[Discussion] Low risk infection encounter ambiguity

[nareshcch]

Hello,

I have an issue since yesterday. My CWA updated its exposure list early in the morning at 3 AM and showed that I had 3 encounters with Low risk. Later the same day at 11 AM it updated the list and it shows now that I have only 1 encounter with low risk. I only travel to my work daily by public transportation. Therefore, I'm very confused about this information. Would you please clarify?

Thank you!

BR, Naresh

Avoid duplicates

• Bug is not mentioned in the FAQ
• Bug is not already reported in another issue

Describe the bug

Expected behaviour

Steps to reproduce the issue

Technical details

• iOS Version:
• Device:

Possible Fix

Additional context

[Ein-Tim]

Hey @nareshcch
Could you please share your EN-Log here so we can take a look at it? This log does not contain any critical/personal data (but the number of encounters you had).

How to export Exposure Notificaiton Logs (EN-Logs) under iOS 13.7 or newer

German:

Einstellungen ➡️ Begegnungsmitteilungen ➡️ Status von Begegnungsaufzeichnungen ➡️ Begegnungsüberprüfungen ➡️ Überprüfungen exportieren

English:

Settings ➡️ Exposure Notifications ➡️ Exosure Logging Status ➡️ Exposure Checks ➡️ Export Exposure Checks

To upload the file here, just rename the file from .json to .txt.

---

Could you please also share

1. Your iOS-Version (in the iOS-Settings go to General and klick About)
2. The CWA-Version (inside CWA go to App Information, there at the very bottom the Version stands)
3. A screenshot of CWA

Thanks 👍

[dsarkar]

Dear @nareshcch,

Thanks for contributing. As suggested by @Ein-Tim it would be helpful if you provide the additional information.
Best wishes,
DS

---

Corona-Warn-App Open Source Team

[nareshcch]

Thank you very much for your reply. Please check the attachments. Let me know if there are any missing.

[Ein-Tim]

I think this was closed by Issue. @dsarkar could you reopen it, thanks.
And no, @nareshcch all the information I need is here, I will take a look at it now.

[nareshcch]

ExposureChecks-2020-11-24.txt

[nareshcch]

Sorry that i have forgot to mask my phone information in my earlier comment. Therefore, i have reposted the attachments again.

THank you!

[Ein-Tim]

Okay thanks 👍

The Hash: 772D137442BE7E677779FC669E8E0D37277A30639A301E2649351296EDBA6BBB was first downloaded tomorrow morning.
There this Hash contained 2 matches.

Also the Hash A1E8BC08556B4BFBE5CD1A1F3FF2572F00FBB974FC000594C2C748AA5BCA7E2A, which was, also, first downloaded tomorrow morning, contained 1 match.

So 2+1 is summing up to 3 Encounters (=matches), which is correct.

---

Then the next check was done today at 11:11:40 and suddenly the Hash
772D137442BE7E677779FC669E8E0D37277A30639A301E2649351296EDBA6BBB only contained 1 match, the Hash A1E8BC08556B4BFBE5CD1A1F3FF2572F00FBB974FC000594C2C748AA5BCA7E2A did not contain any match at all this time.

So here 1 Encounter is correct.

---

This, maybe makes it a bit clearer for you:

---

Now the question is:
Why is the number of matches from the check at 11:41am not the same as the number from the check at 03:05am?

Since Encounters are disappearing after 14 days, one possible answer to this question is that you met 2, later positive tested, people 14 days ago between 03:05 am and 11:41. This seems a bit unrealisic to me, or could this be possible @nareshcch?

[nareshcch]

Hello Tim,

I'm completely clueless. I haven't met any new people as far as i remember. Since I travel by public transportation for work, the only possibility I assume is that I had come across 2 people 14 days ago between 7 am and 11:11 am, who were tested positive the same day. Am i correct?

[Ein-Tim]

@nareshcch
No, it does not matter when these people where tested. If you want to know how the App exactly works, take a look at: https://www.coronawarn.app/en/ and scroll down until "How does the app work?"

So or so this is very unrealisitc so I think something went wrong here. Could you do me a favor:

1. Open CWA, make sure it shows the green card.
2. Close CWA completely (swipe it up).
3. Turn off Wi-Fi for 15 min.
4. Open the App without Internet. (You will see this screen).
5. Close the App (swipe it up).
6. Open the App again with Internet, a check will be done instantly.

Is CWA still showing 1 encounter.

[dsarkar]

Dear @nareshcch, @Ein-Tim,

Thanks for reporting here. This issue might help to understand what is probably going on: corona-warn-app/cwa-app-android#1302.

