29 ms·

NHS open-sources contract tracing iOS and Android apps

342 points by orangepanda 6y ago

noodlesUK 6y ago
This is a big step. I’ve previously been pretty against the NHS’s approach (being mostly centralised etc), but I’m very happy to see that they’ve open sourced it. Does this also contain the server side that does the matching?
- spzb 6y ago
  No it doesn't. Neither does it include some of the configuration values you need to build the mobile apps. It looks like this was a last minute political decision to open source the code in the face of growing public disquiet rather than a co-ordinated effort.
  - g_p 6y ago
    It takes about 5 minutes to obtain the API keys from the Android app to be able to build it. It was also a pretty well-documented process to get the Android app to build (unlike some Android "open source" projects that seem to be designed to be impossible to actually build!) Open sourcing the app was actually planned all along - when Matt Hancock announced the app several weeks ago [1], he said it would be open sourced at the time. [1] https://www.theguardian.com/politics/2020/apr/12/uk-app-to-track-coronavirus-spread-to-be-launched https://www.theguardian.com/politics/2020/apr/12/uk-app-to-t...
  - cameronh90 6y ago
    They have said the server code will be coming soon. The intention has been to release the source code for the app since it was announced. I doubt this is a last minute political decision since the UK government already release a huge amount of their code as open source. The project isn't perfect - but consider that it's been put together in a month, it's still beta and their focus has been on making it work, not making it easy to build. Frankly, the level of transparency from the NCSC and NHSX has been far ahead of most governments and private organisations. You can disagree with the contact tracing approach, but if all government work was done with this level of transparency we'd be in a much better position than we are now.
londons_explore 6y ago
> Each two hours, we merge any changes from master into internal Not hiding the fact the published source code isn't that built into the app then...
- m0xte 6y ago
  Yes indeed. I'm not buying it isn't patched in some way before it's pushed to any app stores. Especially with all the noise beforehand about how it operates and the involvement of GCHQ/NCSC in development. Edit: some digging. NHSX is run by Matthew Gould. Former Israel diplomat and tied via UK-Israel technology hub to NICE (Neptune Intelligence Computer Engineering) Ltd which is a former Israeli army surveillance and data security company among other functions. So basically a hotpot of reasons not to install this thing.
  - TechBro8615 6y ago
    Well, it should be fairly trivial to put it through the rigor of some MITM proxies and verify that the built app is not making any unexpected network requests. I look forward to infosec twitter ripping this apart.
    - m0xte 6y ago
      That would be interesting analytics but you just never know with this stuff. Even basic intercept-avoiding technology like burst encoding require very long term sampling to detect, so the thing would need to be disassembled and every line of code analysed.
  - sixstringtheory 6y ago
    It's the same story as with Signal for iOS. How do we know the version downloaded from the App Store is the same code hosted on GitHub? I'd like to have the option to sideload it. Clearly that would involve some work on their backend, but I think that's fairer than the stuff described in this Signal GitHub issue [0] and Telegram's website [1] regarding the same thing. EDIT: if I'm wrong please leave some details for myself and others to learn more. I've worked on iOS apps for several years, and as far as I know there's no way to verify if an app downloaded from the App Store was compiled from a particular code revision. Even the same code compiled on separate machines can produce different unique binary IDs. And on the scale of difficulty, I'd say that sideloading is less difficult than jailbreaking, if that method even really works for this problem. [0]: https://github.com/signalapp/Signal-iOS/issues/641 https://github.com/signalapp/Signal-iOS/issues/641 [1]: https://core.telegram.org/reproducible-builds#reproducible-builds-for-ios https://core.telegram.org/reproducible-builds#reproducible-b...
aboringusername 6y ago
From [1]: // TODO: We need a real device to test Bluetooth scanning if isMultipleAdvertisementSupported == false // TODO: We need analytics to identify number of devices that fall into this bucket I don't know whether to laugh or cry reading those comments, the fact that this is a "to do" whilst the app is in "testing" and the fact they've decided the appropriate procedure is to reinvent the work Google and Apple have already done. Google already published their code/APIs in [2]. I'm sure these considerations are taken care of by the framework the OS vendors have published themselves. It's absolute pure arrogance that anyone would even attempt to re-create the work that is being done at the OS level and not 'fall in line'. Germany back tracked, Australia back tracked, and the UK too, will back track and implement Google's APIs. In a time where the message is "saving lives", those TODOs are not living up to that motto. This app is a complete waste of time, resources and money. Use the official APIs and be done with it, anything else is putting people in harms way because you think you "know best". The UK government claimed they reached 100k tests, fudged the numbers, and haven't hit that target since. But it's okay, they'll hit 200k by the end of this month too! Pure 100% incompetence. [1]: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/DeviceDetection.kt https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... [2]: https://github.com/google/exposure-notifications-android https://github.com/google/exposure-notifications-android
- ealexhudson 6y ago
  This app is many things, but it does not reimplement the Google/Apple scheme, and works very differently. If you believe knowing contacts who tested positive is enough, the Google/Apple scheme is fine. If you need to know earlier and/risk assess based on exposure, only the NHSX approach works. It's not a clear cut Central v Not Central decision.
  - dtf 6y ago
    I'd heard another interesting angle to this - that the Google/Apple notification scheme is decentralized, but users can only test C-19 positive via a central authority. Meanwhile the NHSX notification scheme is centralized, but users can self-identify as C-19 positive. Can anyone confirm this?
flattone 6y ago
Twitter user probing for safety & security issues ‘india now NHS next’ https://mobile.twitter.com/fs0c131y/status/1258436033840021504 https://mobile.twitter.com/fs0c131y/status/12584360338400215...
azinman2 6y ago
I’m shocked to see all the Firebase and Google analytics in there. I‘m quite surprised that a gov built app would include this. Disappointing from the UK (along with the fact that they really just should use the Apple/Google framework to begin with, which will in the end better integrate with the device and thus will perform better from a technical perspective).
- RandallBrown 6y ago
  I assume they want to know if people are actually using this app and I don't know if building an analytics platform is the best way for them to spend their time right now. It does undermine any privacy claims they might make.
  - saagarjha 6y ago
    > I assume they want to know if people are actually using this app Apple provides such information without any third-party analytics SDKs.
  - AJRF 6y ago
