16 ms·

Germany's Covid contact tracing app is Open Source

199 points by fredrb 6y ago

xupybd 6y ago
The New Zealand contact tracing app just allows you to log visits to businesses that display QR codes listing their address. So you can have a log of where you've been. Only most businesses here don't have the codes on display as applying for them has too much red tape.
- mschuster91 6y ago
  Also NZ is essentially corona-free, there isn't much pressure for app based tracing as long as those in contact with people coming in from anywhere else (i.e. air and sea port workers, customs officials and the likes) get rigorously tested.
  - monadic2 6y ago
    Still far better, and quite simple at that!, than we have in the US.
    - mschuster91 6y ago
      The US is way too deep in the corona mess to do anything like that. What would help is widespread, easy access to tests (including a moratorium on ICE enforcement and no "paper records" requirement so that also illegalized persons get tested instead of being an unknown harbor!) and especially daily tests for at-risk personnel (medical, public transport, supermarket staff and inmates of prisons, jails and health/elderly care institutions).
      - monadic2 6y ago
        Honestly I’d still take it, why not both?
  - fredrb 6y ago
    Wouldn't a tracing app make more sense than having a rigorous border tests? It takes one miss-tested infected person to start a second wave in the country. So I would assume that the investment to make sure businesses provide the QR pays off testing everyone and risking another lockdown. I'm also not sure countries have the resources to enforce huge amounts of tests at the border.
    - jussij 6y ago
      At present NZ have very strict border restriction in place so they have already illuminated that border issue.
    - johannes1234321 6y ago
      > I'm also not sure countries have the resources to enforce huge amounts of tests at the border. Right. One issue with testing is that the only test you can do for masses in a border are basic health checks like temperature, but aside from all general issues with such kind of test (people are exhausted after travelling on a plane, having to do a test, ...) with COVID symptoms often only appear after one had been infectious for a while already, so one can pass by undetected and still spread. Things like PCR tests take time and effort and have notable cost, which makes it hard to apply on a larger entrance port. Either shut down completely (maybe based on origin region or recently visited regions) or be prepared to handle afterwards ... tracing contacts to identify potential carriers after ridentifying infected is a way which is at least a bit promising.
      - DiogenesKynikos 6y ago
        > Either shut down completely (maybe based on origin region or recently visited regions) or be prepared to handle afterwards If you only shut down based on recently visited regions, you're likely to import cases anyways. With CoVID-19, it takes several weeks to identify an outbreak in a region (especially without extensive testing). By the time you shut down travel from a given region, you've probably already been importing cases for weeks. The WHO has gotten a huge amount of flak for not calling for travel restrictions during this pandemic. But their recommendations were based on the ineffectiveness of travel restrictions,* according to previous research. They recommended screening passengers for symptoms, but also told countries to take measures to limit spread (like testing and contact tracing), on the assumption that countries would import cases. * The WHO's recommendations were also based on the International Health Regulations, an international treaty that basically every country on Earth has joined. Most of the public is unaware of the IHR or what it says about travel restrictions, or of the history of the WHO (one of its founding goals was to stop countries from automatically shutting their borders whenever there was an outbreak, and instead to take rational, evidence-based measures).
metachris 6y ago
Some context: > The German government has asked SAP and Deutsche Telekom to develop the Corona-Warn-App for Germany as open source software. Deutsche Telekom is providing the network and mobile technology and will operate and run the backend for the app in a safe, scalable and stable manner. SAP is responsible for the app development, its framework and the underlying platform. Therefore, development teams of SAP and Deutsche Telekom are contributing to this project. At the same time our commitment to open source means that we are enabling -in fact encouraging- all interested parties to contribute and become part of its developer community. https://github.com/corona-warn-app/cwa-app-android#contributors https://github.com/corona-warn-app/cwa-app-android#contribut...
- tpmx 6y ago
