better, but there's also cases where the apps will do better too, and I wouldn't be surprised if it was a wash (soon hopefully we'll have some actual research on this!). For example, in most situations where you're near an anonymous stranger, manual tracing is going to have a lot of trouble. That's a _lot_ of cases. You're almost certainly not going to be able to hunt down the person you sat next to on the metro for half an hour, or a stranger who came into your shop to ask some questions yesterday. Apps plausibly could trace them. That's before you start thinking about simple forgetfulness. Who did you sit next to in the company meeting a week ago? Assuming people actually use contact tracing apps (TBC...), then many of those otherwise untraceable contacts can be picked up.

rswail 6y ago

Unlike "Security Theatre" of the TSA et al, this is a little different. Contact tracing is proven to be effective in reducing the number of infections and locating and treating infected people earlier in their infection. These apps are aids to that tracing, not a solution. They help both those that were in contact with someone who is diagnosed, by getting tested and treated earlier, they are more likely to stay healthier. But if they also quarantine themselves and are infected, they are less likely to spread the infection further. So it's a win-win.

eli 6y ago

No offense to Bruce Schneier but he seems to be making an argument based on the apps' epidemiological value, an area that is outside his expertise. Surely all contact tracing methods have false positives and false negatives. Do they all have "no value"? Technologists have a duty to explain the limitations of the technology, but I don't think they should be drawing conclusions and making public health recommendations.

dchyrdvh 6y ago
Yes, they all have no value. Let's assume someone got bankrupted by a hospital over a severe coronavirus case. This means that someone has been wandering around for weeks infecting others. Let's assume there is a chain of 10 contacts between me and that someone. The probability of virus transmission is 1% (and I'm generous here) because more people wear masks, because people avoid talking and generally avoid interactions. Probability of transmission over 10 links is 10^-20 and we may stop right here, unless we plan to study quantum particles. Now let's assume I get a notification that I might have been infected over the past few weeks. The probability that the app is correct is abysmally low. But even if I get infected, I'm unlikely to get sick and I'm unlikely to transmit the virus to others because masks, social distancing and because I already assume I'm infected. So yeah, this app would be useless and is only good for surveillance.
- sanderjd 6y ago
  I don't think you answered the question you're responding to. You're still talking about the app, the question is about all contact tracing generally. Actual epidemiologists appear to disagree with your (I'm assuming) amateur opinion that contact tracing, in general, is useless. They are aware of all the things you mention, and still believe it is useful. There also seems to be examples of success with contact tracing in conjunction with good testing regimes in countries that are faring much better than the US. It seems like arrogance to me to think that we can't learn anything from those successes. (But I'm very uneasy about these app-based approaches, and much more in favor of hiring tons of humans to do contact tracing instead, or at least as the primary mechanism.)
- chasd00 6y ago

sigmar 6y ago

>without ubiquitous, cheap, fast, and accurate testing No one is arguing to do more contact tracing and stop building testing capacity. You need both. False positives are a big issue and should be reduced. but I don't see how having a better idea of which asymptomatic people to test would be a net negative on the whole?

jandrewrogers 6y ago

Schneier is correct in that the proposed method is almost worthless for effective contact tracing. However, he does not offer a viable alternative. There have been large-scale ground-truthing experiments run in cities like Manhattan for similar types of data models where population coverage was similar to the most optimistic projections for the proposed contact tracing method. We have a lot more data on the effectiveness of this type of tracing than most proponents and bystanders know, and it provides plenty of reason to believe the bluetooth proposal is an exercise in futility. Methods that would likely produce an effective data model exist but they are much more difficult to navigate as there is no legal framework for it, though technically possible. Discussion of contact tracing has been taken over by armchair experts who have a naive understanding of the complexities of the problem, particularly when a disease is already endemic. Technical implementations that would have broad efficacy in a country like the US are at least a year away, and several governments are aware of this. Some governments are rolling out contact tracing programs they know have low efficacy for the sake of appearances.

gregwebs 6y ago

This is a false dichotomy. Professional contact tracers must be in charge. Contact tracing apps help them do their job more effectively. His arguments also seem to assume that testing will remain scarce. But testing capacity keeps increasing and as lockdowns continue demand goes down. Schneir seems so out of his element here to the point that his arguments devolve into name calling. Unfortunately this is going to taint his future credibility on contract tracing. It would have been nice to have his input on the security and privacy concerns of this issue.