    I agree around usage of Firebase here because no one really knows what data is being sucked up there but it looks like the intent of usage here is pretty clean; If you look at the code Firebase is in there because the push notifications to notify of infection are sent via Firebase Cloud Messaging. I also grabbed the Google plist out of the IPA from the app store and it has analytics turned off.
    - Sephiroth87 6y ago
      Then why is the Analytics SDK even there? It’s not required for messaging
      - RandallBrown 6y ago
        The directions for integrating SDKs are usually something along the lines of "Add Firebase to your Podfile", which often adds way more than you need. Given that these devs were likely in a hurry, it wouldn't surprise me if they forgot to go back and clean this up after getting it working.
stephenheron 6y ago
Some quite interesting stuff around how they might be getting around the background iOS restrictions[1] can be found in the Android source. Looking at the Apple documentation on background peripheral bluetooth, they state "All service UUIDs contained in the value of the CBAdvertisementDataServiceUUIDsKey advertisement key are placed in a special “overflow” area; they can be discovered only by an iOS device that is explicitly scanning for them"[2] I wonder if they have managed to reverse engineer this overflow area so it is accessible via Android. Someone did some looking into this and it seems at least feasible[3] [1]: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/ble/Scanner.kt#L58 https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... [2]: https://developer.apple.com/library/archive/documentation/NetworkingInternetWeb/Conceptual/CoreBluetooth_concepts/CoreBluetoothBackgroundProcessingForIOSApps/PerformingTasksWhileYourAppIsInTheBackground.html https://developer.apple.com/library/archive/documentation/Ne... [3]: https://crownstone.rocks/2018/06/27/ios-advertisements-in-the-background https://crownstone.rocks/2018/06/27/ios-advertisements-in-th...
- g_p 6y ago
  Yes, this seems to be one of the rather clever aspects of the design - this appears to make it possible to discover iOS devices that are in the proprietary "iOS-only" mode of discovery. It seems that once one of these "overflow" advertisements is discovered, it attempts a connect that is enough to wake the device and carry out normal tracing. I left an iPhone unplugged, stationary, idle and asleep, running the app for about 5 hours. Then introduced an Android device and it was detected immediately. That seems to suggest this aspect works well. There's also a clever "ping-pong" type keepalive system at play - there are multiple characteristics broadcast, and one of them is for keep-alive. It seems devices also use this keepalive to keep the app active over time. That should work with even 2 devices - if I understand it correctly, device A will K/A device B after a period of time, and this will cause B to act. That means B will then K/A device A after a period of time, and the cycle can continue. I see the concerns about "2 sleeping iOS devices might not find each other", but wonder to what extent this will be a realistic scenario, versus an academic one - given the extent to which people are on their phones these days, and the size of that population, the issue likely fades in significance. Especially considering no app will get full adoption, no system will ever be perfect, and it's very much all about probabilities - the app can't determine if your 30 second exposure was higher risk than 30 minutes sitting 5m apart. Hopefully the testing phase currently underway will give some insight as to if this is a problem.
ngcc_hk 6y ago
Contact not contract in the title?
ck2 6y ago
Can we stop pretending that if half the population refuses to wear masks and/or stay-at-home to spare others that they are going to be open and honest and assist contact tracing when there is no obligation to do so? Why would they bother?
- flattone 6y ago
  Im pretty opposite to those folks. Still im not installing anything.
filleokus 6y ago
This is again one of those cases where, even though it's nice to see the source code, it's very hard to verify what's actually running on our devices. The same case with Signal and other secure messaging apps. How would a scheme work, that (within the confines of the current App Store regime) allowed users to verify the source code look? Could Apple/Google maybe hash every file as part of the compilation/linking process, and then concatenate that in some way and include it in the signed binary and expose it in the App Store? It would be really neat with some process where I can clone a repo on my machine, run some script and get an identifier, and verify that it is the same as what is being shown in the App Store on my device.
- m4rtink 6y ago
  There are initiatives to provide reproducibke builds - you build the code youself and get a binary identical to the one being distributed. This is mainly taking place in Linux distros at the moment, bit Fdroid is doing something related on Android, building all the apps they host on their own infrastructure.
  - filleokus 6y ago
    Yeah, thinking about just a bit more, it seems like it's not possible to do without giving the source to Apple. If it's done on a the developer's machine I'm guessing it's always going to be possible to mess with it somehow.
    - m4rtink 6y ago
      For reproducible builds the source needs to be available to the users, so they can rebuild the software themselves and verify the binary that is being distributed is 1:1 similar. There is really no way around that. As for "messing it up on developer machine" - that's not really possibly if the build is really reproducible. If the users get the same binary after building the source, they can be sure they have the source matching the binary. If the binary they get is different from what the developer built on their machine, there is a good chance they don't have the source matching the binary, which is exactly what reproducible builds aims to protect them from.
tomduncalf 6y ago
There’s some good initial investigation into this at https://reincubate.com/blog/staying-alive-covid-19-background-tracing/ https://reincubate.com/blog/staying-alive-covid-19-backgroun..., which I posted to https://news.ycombinator.com/item?id=23108867 https://news.ycombinator.com/item?id=23108867 in case it warrants a separate discussion. Sounds like their approach is fairly privacy conscious and clever in terms of taking advantage of how each platform works - whether it works well enough and whether people will use it despite “not using the Apple/Google way” I guess we will see
- danieltillett 6y ago
  Tom do you know if anyone has told the developers of the useless Australian app about this?
  - brutusborn 6y ago
    Why do you say it is useless?
    - danieltillett 6y ago
      Because it doesn’t work on iOS. Given the Australian market is 50% iOS this kind of defeats the purpose. We really should just dump the worthless app we have and just use the NHS version.
      - brutusborn 6y ago
        These [1] people disagree. Can you commment? Personally I don't know enough to judge myself. [1] https://www.scimex.org/newsfeed/expert-reaction-covidsafe-app-released,-but-does-it-work-on-iphones https://www.scimex.org/newsfeed/expert-reaction-covidsafe-ap...
        danieltillett 6y ago
        No they don’t. They are all saying it doesn’t work when the app is in the background on iOS. This makes the app worthless on iOS as nobody it going to walk around with the app in the foreground the whole time. The NHS app appears to solve this problem.
Mvandenbergh 6y ago