  Wow, those are not two companies that come to mind when "moving fast" is a priority. (I've only worked in a supplier role to Deutsche Telekom, but I can't imagine SAP is any less ... specific about rules and processes.) I guess they probably have some "experimental" departments for recruitment purposes, they must have used those.
  - cheschire 6y ago
    They probably are funding external "startup" style companies which are outside of the corporate HR and union boundaries.
  - zxienin 6y ago
    When serious data privacy and protection concerns are in play, German govt. banking on these is no surprise.
- konschubert 6y ago
  Ah, the two most expensive, most corporate, software development consultancies Germany has to offer.
  - bla3 6y ago
    Don't disagree, but the GitHub project seems to be run well from a quick glance. Maybe the team is small enough.
barbegal 6y ago
I really question whether these apps will be effective. The limitation section https://github.com/corona-warn-app/cwa-documentation/blob/master/solution_architecture.md#limitations https://github.com/corona-warn-app/cwa-documentation/blob/ma... of their architecture document shows that people in close proximity for a few minutes may not even get picked up. Anyone who has dealt with trying to work out distance from Bluetooth signal strength will know that it is virtually impossible once you factor in, the orientation of two devices (signal polarization), their locations (in a pocket, bag, case...) and the local environment (reflections and attenuation from walls, floors ceilings, furniture). Additionally, without knowing exactly how transmission is occurring the risk score calculation https://github.com/corona-warn-app/cwa-documentation/blob/master/solution_architecture.md#risk-score-calculation https://github.com/corona-warn-app/cwa-documentation/blob/ma... may be wildly inaccurate too resulting in the wrong people being notified. And even assuming perfect ability to deduce the risk of infection of two people using the app, will that help in the bigger context. If the people most at risk don't install this app and the least at risk do then you may be drawing resources away from the people that most need help.
- uvw 6y ago
  I imagine it's not meant to be 100% accurate. If it identifies even 50% of the people that may have come in contact with someone who's positive, even considering 50% false positives, I would consider it a rousing success.
  - Schlaefer 6y ago
    Even if there are 95% false positive: if you're able to test all those people and catch the 5% that might still be a net profit. It comes down to cost. Societies are spending thousands of billions to mitigate the problem, even a slight reduction of that number is a win.
    - w-m 6y ago
      As far as I understand, you would need to send everybody who might have been in contact with someone who's positive into quarantine, right away. You can also test them, but you need to quarantine them immediately, as the virus is transmitted before symptoms show. If you just send everybody who was in contact with a positively tested person into testing (they give samples, send them in, get tested, get the results back), but they keep going about their normal lives, they will statistically infect more people before the tests come back. So the false positive rate is quite important, as it potentially means sending thousands of people into home-quarantine.
traspler 6y ago
So are all the parts of what will become the Swiss COVID tracing app: https://github.com/DP-3T https://github.com/DP-3T
- nikeee 6y ago
  The Austrian app can be found here: https://github.com/austrianredcross/ https://github.com/austrianredcross/
- dagurp 6y ago
  The Icelandic app is here https://github.com/aranja/rakning-c19-app https://github.com/aranja/rakning-c19-app
- outadoc 6y ago
  French app, protocol and backend here: https://gitlab.inria.fr/stopcovid19/ https://gitlab.inria.fr/stopcovid19/
mikece 6y ago
I wonder how quickly contact tracing applications will be leveraged for other uses. If a significant number of protesters are using such an application then I imagine government will throw the “for your protection“ excuse to go harvest information from the phones of protesters to see who was meeting with him and who their social circles are. Of course, to keep us and our children safe.
- monkeynotes 6y ago
  I have brought up the same worry in similar threads. I think it's a given that once this sort of thing is accepted it will be implemented more broadly for our safety.
- DiogenesKynikos 6y ago
  That's a legitimate concern, but I think the German app is designed so that the government does not get the contact data. Here's how I understand the system: Your phone saves the ID numbers of the phones it's come into close contact with. The IDs are randomly generated, so they don't contain any information about the person carrying the phone. When someone tests positive for the virus, they can transmit their ID to a central server, which then broadcasts that ID to everyone with the app. The app checks that ID against its local list of contacts.
- empath75 6y ago
  Given the situation in the us currently, installing one of these apps would at least give me pause.
