Thursday, July 30, 2020

Exposure Notification Update

Howard Oakley (Hacker News):

According to figures obtained by the BBC, of the 83 million people in Germany, only around 16 million have downloaded this app since it launched in June. That’s less than 20% of the whole population, and probably around a quarter of all smartphone users. Its adoption has been far below the percentages envisaged by those modelling the benefits of such apps, which normally start to become significant once adoption exceeds 50% and rises towards 80%.

Because the German app has respected data privacy, Public Health authorities have gained almost no information about Covid-19 outbreaks from the app. They know that about 500 users of the app have tested positive – that’s an insignificant proportion – and no one can find out how many contacts have been successfully traced as a result. There is also no record of how many exposures resulted in false alarms, nor of missed diagnoses. There are similar problems with Switzerland’s app, and a lack of data for Ireland’s too.

Adoption of smartphone contact tracing apps has also been very poor in Japan (6% of the population), Italy (7%), and France (3%). To date, no national smartphone contact tracing app has been demonstrated to have had any significant benefit in controlling outbreaks, or significantly reducing the incidence of Covid-19. Only draconian access to personal data, as used in South Korea, seems to have brought any positive results.

Joe Wituschek:

Despite its quick turnaround in creating the technology, barely any states in the United States are planning on adopting Apple and Google’s Exposure Notification technology.


Oklahoma, Alabama, South Carolina and Virginia are the only states signed on to build their apps with the technology.


Almost a quarter of states currently have no plans to build a digital solution to help assist in the effort.

See also: Nick Heer.


Update (2021-03-14): John Gruber:

The whole endeavor seems pointless, looking at these numbers. If anything, it might be giving the users of these apps a false sense of security. If you use one of these apps and are exposed to someone who later tests positive, the odds that that person both uses the app and will report their positive test result seem not just low but downright infinitesimal.

Update (2021-03-22): Howard Oakley:

Feasibility modelling used to decide whether to proceed to develop the app in the first place had been based on the assumption that about 60% of the population would use it; in reality that percentage hasn’t even reached half that (28%). Detailed analysis has also revealed that app uptake has been lowest in areas with densest population, such as London, where cases have also been most frequent during the second wave.

Research on the effectiveness of that and other Exposure Notification apps has been scant and of shockingly poor quality. A recent brief review has clutched at the straws offered in just six studies, most of which have had to rely on modelling to predict what might be expected, rather than measuring what has been achieved. To realise any significant public health benefits from smartphone apps, they desperataly need many more users, and deeper links to healthcare and sensitive personal information. The Apple-Google dream of Exposure Notification in a privacy vacuum simply doesn’t do enough to have an impact on the pandemic.

6 Comments RSS · Twitter

The problem primarily seems to be lack of installations. In Switzerland, previous to the app being released, around 50% said that they would install the app. Now, only around 10% have installed it.

Even so, it's impossible to know if the app has had any positive effects. In Switzerland, there have been a few hundred people who tested positively, did use the app, and did register their case in the app - that part we know. But due to the privacy controls, we don't know how many people got a contact alert, how many of them tested themselves, and how many tested positively.

Tests previous to the release of the app did show that contacts registered by the app track pretty closely with dangerous exposure. So in theory, there's a good chance that the app would be beneficial, if people actually used it.

Sadly, the main reason people don't want to install the app is fear of privacy breaches. Engineers invested so much effort into making the app safe to use, yet people don't seem to care at all. So it might also be a communication problem. The loudest voices are the ones that constantly yell about how this app was a terrible idea and anyways useless. Kind of a self-fulfilling prophecy.

Some people also just might not know that the app exists. The only non-avoidable thing I saw was a text message from my provider, telling me that the app is available, and that usage is voluntary.

One thing to consider is that Europe generally has low infection rates and mortality right now, so a lot of people don't see any use in additional measures. Maybe install rates will go up if infection rates start to go up again.

Thing is, exposure notification is not contact tracing.

Exposure notification is a kind of reverse weather forecast that tells you to buy a coat because you may or may not have been rained on in the past 3 weeks.

It's classic silicon valley. Rather than focus on making an existing, well understood problem, more efficient. It ignores domain expertise and focuses on an over-simplistic model of contact between strangers, which would ultimately be caught by regular contact tracing. It then delivers a solution which is unreliable and doesn't provide clear, actionable, information.

BT signal strength is fundamentally the wrong technology to use. It's easily blocked by water. Two people face to face with phones in their back pocket will seem to be further apart because the human body's 70% water. If it's dreich or raining BT signal strength is further reduced by the moisture in the air. It's also impossible for BT to differentiate between proximity & presence, neighbours in blocks of flats / apartments will appear to be in contact even when they're separated by walls.

It would have made much more sense for contact tracing apps to plug into the existing systems (this isn't our first pandemic rodeo folks). The app would enable someone registering with the system to lean on the phone's contacts & location log and be walked through identifying who they've seen and where they've been. The user would be in control all the way. No surprises. You could even pop QR codes into the test kits and use the app to provide testing notifications.

It's not surprising that places like Kerela and Vietnam have done a better job of controlling SARS-COV-2 than Europe & the US. They're not hampered by the neoliberal knee-jerk reaction to outsource personal responsibility to an app.

>It ignores domain expertise

These APIs and apps were created with the input from domain experts.

>focuses on an over-simplistic model of contact between strangers

The model has been experimentally validated, contacts tracked by the apps are consistent with what experts consider to be contacts that can cause transmissions.

>which would ultimately be caught by regular contact tracing

How does regular contact tracing make a connection between you and the random person you sat next to in a train? Or between you and the person you sat next to in a club who entered bogus information in the contact tracing form at the club?

>doesn't provide clear, actionable, information

When the app alerts you of a potential contact, it provides clear, actionable information.

>BT signal strength is fundamentally the wrong technology to use

Again, this has been experimentally validated.

>lean on the phone's contacts & location log and be walked through
>identifying who they've seen and where they've been.

This is exactly the kind of system that we want to avoid creating, since it has severe privacy and security implications. The actual problem we're encountering is not that the app doesn't work, but that not enough people install it. Making it a privacy nightmare is not going to help with that.

It doesn't help that, at least for the German app, the API is rendered unusable in the iOS 14 betas thus far. The error, which for me is "not available in your region", seems to suggest they haven't managed/prioritized to merge this from 13.x to 14? Maybe due to changes in privacy?

That's kind of a problem though when you offer public betas. Like, yes, it's a beta, stuff will break, but… uh… this feature is kind of important, and time is of the essence.

The German app also arrived at a time of very low infection numbers and significantly decreased concern in the population. I suspect it would have been downloaded much more frequently had it arrived at the time of empty store shelves. And maybe a second wave will convince more people.

Here are some interesting statistics we do have, though:

An interesting note: About half of downloads were by iOS users, despite Apple only having something like 20% market share.

For me the COVID app has been less useful because by habit I frequently forget to turn on Bluetooth. We’ve been told for years that Bluetooth is a security risk, so I keep it off unless I’m actively using it to listen to music or Continuity on my Mac. Oops.

Leave a Comment