Very interesting. We probably won't need it fully up and running for another week or two so hopefully bugs will be out by then. For context, there are two ways of doing digital contact tracing. A centralised system which tracks everyone all the time and runs a central algorithm for deciding whether someone is at risk on all that data. This is what China, South Korea, and Taiwan have done. Advantage: it seems to work. Disadvantage: government has a database of literally everyone's movements. In SK they also use CCTV and other data, it's a nightmarish panopticon. "Minimally disclosive" contact tracing. This keeps as much data as possible on the device and only share some of it with other devices or central servers. Obviously, designing these protocols is a balancing act between privacy and functionality. Different groups have designed protocols that make different choices there. The two main competing protocols are DP-3T, on which Google/Apple have based their API and PEPP-PT / ROBERT which some countries including the UK have been building their solution. Until very recently, Germany was also using PEPP-PT but they have switched to DP-3T. Both protocols make trade-offs between the amount of information which leaks and the usefulness of the tool. That's important. Installing an app based on either will strictly reduce your current privacy. Both frameworks use pseudo-random rotating keys which are exchanged over Bluetooth. In PEPP-PT a central server manages a rotating private key which is used to generate a set of time-gated ephemeral IDs for each device. Devices exchange and log these IDs. When a health authority determines that someone is infected, they issue them a key which allows them to upload all their logged IDs to the central server. (Optionally, they can just allow them to self report which NHSX seems to be doing) The server is able to determine who the infected person's phone has logged a contact with and notify those people. A random sample of additional people also receive notification messages which their phones are able to discard as invalid decoy messages. Because relatively rich data goes to the server, real time data on interaction patterns of the infected is available and notification algorithms can be tested and tweaked. Since we don't know exactly how Bluetooth propagation and covid infection map to each other, this may end up being an important step. In DP-3T, the keys are generated on the devices and IDs are stored only on the devices. If a central server authorises you to do so (based on a confirmed diagnosed infection), you broadcast the IDs of all the devices you have been in proximity to. All devices regularly download a list of IDs and check the list for one of their own rotating ID numbers. If they match, the user is notified and is able to pre-emptively isolate. The second approach reduces the consequences of a nefarious central operator but at the cost of sharing more information with more people (since everyone sees the list of possibly-infected IDs). In other words, even in privacy terms, this is not a perfect approach either. That information can be used to carry out re-identification attacks and reveal infected users if certain conditions are met. From a privacy point of view, I think many people would prefer the latter (possibly allow malicious attacker, if they are able to do certain not-so-easy things to determine that they were infected) since most people in the UK will not consider that deeply private and secret information about themselves. Many of my friends who got it have posted about it on FB, twitter, etc. The former, which gives a state actor more information seems like a greater breach of privacy. A final point which I think is super important: we don't know if either of these minimally disclosive options work in practice. No-one has used them in the wild yet. If they both worked then we could say - DP-3T has fewer privacy implications, they both work, therefore it is strictly superior. Since we don't know whether they both work (or even if either one works), we are instead left with a balancing act between privacy and usefulness which is not an easy one. Of course, if due to API support reasons, only the OEM supported protocol can be made to work then regardless of any theoretical arguments, that is the one that we will need to use. I suspect we will know by the end of the weekend if their implementation works in practice. I would like to see statutory safeguards put in place for this data. If they really need it then I get that, but it is important that if we do not have the technical safeguard we have legal ones. (Also, Google/Apple had a difficult choice to make here because they operate everywhere. They had to pick something that they feel comfortable rolling out to their devices in every country.)
jamieweb 6y ago
I'm delighted to see that they have a vulnerability disclosure program for the app too [1]. That's fairly rare for the public sector - the UK Gov and NCSC are really leading on this sort of stuff. [1] https://github.com/nhsx/COVID-19-app-iOS-BETA/blob/master/SECURITY.md https://github.com/nhsx/COVID-19-app-iOS-BETA/blob/master/SE...
- IshKebab 6y ago
  Agreed. I think the decision to go it on their own and not use Google/Apple's API is completely bone-headed and won't work at all. But given that they made that decision, everything else they've done seems pretty good.
davb 6y ago
Interesting to see from the docs that it seems to have been built by VMWare Pivotal, rather than an internal NHS(X) team.
- darrenf 6y ago
  This was mentioned by the media some days ago, eg https://www.bbc.co.uk/news/technology-52551273 https://www.bbc.co.uk/news/technology-52551273
eternalban 6y ago
Any contract tracing system that is not time limited and disposable by design is a surveillance system being introduced in the guise of contact tracing. My ideal tracing system would include disposable components, such as time-boxed smart cards, that are disposed of when an epidemic wave (cycle) ends. If the pandemic has multiple waves, each wave will entail producing a new series of disposable components. Another important aspect of a genuine tracing system would be that it does not hook into infrastructure of surveillance capitalism behemoths. The regrettable fact is that this contact tracing app will definitely become a requirement for getting a job, and very likely at some point a de facto identity and civil passport for being able to access modern infrastructure and urban areas.
- ryeights 6y ago
  >The regrettable fact is that this contact tracing app will definitely become a requirement for getting a job, and very likely at some point a de facto identity and civil passport for being able to access modern infrastructure and urban areas. Should be an easy fix now that the app is open-sourced: just build a version of the app with all the tracking code stripped out, leaving a mock UI that always says "no contact detected"
  - eternalban 6y ago
    The issue is not that. This is raising private corporate infrastructure (Google, Apple, etc.) to a quasi-governmental role. Something so tightly bound with fundamental civil and human rights concerns, should not depend on these giants. Think China's Baidu. And here is a deliciously ironic title and article: China's Dystopian Tech Could Be Contagious https://www.theatlantic.com/technology/archive/2018/02/chinas-dangerous-dream-of-urban-control/553097/ https://www.theatlantic.com/technology/archive/2018/02/china...
3fe9a03ccd14ca5 6y ago
Whelp, we've sure entered into the twilight zone of digital privacy quickly. A month ago we were saying "15 days to flatten the curve", today we have MRAPS busting up protests and digital privacy continuing to circle the drain... and THE PEOPLE LIKE IT THIS WAY?
seanwilson 6y ago