- zabana 6y ago
  It's already happened in the wake of the events related to the unfortunate death of George Floyd. Police in minneapolis have admitted the use of contact tracing technology to locate protesters.
  - huxley 6y ago
    My understanding is that that was the police grabbing cell phone tower records from the cell service providers -- which they've always been able to do, it is a different (though still problematic) issue. The writers of the article conflated it with contact tracing.
s_dev 6y ago
I'm at a loss as to why Ireland isn't open sourcing our contact tracing app or just using another open source App considering every other EU nation is. I suspect combination of soft corruption and perverse incentives.
- padmick 6y ago
  did they announce they wont open source it? don't think ill be giving it a download then :/ shame
  - s_dev 6y ago
    https://www.reddit.com/r/DevelEire/comments/g77kcc/irish_government_keeping_the_source_code_of_their/ https://www.reddit.com/r/DevelEire/comments/g77kcc/irish_gov...
pjc50 6y ago
Meanwhile in the UK, it's closed source corruptionware: https://www.mirror.co.uk/news/politics/tory-husband-test-trace-chief-22128892 https://www.mirror.co.uk/news/politics/tory-husband-test-tra...
- chimprich 6y ago
  That story does not say anything about that. The UK app's source code has been released. Previous discussion: https://news.ycombinator.com/item?id=23107553 https://news.ycombinator.com/item?id=23107553
lou1306 6y ago
FWIW The Italian contact tracing app, Immuni, is open source as well: https://github.com/immuni-app https://github.com/immuni-app I installed it today and I live in one of the 4 pilot regions, let's see how it goes.
danielfoster 6y ago
Great to see this open-sourced. I think the biggest issue here is why the app is still under development and won't be released. until mid-June. The government has already had more than 3 months to get this ready.
krzyk 6y ago
Polish one is also opensource - https://github.com/ProteGO-Safe https://github.com/ProteGO-Safe
Lutger 6y ago
Most European countries develop their contract tracing apps as open source software. The fragmented landscape is unfortunate. It's not just the code being developed that could benefit from a cooperative approach, the ethical, legal, medical and governance issues around these apps could benefit a lot from a shared European approach. We have done this with the GDPR, we should collaborate on this as well.
- bennofs 6y ago
  At this scale, collaboration would probably slow things down more than it helps. Finding a consensus among so many parties is hard. Building separate solutions first and then unifying them later might be better.
  - Lutger 6y ago
    Maybe. I just don't understand why European developers didn't start by forking the austrian app, which has an apache license. The Stopp Corona app is developed by the Austrian red cross and has already been successfully deployed and used. There's a lot of experience around it. Why not begin with a fork and add your own requirements? Then slowly try to merge those upstream? Now the landscape is fragmented from the start. It's NIH all over the place.
ubanholzer 6y ago
Covid contact tracing app Switzerland: Android repository: https://github.com/DP-3T/dp3t-app-android-ch https://github.com/DP-3T/dp3t-app-android-ch iOS repository: https://github.com/DP-3T/dp3t-app-ios-ch https://github.com/DP-3T/dp3t-app-ios-ch Covidcode Frontend: https://github.com/admin-ch/CovidCode-UI https://github.com/admin-ch/CovidCode-UI App backend: https://github.com/DP-3T/dp3t-sdk-backend https://github.com/DP-3T/dp3t-sdk-backend App config backend: https://github.com/DP-3T/dp3t-config-backend-ch https://github.com/DP-3T/dp3t-config-backend-ch Covidcode backend: https://github.com/admin-ch/CovidCode-Service https://github.com/admin-ch/CovidCode-Service
rurban 6y ago
As I expected it's backdoored. It uses the new central Google Tracking ID feature. https://github.com/corona-warn-app/cwa-app-android/wiki/4-Google-Exposure-Notifications-API https://github.com/corona-warn-app/cwa-app-android/wiki/4-Go... Other apps can do without central tracking Id's. It was fishy that Germany waited weeks for this Google API (officially to support low voltage Bluetooth), whilst other countries had their open source apps ready for long. Germany and France pushed for centralized tracking, it was called off after protests, now its again in via their US friends.
zxienin 6y ago
Having spent some time looking at contact tracing app architectures across the world, I realize how conceptually same they are. Mostly variations are in central or decentral handling of data. BLE based. Similar usage protocol. Instead of 50 odd countries, each making tracing app with ~90% similarity, doesn’t it make sense that there is one grand GitHub repo? Each country instantiates their own variant of it, by injecting own config, while contributing to the this repo. Am surprised at the mushrooming effect here.