newacct583 6y ago

This is very wrong, to the point of being deliberately misleading: > Assume you take the app out grocery shopping with you and it subsequently alerts you of a contact. What should you do? It's not accurate enough for you to quarantine yourself for two weeks. And without ubiquitous, cheap, fast, and accurate testing, you can't confirm the app's diagnosis. So the alert is useless. YES, of course we need pervasive testing. Everyone knows we need pervasive testing. That's why it's called a "test and trace" regime! We don't have it, and that's a major problem. But we know we have to get there. And once we do, the alert isn't useless anymore. Tracing is one requirement of a successful mitigation strategy. Testing is the other. We need both. Having one side refuse to cooperate because they don't think the other will is just a recipe for disaster. I mean, imagine if the medical community started refusing to do tests because they thought the privacy folks would block attempts at tracing. That's what this logic amounts to.

senectus1 6y ago

Schneier is too close to the binary nature of security. This is an organic problem, not his specialty and will take a multilayered response.

dchyrdvh 6y ago

With 95% infected not showing any symptoms, contact tracing is pointless, as it will be about tracing contacts of those few severely ill. With this in mind, contact tracing is really just a way to sell survelliance to people and then seal it in laws.

xorfish 6y ago
But it is more 5-40% of infected that don't show any symptoms. It is also not clear how infectious people that don't show symptoms are.
- dchyrdvh 6y ago
  They are doing well. The symptoms are the same as mild flu or allergy, and the effects are nearly non existent except in already old and sick. If half of infected got severe complications, it would be a blood bath with military on the streets already.
  - xorfish 6y ago
    Average life expectancy based on age and comorbidities of the people who die is around 10-13 years. That is not an insignificant lifetime reduction. 0.5%-2% of the people who get it, die. That is much worse than the flu that kills 0.04-0.1% of the infected. The flu itself is already pretty deadly and this is much deadlier.
    - dchyrdvh 6y ago
      But it's not deadly enough to reverse the climate change. Humans are smart animals: they will adopt to the virus real quick, restart the dirty economy machine, get their previous life expectancy back and suffocate in dirty air, water and unbearable weather. But they will die on their terms, with pride and dignity.
turdnagel 6y ago
> With 95% infected not showing any symptoms Got a source for that? I believe I've read it's somewhere closer to 50%.

chasd00 6y ago

what these apps would be most useful for is keeping OCD types and concern trolls busy while the rest of us get on with our lives. EDIT: and think about this, users of this app will open and engage with it every time they're shopping or any venue. It will be the most effective add delivery platform ever made. I think that's the real motivation.

mirrorlake 6y ago

Two big things he seems to miss. Correctly identifying (and quarantining) just a few newly infected people in the early stages of an epidemic is a huge win. It's the same as compound interest. Early investment pays handsomely. Secondly, this article is written as if better testing won't be available in the future. Better tests will eventually exist, so that can hardly be a reason why we shouldn't lay groundwork now. Bonus point: we aren't just trying to help the current pandemic. Perhaps this infrastructure could help prevent the next pandemic of a far deadlier disease where every extra quarantined person saves multiple lives.

syrrim 6y ago

An important part of the criticism is that the apps being proposed won't tell you who or where you had a contact, just that it occured anywhere. This leaves you with no capacity to judge the actual danger of being infected. An app being used to augment practical contact tracing, for example by reminding you who you'd been in contact with, would be potentially useful, but that isn't what's proposed. Another way that such apps become useless is their voluntary nature. Ie that use of the app, and self-quarantine in response to an alert, are an individual's choice. Obviously, if you passed by a sick person in the grocery store, you do have a chance of being sick, and therefore quarantining is still useful. But most people will feel silly about quarantining themselves in response to such a low probability event. Having even a small fraction of people act on these alerts would therefore require enforced compliance of some sort. Note that I'm not per se advocating either that the app be less privacy aware, nor that compliance be enforced, just expanding on the source of the impotency schneier talks about.

chasd00 6y ago
also, even if compliance was enforced, at best, the apps can only track phones. For example, I leave my phone at home by mistake all the time...

coucou 6y ago

I think there is more to the ContactTracing app then what Schneier mentioned. Understand how to define a close-contact of infected. It requires a constant 30 minutes Bluetooth-strong-signal (geographically near) to the infected person, not just because your "ID" being captured on the infected person. The app helps find these close-contacts around you and eventually notifying them to isolate themselves and test. Imagine this process chained. Of course, this will need a scale of people downloading the app. But better-having this auto-logged than human-effort asking infected 1 by 1 (10,000+++ infected VS 100 contact-tracer)!

bybjorn 6y ago

Add ubiquitous & fast testing into the mix - is contact tracing valuable then? Because testing on demand is what a lot of governments are looking at. I’m thinking the app giving me a notice of close contact with a confirmed covid case will also increase my chances of getting a test even before we reach that scenario.

bfung 6y ago

The crux of it is: “... it's just techies doing techie things because they don't know what else to do.” All the comments here, esp HN, should think about if this is even a useful app, before debating other stats. Will ordinary people install and use this app? Example scenario: will SIP protestors use this app? Force install with opt-out?