Did the NHS have any good reasons why they weren't going to work with Google and Apple (who surely have more expertise for this)? Why not work on a single open source iOS + Android app that is shared and used in all countries so we can get cross border tracing? If governments are concerned about Google and Apple getting access to data, what's the argument against the above where each country uses their own servers to store tracing data?
- g_p 6y ago
  The NHS wanted the ability to model "risk-from" a contact, rather than only "risk-to". In the decentralised approach, infected users upload a list of their own identifiers, these are broadcast, and everyone checks if they've been near one. There needs to be a threshold picked that will trigger to alert you - probably "contact-minutes" with an infected person. The NHS approach is less binary, as they believe based on the rate of spread that it's necessary to request people report symptoms and share their own anonymous contact log. Based on the level of exposure the "suspected individual" had with other known/suspected infected people, combined with the number of other known/suspected infected people you were near, your advice can be tailored. You might be told to isolate, but then you're asked to report symptoms regularly. Others in the same position as you will be doing so as well - there is potential here to actually tell people they no longer need to self isolate if the "group" don't have any symptoms emerging, based on the epidemiology and the rate people are believed to develop symptoms in the population. There's a good write-up of this actually in the NCSC security report and post - https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.pdf https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.... and https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contac.... It explains a lot about the rationale, and not only for security, also in terms of the approach and how the app is designed to work when people have symptoms etc.
  - seanwilson 6y ago
    Thanks for that I'll have a read. Is there any discussion about other countries using this NHS app (the repo says MIT license)? Each country could customise the alert heuristic but it seems like a waste of resources for each country to code their own app for a global problem.
gurjeet 6y ago
s/contract/contact/
deleted 6y ago
[deleted]
scared2 6y ago
Contact not contract
cs02rm0 6y ago
There's a code review, of sorts, (from an ex-Googler) here: https://lockdownsceptics.org/code-review-of-fergusons-model/ https://lockdownsceptics.org/code-review-of-fergusons-model/
- g_p 6y ago
  This review seems to be of academic code for an epidemiological model, rather than anything to do with the app itself? The 2 apps are in Kotlin and Objective C, rather than C++.
  - cs02rm0 6y ago
    Sorry, it is. Managed to cross wires in my head. In my weak defence, it's not often we get two bits of code open sourced in a week relating to UK government policy.
    - g_p 6y ago
      Hah, good point! Although in fairness to UK Gov, they are pretty forward thinking when it comes to open sourcing infrastructure that others would baulk at open sourcing [1]. Just usually not hugely relevant to their current policy, rather the underlying infrastructure. There's actually some quite nice (open-source and reusable) guidance/handbooks etc. on remote working and security from the Ministry of Justice [2]. Probably not nearly as well advertised as it should be. Clearly won't meet everyone's needs, but there's a lot more out there than people probably realise! :) [1] https://github.com/ministryofjustice/hmpps-book-secure-move-api https://github.com/ministryofjustice/hmpps-book-secure-move-..., https://github.com/ministryofjustice/correspondence_tool_staff https://github.com/ministryofjustice/correspondence_tool_sta..., https://github.com/alphagov/govwifi-admin https://github.com/alphagov/govwifi-admin etc. [2] https://github.com/ministryofjustice/security-guidance https://github.com/ministryofjustice/security-guidance
    - mellosouls 6y ago
      Actually, it is often. https://github.com/alphagov https://github.com/alphagov
sschueller 6y ago
Here is the approach Switzerland it taking [2]. All open source and decentralised privacy-preserving. Available for any other state to use. It is the responsibility of the app user to get tested or quarantine themselves if the app shows you have been in contact. No central authority knows who you have been in contact with or who you are. The installation of the App will also most likely be voluntary. [1] https://github.com/DP-3T/documents https://github.com/DP-3T/documents [2] https://github.com/DP-3T/dp3t-app-android-ch https://github.com/DP-3T/dp3t-app-android-ch
tomduncalf 6y ago
One mildly interesting thing I noticed is that some of the files date back to 12th March (possibly earlier, I’m on my mobile so can’t search properly) - back before the UK was taking this particularly seriously in public, if I remember correctly (restaurants and pubs weren’t closed until 20th). Suggests at least someone realised the gravity of the situation!
aclelland 6y ago
As someone from the UK, I'm really appreciative of all of the people who are actively looking into the app and highlighting privacy, security and other concerns. My main concern with all of the contact tracing apps is that I live near a very busy road, hundreds of people per day walk past my house and they're going to be about 3 meters away from my phone, albeit through a brick wall and a 6' hedge. My concern is that the apps will pick up the random passers by and I'll be forced to isolate my family based on a false detection. Maybe this isn't an issue and these apps will have protection against this sort of false positive. I've yet to hear either way. edit: Thanks for all the answers! Definitely helped calm the concerns about this sort of false-positive.
- DanBC 6y ago
  The current app needs two phones to be in contact for at least 15 minutes before it triggers anything.
- cameronh90 6y ago
  Firstly, people briefly walking past your wall shouldn't trigger either system as they're both set up to require a period of time and a certain signal strength. Secondly, situations like this are possibly one of the situations that will benefit this NHS-style centralised contact tracing over the distributed one as they can apply more advanced models to the nature of the exposure and try to reduce false positives. Or indeed, potentially expose that information to human contact tracers (though right now they say they have no plans to do this).
- neuronic 6y ago
  As far as I understood the apps are designed to measure time of being near someone as well. I think within X meters for Y minutes (based on how often the bluetooth pings are exchanged). This also has basis in virology where rate of infection for flu/corona substantially increases when you are close to someone within X meters (say 1.5m) for longer than a defined time Y (say 10min).
- chimprich 6y ago
  > I'll be forced to isolate my family based on a false detection. Installation of the app is voluntary, and there's no sign that's going to change. Forced installation would probably be politically and logistically impossible. If this was a problem, workarounds include deciding that the app wasn't usable in your situation, or turning off bluetooth on your phone while at home.
holri 6y ago
For reference Austrias Red Cross App is here: https://github.com/austrianredcross https://github.com/austrianredcross
- g_p 6y ago
  Interesting - it looks like they've gone down the route of having a way for people to do a "digital handshake" (both press the button, and have devices within a short distance of each other) to create their contact pairings. I do wonder how many people will use this feature, or remember to use it. This would seem to reduce false positives, but make it much less useful at scale (i.e. it won't help trace people who were on a train or bus).