199 points by fredrb 6y ago

The New Zealand contact tracing app just allows you to log visits to businesses that display QR codes listing their address. So you can have a log of where you've been. Only most businesses here don't have the codes on display as applying for them has too much red tape.

mschuster91 6y ago
Also NZ is essentially corona-free, there isn't much pressure for app based tracing as long as those in contact with people coming in from anywhere else (i.e. air and sea port workers, customs officials and the likes) get rigorously tested.
- monadic2 6y ago
  Still far better, and quite simple at that!, than we have in the US.
  - mschuster91 6y ago
    The US is way too deep in the corona mess to do anything like that. What would help is widespread, easy access to tests (including a moratorium on ICE enforcement and no "paper records" requirement so that also illegalized persons get tested instead of being an unknown harbor!) and especially daily tests for at-risk personnel (medical, public transport, supermarket staff and inmates of prisons, jails and health/elderly care institutions).
    - monadic2 6y ago
      Honestly I’d still take it, why not both?
- fredrb 6y ago
  Wouldn't a tracing app make more sense than having a rigorous border tests? It takes one miss-tested infected person to start a second wave in the country. So I would assume that the investment to make sure businesses provide the QR pays off testing everyone and risking another lockdown. I'm also not sure countries have the resources to enforce huge amounts of tests at the border.
  - jussij 6y ago
    At present NZ have very strict border restriction in place so they have already illuminated that border issue.
  - johannes1234321 6y ago
    > I'm also not sure countries have the resources to enforce huge amounts of tests at the border. Right. One issue with testing is that the only test you can do for masses in a border are basic health checks like temperature, but aside from all general issues with such kind of test (people are exhausted after travelling on a plane, having to do a test, ...) with COVID symptoms often only appear after one had been infectious for a while already, so one can pass by undetected and still spread. Things like PCR tests take time and effort and have notable cost, which makes it hard to apply on a larger entrance port. Either shut down completely (maybe based on origin region or recently visited regions) or be prepared to handle afterwards ... tracing contacts to identify potential carriers after ridentifying infected is a way which is at least a bit promising.
    - DiogenesKynikos 6y ago
      > Either shut down completely (maybe based on origin region or recently visited regions) or be prepared to handle afterwards If you only shut down based on recently visited regions, you're likely to import cases anyways. With CoVID-19, it takes several weeks to identify an outbreak in a region (especially without extensive testing). By the time you shut down travel from a given region, you've probably already been importing cases for weeks. The WHO has gotten a huge amount of flak for not calling for travel restrictions during this pandemic. But their recommendations were based on the ineffectiveness of travel restrictions,* according to previous research. They recommended screening passengers for symptoms, but also told countries to take measures to limit spread (like testing and contact tracing), on the assumption that countries would import cases. * The WHO's recommendations were also based on the International Health Regulations, an international treaty that basically every country on Earth has joined. Most of the public is unaware of the IHR or what it says about travel restrictions, or of the history of the WHO (one of its founding goals was to stop countries from automatically shutting their borders whenever there was an outbreak, and instead to take rational, evidence-based measures).

metachris 6y ago

Some context: > The German government has asked SAP and Deutsche Telekom to develop the Corona-Warn-App for Germany as open source software. Deutsche Telekom is providing the network and mobile technology and will operate and run the backend for the app in a safe, scalable and stable manner. SAP is responsible for the app development, its framework and the underlying platform. Therefore, development teams of SAP and Deutsche Telekom are contributing to this project. At the same time our commitment to open source means that we are enabling -in fact encouraging- all interested parties to contribute and become part of its developer community. https://github.com/corona-warn-app/cwa-app-android#contributors https://github.com/corona-warn-app/cwa-app-android#contribut...

tpmx 6y ago
Wow, those are not two companies that come to mind when "moving fast" is a priority. (I've only worked in a supplier role to Deutsche Telekom, but I can't imagine SAP is any less ... specific about rules and processes.) I guess they probably have some "experimental" departments for recruitment purposes, they must have used those.
- cheschire 6y ago
  They probably are funding external "startup" style companies which are outside of the corporate HR and union boundaries.
- zxienin 6y ago
  When serious data privacy and protection concerns are in play, German govt. banking on these is no surprise.
konschubert 6y ago
Ah, the two most expensive, most corporate, software development consultancies Germany has to offer.
- bla3 6y ago
  Don't disagree, but the GitHub project seems to be run well from a quick glance. Maybe the team is small enough.

barbegal 6y ago

I really question whether these apps will be effective. The limitation section https://github.com/corona-warn-app/cwa-documentation/blob/master/solution_architecture.md#limitations https://github.com/corona-warn-app/cwa-documentation/blob/ma... of their architecture document shows that people in close proximity for a few minutes may not even get picked up. Anyone who has dealt with trying to work out distance from Bluetooth signal strength will know that it is virtually impossible once you factor in, the orientation of two devices (signal polarization), their locations (in a pocket, bag, case...) and the local environment (reflections and attenuation from walls, floors ceilings, furniture). Additionally, without knowing exactly how transmission is occurring the risk score calculation https://github.com/corona-warn-app/cwa-documentation/blob/master/solution_architecture.md#risk-score-calculation https://github.com/corona-warn-app/cwa-documentation/blob/ma... may be wildly inaccurate too resulting in the wrong people being notified. And even assuming perfect ability to deduce the risk of infection of two people using the app, will that help in the bigger context. If the people most at risk don't install this app and the least at risk do then you may be drawing resources away from the people that most need help.

uvw 6y ago
I imagine it's not meant to be 100% accurate. If it identifies even 50% of the people that may have come in contact with someone who's positive, even considering 50% false positives, I would consider it a rousing success.
- Schlaefer 6y ago
  Even if there are 95% false positive: if you're able to test all those people and catch the 5% that might still be a net profit. It comes down to cost. Societies are spending thousands of billions to mitigate the problem, even a slight reduction of that number is a win.
  - w-m 6y ago
    As far as I understand, you would need to send everybody who might have been in contact with someone who's positive into quarantine, right away. You can also test them, but you need to quarantine them immediately, as the virus is transmitted before symptoms show. If you just send everybody who was in contact with a positively tested person into testing (they give samples, send them in, get tested, get the results back), but they keep going about their normal lives, they will statistically infect more people before the tests come back. So the false positive rate is quite important, as it potentially means sending thousands of people into home-quarantine.

traspler 6y ago

So are all the parts of what will become the Swiss COVID tracing app: https://github.com/DP-3T https://github.com/DP-3T

nikeee 6y ago
The Austrian app can be found here: https://github.com/austrianredcross/ https://github.com/austrianredcross/
dagurp 6y ago
The Icelandic app is here https://github.com/aranja/rakning-c19-app https://github.com/aranja/rakning-c19-app
outadoc 6y ago
French app, protocol and backend here: https://gitlab.inria.fr/stopcovid19/ https://gitlab.inria.fr/stopcovid19/

mikece 6y ago

I wonder how quickly contact tracing applications will be leveraged for other uses. If a significant number of protesters are using such an application then I imagine government will throw the “for your protection“ excuse to go harvest information from the phones of protesters to see who was meeting with him and who their social circles are. Of course, to keep us and our children safe.

monkeynotes 6y ago
I have brought up the same worry in similar threads. I think it's a given that once this sort of thing is accepted it will be implemented more broadly for our safety.
DiogenesKynikos 6y ago
That's a legitimate concern, but I think the German app is designed so that the government does not get the contact data. Here's how I understand the system: Your phone saves the ID numbers of the phones it's come into close contact with. The IDs are randomly generated, so they don't contain any information about the person carrying the phone. When someone tests positive for the virus, they can transmit their ID to a central server, which then broadcasts that ID to everyone with the app. The app checks that ID against its local list of contacts.
empath75 6y ago
Given the situation in the us currently, installing one of these apps would at least give me pause.
zabana 6y ago
It's already happened in the wake of the events related to the unfortunate death of George Floyd. Police in minneapolis have admitted the use of contact tracing technology to locate protesters.
- huxley 6y ago
  My understanding is that that was the police grabbing cell phone tower records from the cell service providers -- which they've always been able to do, it is a different (though still problematic) issue. The writers of the article conflated it with contact tracing.