342 points by orangepanda 6y ago

This is a big step. I’ve previously been pretty against the NHS’s approach (being mostly centralised etc), but I’m very happy to see that they’ve open sourced it. Does this also contain the server side that does the matching?

spzb 6y ago
No it doesn't. Neither does it include some of the configuration values you need to build the mobile apps. It looks like this was a last minute political decision to open source the code in the face of growing public disquiet rather than a co-ordinated effort.
- g_p 6y ago
  It takes about 5 minutes to obtain the API keys from the Android app to be able to build it. It was also a pretty well-documented process to get the Android app to build (unlike some Android "open source" projects that seem to be designed to be impossible to actually build!) Open sourcing the app was actually planned all along - when Matt Hancock announced the app several weeks ago [1], he said it would be open sourced at the time. [1] https://www.theguardian.com/politics/2020/apr/12/uk-app-to-track-coronavirus-spread-to-be-launched https://www.theguardian.com/politics/2020/apr/12/uk-app-to-t...
- cameronh90 6y ago
  They have said the server code will be coming soon. The intention has been to release the source code for the app since it was announced. I doubt this is a last minute political decision since the UK government already release a huge amount of their code as open source. The project isn't perfect - but consider that it's been put together in a month, it's still beta and their focus has been on making it work, not making it easy to build. Frankly, the level of transparency from the NCSC and NHSX has been far ahead of most governments and private organisations. You can disagree with the contact tracing approach, but if all government work was done with this level of transparency we'd be in a much better position than we are now.

londons_explore 6y ago

> Each two hours, we merge any changes from master into internal Not hiding the fact the published source code isn't that built into the app then...

m0xte 6y ago
Yes indeed. I'm not buying it isn't patched in some way before it's pushed to any app stores. Especially with all the noise beforehand about how it operates and the involvement of GCHQ/NCSC in development. Edit: some digging. NHSX is run by Matthew Gould. Former Israel diplomat and tied via UK-Israel technology hub to NICE (Neptune Intelligence Computer Engineering) Ltd which is a former Israeli army surveillance and data security company among other functions. So basically a hotpot of reasons not to install this thing.
- TechBro8615 6y ago
  Well, it should be fairly trivial to put it through the rigor of some MITM proxies and verify that the built app is not making any unexpected network requests. I look forward to infosec twitter ripping this apart.
  - m0xte 6y ago
    That would be interesting analytics but you just never know with this stuff. Even basic intercept-avoiding technology like burst encoding require very long term sampling to detect, so the thing would need to be disassembled and every line of code analysed.
- sixstringtheory 6y ago
  It's the same story as with Signal for iOS. How do we know the version downloaded from the App Store is the same code hosted on GitHub? I'd like to have the option to sideload it. Clearly that would involve some work on their backend, but I think that's fairer than the stuff described in this Signal GitHub issue [0] and Telegram's website [1] regarding the same thing. EDIT: if I'm wrong please leave some details for myself and others to learn more. I've worked on iOS apps for several years, and as far as I know there's no way to verify if an app downloaded from the App Store was compiled from a particular code revision. Even the same code compiled on separate machines can produce different unique binary IDs. And on the scale of difficulty, I'd say that sideloading is less difficult than jailbreaking, if that method even really works for this problem. [0]: https://github.com/signalapp/Signal-iOS/issues/641 https://github.com/signalapp/Signal-iOS/issues/641 [1]: https://core.telegram.org/reproducible-builds#reproducible-builds-for-ios https://core.telegram.org/reproducible-builds#reproducible-b...

aboringusername 6y ago

From [1]: // TODO: We need a real device to test Bluetooth scanning if isMultipleAdvertisementSupported == false // TODO: We need analytics to identify number of devices that fall into this bucket I don't know whether to laugh or cry reading those comments, the fact that this is a "to do" whilst the app is in "testing" and the fact they've decided the appropriate procedure is to reinvent the work Google and Apple have already done. Google already published their code/APIs in [2]. I'm sure these considerations are taken care of by the framework the OS vendors have published themselves. It's absolute pure arrogance that anyone would even attempt to re-create the work that is being done at the OS level and not 'fall in line'. Germany back tracked, Australia back tracked, and the UK too, will back track and implement Google's APIs. In a time where the message is "saving lives", those TODOs are not living up to that motto. This app is a complete waste of time, resources and money. Use the official APIs and be done with it, anything else is putting people in harms way because you think you "know best". The UK government claimed they reached 100k tests, fudged the numbers, and haven't hit that target since. But it's okay, they'll hit 200k by the end of this month too! Pure 100% incompetence. [1]: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/DeviceDetection.kt https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... [2]: https://github.com/google/exposure-notifications-android https://github.com/google/exposure-notifications-android

ealexhudson 6y ago
This app is many things, but it does not reimplement the Google/Apple scheme, and works very differently. If you believe knowing contacts who tested positive is enough, the Google/Apple scheme is fine. If you need to know earlier and/risk assess based on exposure, only the NHSX approach works. It's not a clear cut Central v Not Central decision.
- dtf 6y ago
  I'd heard another interesting angle to this - that the Google/Apple notification scheme is decentralized, but users can only test C-19 positive via a central authority. Meanwhile the NHSX notification scheme is centralized, but users can self-identify as C-19 positive. Can anyone confirm this?

flattone 6y ago

Twitter user probing for safety & security issues ‘india now NHS next’ https://mobile.twitter.com/fs0c131y/status/1258436033840021504 https://mobile.twitter.com/fs0c131y/status/12584360338400215...

azinman2 6y ago

I’m shocked to see all the Firebase and Google analytics in there. I‘m quite surprised that a gov built app would include this. Disappointing from the UK (along with the fact that they really just should use the Apple/Google framework to begin with, which will in the end better integrate with the device and thus will perform better from a technical perspective).