s_dev 6y ago

I'm at a loss as to why Ireland isn't open sourcing our contact tracing app or just using another open source App considering every other EU nation is. I suspect combination of soft corruption and perverse incentives.

padmick 6y ago
did they announce they wont open source it? don't think ill be giving it a download then :/ shame
- s_dev 6y ago
  https://www.reddit.com/r/DevelEire/comments/g77kcc/irish_government_keeping_the_source_code_of_their/ https://www.reddit.com/r/DevelEire/comments/g77kcc/irish_gov...

pjc50 6y ago

Meanwhile in the UK, it's closed source corruptionware: https://www.mirror.co.uk/news/politics/tory-husband-test-trace-chief-22128892 https://www.mirror.co.uk/news/politics/tory-husband-test-tra...

chimprich 6y ago
That story does not say anything about that. The UK app's source code has been released. Previous discussion: https://news.ycombinator.com/item?id=23107553 https://news.ycombinator.com/item?id=23107553

lou1306 6y ago

FWIW The Italian contact tracing app, Immuni, is open source as well: https://github.com/immuni-app https://github.com/immuni-app I installed it today and I live in one of the 4 pilot regions, let's see how it goes.

danielfoster 6y ago

Great to see this open-sourced. I think the biggest issue here is why the app is still under development and won't be released. until mid-June. The government has already had more than 3 months to get this ready.

krzyk 6y ago

Polish one is also opensource - https://github.com/ProteGO-Safe https://github.com/ProteGO-Safe

Lutger 6y ago

Most European countries develop their contract tracing apps as open source software. The fragmented landscape is unfortunate. It's not just the code being developed that could benefit from a cooperative approach, the ethical, legal, medical and governance issues around these apps could benefit a lot from a shared European approach. We have done this with the GDPR, we should collaborate on this as well.

bennofs 6y ago
At this scale, collaboration would probably slow things down more than it helps. Finding a consensus among so many parties is hard. Building separate solutions first and then unifying them later might be better.
- Lutger 6y ago
  Maybe. I just don't understand why European developers didn't start by forking the austrian app, which has an apache license. The Stopp Corona app is developed by the Austrian red cross and has already been successfully deployed and used. There's a lot of experience around it. Why not begin with a fork and add your own requirements? Then slowly try to merge those upstream? Now the landscape is fragmented from the start. It's NIH all over the place.

ubanholzer 6y ago

Covid contact tracing app Switzerland: Android repository: https://github.com/DP-3T/dp3t-app-android-ch https://github.com/DP-3T/dp3t-app-android-ch iOS repository: https://github.com/DP-3T/dp3t-app-ios-ch https://github.com/DP-3T/dp3t-app-ios-ch Covidcode Frontend: https://github.com/admin-ch/CovidCode-UI https://github.com/admin-ch/CovidCode-UI App backend: https://github.com/DP-3T/dp3t-sdk-backend https://github.com/DP-3T/dp3t-sdk-backend App config backend: https://github.com/DP-3T/dp3t-config-backend-ch https://github.com/DP-3T/dp3t-config-backend-ch Covidcode backend: https://github.com/admin-ch/CovidCode-Service https://github.com/admin-ch/CovidCode-Service

rurban 6y ago

As I expected it's backdoored. It uses the new central Google Tracking ID feature. https://github.com/corona-warn-app/cwa-app-android/wiki/4-Google-Exposure-Notifications-API https://github.com/corona-warn-app/cwa-app-android/wiki/4-Go... Other apps can do without central tracking Id's. It was fishy that Germany waited weeks for this Google API (officially to support low voltage Bluetooth), whilst other countries had their open source apps ready for long. Germany and France pushed for centralized tracking, it was called off after protests, now its again in via their US friends.

zxienin 6y ago

Having spent some time looking at contact tracing app architectures across the world, I realize how conceptually same they are. Mostly variations are in central or decentral handling of data. BLE based. Similar usage protocol. Instead of 50 odd countries, each making tracing app with ~90% similarity, doesn’t it make sense that there is one grand GitHub repo? Each country instantiates their own variant of it, by injecting own config, while contributing to the this repo. Am surprised at the mushrooming effect here.