RandallBrown 6y ago
I assume they want to know if people are actually using this app and I don't know if building an analytics platform is the best way for them to spend their time right now. It does undermine any privacy claims they might make.
- saagarjha 6y ago
  > I assume they want to know if people are actually using this app Apple provides such information without any third-party analytics SDKs.
- AJRF 6y ago
  I agree around usage of Firebase here because no one really knows what data is being sucked up there but it looks like the intent of usage here is pretty clean; If you look at the code Firebase is in there because the push notifications to notify of infection are sent via Firebase Cloud Messaging. I also grabbed the Google plist out of the IPA from the app store and it has analytics turned off.
  - Sephiroth87 6y ago
    Then why is the Analytics SDK even there? It’s not required for messaging
    - RandallBrown 6y ago
      The directions for integrating SDKs are usually something along the lines of "Add Firebase to your Podfile", which often adds way more than you need. Given that these devs were likely in a hurry, it wouldn't surprise me if they forgot to go back and clean this up after getting it working.

stephenheron 6y ago

Some quite interesting stuff around how they might be getting around the background iOS restrictions[1] can be found in the Android source. Looking at the Apple documentation on background peripheral bluetooth, they state "All service UUIDs contained in the value of the CBAdvertisementDataServiceUUIDsKey advertisement key are placed in a special “overflow” area; they can be discovered only by an iOS device that is explicitly scanning for them"[2] I wonder if they have managed to reverse engineer this overflow area so it is accessible via Android. Someone did some looking into this and it seems at least feasible[3] [1]: https://github.com/nhsx/COVID-19-app-Android-BETA/blob/master/app/src/main/java/uk/nhs/nhsx/sonar/android/app/ble/Scanner.kt#L58 https://github.com/nhsx/COVID-19-app-Android-BETA/blob/maste... [2]: https://developer.apple.com/library/archive/documentation/NetworkingInternetWeb/Conceptual/CoreBluetooth_concepts/CoreBluetoothBackgroundProcessingForIOSApps/PerformingTasksWhileYourAppIsInTheBackground.html https://developer.apple.com/library/archive/documentation/Ne... [3]: https://crownstone.rocks/2018/06/27/ios-advertisements-in-the-background https://crownstone.rocks/2018/06/27/ios-advertisements-in-th...

g_p 6y ago
Yes, this seems to be one of the rather clever aspects of the design - this appears to make it possible to discover iOS devices that are in the proprietary "iOS-only" mode of discovery. It seems that once one of these "overflow" advertisements is discovered, it attempts a connect that is enough to wake the device and carry out normal tracing. I left an iPhone unplugged, stationary, idle and asleep, running the app for about 5 hours. Then introduced an Android device and it was detected immediately. That seems to suggest this aspect works well. There's also a clever "ping-pong" type keepalive system at play - there are multiple characteristics broadcast, and one of them is for keep-alive. It seems devices also use this keepalive to keep the app active over time. That should work with even 2 devices - if I understand it correctly, device A will K/A device B after a period of time, and this will cause B to act. That means B will then K/A device A after a period of time, and the cycle can continue. I see the concerns about "2 sleeping iOS devices might not find each other", but wonder to what extent this will be a realistic scenario, versus an academic one - given the extent to which people are on their phones these days, and the size of that population, the issue likely fades in significance. Especially considering no app will get full adoption, no system will ever be perfect, and it's very much all about probabilities - the app can't determine if your 30 second exposure was higher risk than 30 minutes sitting 5m apart. Hopefully the testing phase currently underway will give some insight as to if this is a problem.

ngcc_hk 6y ago

Contact not contract in the title?

ck2 6y ago

Can we stop pretending that if half the population refuses to wear masks and/or stay-at-home to spare others that they are going to be open and honest and assist contact tracing when there is no obligation to do so? Why would they bother?

flattone 6y ago
Im pretty opposite to those folks. Still im not installing anything.

filleokus 6y ago

This is again one of those cases where, even though it's nice to see the source code, it's very hard to verify what's actually running on our devices. The same case with Signal and other secure messaging apps. How would a scheme work, that (within the confines of the current App Store regime) allowed users to verify the source code look? Could Apple/Google maybe hash every file as part of the compilation/linking process, and then concatenate that in some way and include it in the signed binary and expose it in the App Store? It would be really neat with some process where I can clone a repo on my machine, run some script and get an identifier, and verify that it is the same as what is being shown in the App Store on my device.

m4rtink 6y ago
There are initiatives to provide reproducibke builds - you build the code youself and get a binary identical to the one being distributed. This is mainly taking place in Linux distros at the moment, bit Fdroid is doing something related on Android, building all the apps they host on their own infrastructure.
- filleokus 6y ago
  Yeah, thinking about just a bit more, it seems like it's not possible to do without giving the source to Apple. If it's done on a the developer's machine I'm guessing it's always going to be possible to mess with it somehow.
  - m4rtink 6y ago
    For reproducible builds the source needs to be available to the users, so they can rebuild the software themselves and verify the binary that is being distributed is 1:1 similar. There is really no way around that. As for "messing it up on developer machine" - that's not really possibly if the build is really reproducible. If the users get the same binary after building the source, they can be sure they have the source matching the binary. If the binary they get is different from what the developer built on their machine, there is a good chance they don't have the source matching the binary, which is exactly what reproducible builds aims to protect them from.

tomduncalf 6y ago

There’s some good initial investigation into this at https://reincubate.com/blog/staying-alive-covid-19-background-tracing/ https://reincubate.com/blog/staying-alive-covid-19-backgroun..., which I posted to https://news.ycombinator.com/item?id=23108867 https://news.ycombinator.com/item?id=23108867 in case it warrants a separate discussion. Sounds like their approach is fairly privacy conscious and clever in terms of taking advantage of how each platform works - whether it works well enough and whether people will use it despite “not using the Apple/Google way” I guess we will see

danieltillett 6y ago
Tom do you know if anyone has told the developers of the useless Australian app about this?
- brutusborn 6y ago
  Why do you say it is useless?
  - danieltillett 6y ago
    Because it doesn’t work on iOS. Given the Australian market is 50% iOS this kind of defeats the purpose. We really should just dump the worthless app we have and just use the NHS version.
    - brutusborn 6y ago
      These [1] people disagree. Can you commment? Personally I don't know enough to judge myself. [1] https://www.scimex.org/newsfeed/expert-reaction-covidsafe-app-released,-but-does-it-work-on-iphones https://www.scimex.org/newsfeed/expert-reaction-covidsafe-ap...
      - danieltillett 6y ago
        No they don’t. They are all saying it doesn’t work when the app is in the background on iOS. This makes the app worthless on iOS as nobody it going to walk around with the app in the foreground the whole time. The NHS app appears to solve this problem.

Mvandenbergh 6y ago

Very interesting. We probably won't need it fully up and running for another week or two so hopefully bugs will be out by then. For context, there are two ways of doing digital contact tracing. A centralised system which tracks everyone all the time and runs a central algorithm for deciding whether someone is at risk on all that data. This is what China, South Korea, and Taiwan have done. Advantage: it seems to work. Disadvantage: government has a database of literally everyone's movements. In SK they also use CCTV and other data, it's a nightmarish panopticon. "Minimally disclosive" contact tracing. This keeps as much data as possible on the device and only share some of it with other devices or central servers. Obviously, designing these protocols is a balancing act between privacy and functionality. Different groups have designed protocols that make different choices there. The two main competing protocols are DP-3T, on which Google/Apple have based their API and PEPP-PT / ROBERT which some countries including the UK have been building their solution. Until very recently, Germany was also using PEPP-PT but they have switched to DP-3T. Both protocols make trade-offs between the amount of information which leaks and the usefulness of the tool. That's important. Installing an app based on either will strictly reduce your current privacy. Both frameworks use pseudo-random rotating keys which are exchanged over Bluetooth. In PEPP-PT a central server manages a rotating private key which is used to generate a set of time-gated ephemeral IDs for each device. Devices exchange and log these IDs. When a health authority determines that someone is infected, they issue them a key which allows them to upload all their logged IDs to the central server. (Optionally, they can just allow them to self report which NHSX seems to be doing) The server is able to determine who the infected person's phone has logged a contact with and notify those people. A random sample of additional people also receive notification messages which their phones are able to discard as invalid decoy messages. Because relatively rich data goes to the server, real time data on interaction patterns of the infected is available and notification algorithms can be tested and tweaked. Since we don't know exactly how Bluetooth propagation and covid infection map to each other, this may end up being an important step. In DP-3T, the keys are generated on the devices and IDs are stored only on the devices. If a central server authorises you to do so (based on a confirmed diagnosed infection), you broadcast the IDs of all the devices you have been in proximity to. All devices regularly download a list of IDs and check the list for one of their own rotating ID numbers. If they match, the user is notified and is able to pre-emptively isolate. The second approach reduces the consequences of a nefarious central operator but at the cost of sharing more information with more people (since everyone sees the list of possibly-infected IDs). In other words, even in privacy terms, this is not a perfect approach either. That information can be used to carry out re-identification attacks and reveal infected users if certain conditions are met. From a privacy point of view, I think many people would prefer the latter (possibly allow malicious attacker, if they are able to do certain not-so-easy things to determine that they were infected) since most people in the UK will not consider that deeply private and secret information about themselves. Many of my friends who got it have posted about it on FB, twitter, etc. The former, which gives a state actor more information seems like a greater breach of privacy. A final point which I think is super important: we don't know if either of these minimally disclosive options work in practice. No-one has used them in the wild yet. If they both worked then we could say - DP-3T has fewer privacy implications, they both work, therefore it is strictly superior. Since we don't know whether they both work (or even if either one works), we are instead left with a balancing act between privacy and usefulness which is not an easy one. Of course, if due to API support reasons, only the OEM supported protocol can be made to work then regardless of any theoretical arguments, that is the one that we will need to use. I suspect we will know by the end of the weekend if their implementation works in practice. I would like to see statutory safeguards put in place for this data. If they really need it then I get that, but it is important that if we do not have the technical safeguard we have legal ones. (Also, Google/Apple had a difficult choice to make here because they operate everywhere. They had to pick something that they feel comfortable rolling out to their devices in every country.)

jamieweb 6y ago

I'm delighted to see that they have a vulnerability disclosure program for the app too [1]. That's fairly rare for the public sector - the UK Gov and NCSC are really leading on this sort of stuff. [1] https://github.com/nhsx/COVID-19-app-iOS-BETA/blob/master/SECURITY.md https://github.com/nhsx/COVID-19-app-iOS-BETA/blob/master/SE...

IshKebab 6y ago
Agreed. I think the decision to go it on their own and not use Google/Apple's API is completely bone-headed and won't work at all. But given that they made that decision, everything else they've done seems pretty good.

davb 6y ago

Interesting to see from the docs that it seems to have been built by VMWare Pivotal, rather than an internal NHS(X) team.

darrenf 6y ago
This was mentioned by the media some days ago, eg https://www.bbc.co.uk/news/technology-52551273 https://www.bbc.co.uk/news/technology-52551273

eternalban 6y ago

Any contract tracing system that is not time limited and disposable by design is a surveillance system being introduced in the guise of contact tracing. My ideal tracing system would include disposable components, such as time-boxed smart cards, that are disposed of when an epidemic wave (cycle) ends. If the pandemic has multiple waves, each wave will entail producing a new series of disposable components. Another important aspect of a genuine tracing system would be that it does not hook into infrastructure of surveillance capitalism behemoths. The regrettable fact is that this contact tracing app will definitely become a requirement for getting a job, and very likely at some point a de facto identity and civil passport for being able to access modern infrastructure and urban areas.

ryeights 6y ago
>The regrettable fact is that this contact tracing app will definitely become a requirement for getting a job, and very likely at some point a de facto identity and civil passport for being able to access modern infrastructure and urban areas. Should be an easy fix now that the app is open-sourced: just build a version of the app with all the tracking code stripped out, leaving a mock UI that always says "no contact detected"
- eternalban 6y ago
  The issue is not that. This is raising private corporate infrastructure (Google, Apple, etc.) to a quasi-governmental role. Something so tightly bound with fundamental civil and human rights concerns, should not depend on these giants. Think China's Baidu. And here is a deliciously ironic title and article: China's Dystopian Tech Could Be Contagious https://www.theatlantic.com/technology/archive/2018/02/chinas-dangerous-dream-of-urban-control/553097/ https://www.theatlantic.com/technology/archive/2018/02/china...

3fe9a03ccd14ca5 6y ago

Whelp, we've sure entered into the twilight zone of digital privacy quickly. A month ago we were saying "15 days to flatten the curve", today we have MRAPS busting up protests and digital privacy continuing to circle the drain... and THE PEOPLE LIKE IT THIS WAY?

seanwilson 6y ago

Did the NHS have any good reasons why they weren't going to work with Google and Apple (who surely have more expertise for this)? Why not work on a single open source iOS + Android app that is shared and used in all countries so we can get cross border tracing? If governments are concerned about Google and Apple getting access to data, what's the argument against the above where each country uses their own servers to store tracing data?

g_p 6y ago
The NHS wanted the ability to model "risk-from" a contact, rather than only "risk-to". In the decentralised approach, infected users upload a list of their own identifiers, these are broadcast, and everyone checks if they've been near one. There needs to be a threshold picked that will trigger to alert you - probably "contact-minutes" with an infected person. The NHS approach is less binary, as they believe based on the rate of spread that it's necessary to request people report symptoms and share their own anonymous contact log. Based on the level of exposure the "suspected individual" had with other known/suspected infected people, combined with the number of other known/suspected infected people you were near, your advice can be tailored. You might be told to isolate, but then you're asked to report symptoms regularly. Others in the same position as you will be doing so as well - there is potential here to actually tell people they no longer need to self isolate if the "group" don't have any symptoms emerging, based on the epidemiology and the rate people are believed to develop symptoms in the population. There's a good write-up of this actually in the NCSC security report and post - https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.pdf https://www.ncsc.gov.uk/files/NHS-app-security-paper%20V0.1.... and https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contac.... It explains a lot about the rationale, and not only for security, also in terms of the approach and how the app is designed to work when people have symptoms etc.
- seanwilson 6y ago
  Thanks for that I'll have a read. Is there any discussion about other countries using this NHS app (the repo says MIT license)? Each country could customise the alert heuristic but it seems like a waste of resources for each country to code their own app for a global problem.

gurjeet 6y ago

s/contract/contact/

deleted 6y ago

[deleted]

scared2 6y ago

Contact not contract

cs02rm0 6y ago

There's a code review, of sorts, (from an ex-Googler) here: https://lockdownsceptics.org/code-review-of-fergusons-model/ https://lockdownsceptics.org/code-review-of-fergusons-model/

g_p 6y ago
This review seems to be of academic code for an epidemiological model, rather than anything to do with the app itself? The 2 apps are in Kotlin and Objective C, rather than C++.
- cs02rm0 6y ago
  Sorry, it is. Managed to cross wires in my head. In my weak defence, it's not often we get two bits of code open sourced in a week relating to UK government policy.
  - g_p 6y ago
    Hah, good point! Although in fairness to UK Gov, they are pretty forward thinking when it comes to open sourcing infrastructure that others would baulk at open sourcing [1]. Just usually not hugely relevant to their current policy, rather the underlying infrastructure. There's actually some quite nice (open-source and reusable) guidance/handbooks etc. on remote working and security from the Ministry of Justice [2]. Probably not nearly as well advertised as it should be. Clearly won't meet everyone's needs, but there's a lot more out there than people probably realise! :) [1] https://github.com/ministryofjustice/hmpps-book-secure-move-api https://github.com/ministryofjustice/hmpps-book-secure-move-..., https://github.com/ministryofjustice/correspondence_tool_staff https://github.com/ministryofjustice/correspondence_tool_sta..., https://github.com/alphagov/govwifi-admin https://github.com/alphagov/govwifi-admin etc. [2] https://github.com/ministryofjustice/security-guidance https://github.com/ministryofjustice/security-guidance
  - mellosouls 6y ago
    Actually, it is often. https://github.com/alphagov https://github.com/alphagov

sschueller 6y ago

Here is the approach Switzerland it taking [2]. All open source and decentralised privacy-preserving. Available for any other state to use. It is the responsibility of the app user to get tested or quarantine themselves if the app shows you have been in contact. No central authority knows who you have been in contact with or who you are. The installation of the App will also most likely be voluntary. [1] https://github.com/DP-3T/documents https://github.com/DP-3T/documents [2] https://github.com/DP-3T/dp3t-app-android-ch https://github.com/DP-3T/dp3t-app-android-ch

tomduncalf 6y ago

One mildly interesting thing I noticed is that some of the files date back to 12th March (possibly earlier, I’m on my mobile so can’t search properly) - back before the UK was taking this particularly seriously in public, if I remember correctly (restaurants and pubs weren’t closed until 20th). Suggests at least someone realised the gravity of the situation!

aclelland 6y ago

As someone from the UK, I'm really appreciative of all of the people who are actively looking into the app and highlighting privacy, security and other concerns. My main concern with all of the contact tracing apps is that I live near a very busy road, hundreds of people per day walk past my house and they're going to be about 3 meters away from my phone, albeit through a brick wall and a 6' hedge. My concern is that the apps will pick up the random passers by and I'll be forced to isolate my family based on a false detection. Maybe this isn't an issue and these apps will have protection against this sort of false positive. I've yet to hear either way. edit: Thanks for all the answers! Definitely helped calm the concerns about this sort of false-positive.

DanBC 6y ago
The current app needs two phones to be in contact for at least 15 minutes before it triggers anything.
cameronh90 6y ago
Firstly, people briefly walking past your wall shouldn't trigger either system as they're both set up to require a period of time and a certain signal strength. Secondly, situations like this are possibly one of the situations that will benefit this NHS-style centralised contact tracing over the distributed one as they can apply more advanced models to the nature of the exposure and try to reduce false positives. Or indeed, potentially expose that information to human contact tracers (though right now they say they have no plans to do this).
neuronic 6y ago
As far as I understood the apps are designed to measure time of being near someone as well. I think within X meters for Y minutes (based on how often the bluetooth pings are exchanged). This also has basis in virology where rate of infection for flu/corona substantially increases when you are close to someone within X meters (say 1.5m) for longer than a defined time Y (say 10min).
chimprich 6y ago
> I'll be forced to isolate my family based on a false detection. Installation of the app is voluntary, and there's no sign that's going to change. Forced installation would probably be politically and logistically impossible. If this was a problem, workarounds include deciding that the app wasn't usable in your situation, or turning off bluetooth on your phone while at home.

holri 6y ago

For reference Austrias Red Cross App is here: https://github.com/austrianredcross https://github.com/austrianredcross

g_p 6y ago
Interesting - it looks like they've gone down the route of having a way for people to do a "digital handshake" (both press the button, and have devices within a short distance of each other) to create their contact pairings. I do wonder how many people will use this feature, or remember to use it. This would seem to reduce false positives, but make it much less useful at scale (i.e. it won't help trace people who were on a train or bus).