Best wishes,
DS

---

Corona-Warn-App Open Source Team

[Ein-Tim]

@dsarkar Yeah I know how this works, but what confuses me is that the check on the morning showed 3 Exposures while a check 8 hours later only showed 1 Exposure...

@daimpi (since you were also involved in corona-warn-app/cwa-app-android#1302) could you take a quick look at this (just to ensure I didn't get anything wrong here 😅 Thaks for all your work!)

[nareshcch]

Hello Tim,

I just did as you asked. In all the steps, the app shows 1 low risk encounter.

[nareshcch]

@dsarkar Thanks for the information!

[Ein-Tim]

Mhh, okay @nareshcch. Such Issues are always hard to determine because of the high data privacy of the App.
Encounters will be "deleted" after 14 days, yes. But that these 14 days from you expierienced in this 8h window tomorrow, seems a bit unlikely to me...

[daimpi]

@Ein-Tim I concur with our EN log analysis above and I also find it very strange that an encounter would disappear between two different checks on the same (UTC) day. My understanding so far was that RPIs get deleted in one day chunks i.e. if you had an encounter on (UTC) day x no matter the exact timestamp, all those RPIs should be deleted on day x+15 and therefore number of encounters shouldn't change during the day. This seems to be confirmed by @mh-'s observation on a rooted Android device here.

But none of this is 100% certain:

1. Google/Apple change their ENF behavior with updates
2. iOS might handle the RPI deletion differently from Android?
3. Actual production source code for ENF is provided by neither Google nor Apple

And there are probably more reasons for why this could have happened which I didn't think of. But it is indeed strange: if we were e.g. (just for illustration purposes) to assume that RPI deletion on iOS would happen exactly after 14*24 h that would mean that more precise timestamps than those provided by the API (which are coarsened to a one day window) would be indirectly leaked after 14 days, which doesn't sound like intended behavior.

Unfortunately this is something the CWA devs would have to test b/c we can't root iPhones.

Btw: there have been reports on Android of changing number of encounters during the same day as well (cf. here and here) and the reason for those are still not known afaik.

[Ein-Tim]

Thank you very very much @daimpi for your detailed comment!
Thank you so much for all your great work here! ❤️💪
Always amazing to see how you know (nearly) everything 😅
@dsarkar I think this is definitely something what should be further investigated by the Developers. The first question would be:
When are RPIs deleted under iOS? (After exactly 14x24h or at midnight)

[daimpi]

@Ein-Tim glad I could help 🙂.

And thank you for your contributions as well ❤️.

[nareshcch]

@Ein-Tim @daimpi Tahnk you very much for the detailed information. Looking forward to your final analysis on the problem. 😊

[ndegendogo]

Just an idea. Does anybody knows if the risk configuration parameters from the server have changed between these two checks?
(On 24 Nov between 03:05 and 11:11?)

[Ein-Tim]

@ndegendogo good Idea, if there were any changes the must have been done at the App config file I think, so I've taken a look at: https://github.com/corona-warn-app/cwa-server/commits/master/services/distribution/src/main/resources/master-config. There were indeed 2 Pull Request which were merged at the 23.11.
But none of them touched the parameters (if I understand everything correct here)...
@dsarkar Are the developers on this?

[ndegendogo]

Since I travel by public transportation for work, the only possibility I assume is that I had come across 2 people 14 days ago between 7 am and 11:11 am

@nareshcch I think this is indeed the explanation.
Of course I don't know your working schedule, but in the morning before 11:11 sounds plausible to me.
I have several times picked up more than one on the same day in public transport, this can happen.

My understanding so far was that RPIs get deleted in one day chunks

@daimpi as you already mentioned, this has been confirmed by observation for Android only. It is nowhere written in any spec.

iOS might handle the RPI deletion differently from Android

Well, it is hard to tell for sure, but: yes, this is my assumption.

[nareshcch]

@ndegendogo Thanks for the info.

[dsarkar]

Hi all, We will forward the question when RPIs are deleted under iOS? (After exactly 14x24h or at midnight). Best wishes,
DS

---

Corona-Warn-App Open Source Team

[dsarkar]

Hi all, feedback from the developers:

• Both under iOS and Android RPIs are not deleted at midnight but by trend after 14 x 24 h.

Best wishes,
DS

---

Corona-Warn-App Open Source Team

[daimpi]

Hey @dsarkar,

Hi all, feedback from the developers:

• Both under iOS and Android RPIs are not deleted at midnight but by trend after 14 x 24 h.

Thanks for the info that's good to know. I'm somewhat surprised that Google/Apple chose such an implementation, as this leaks somewhat precise timestamps (after 14 days) which seems to run counter their intention as ENF doesn't even provide this kind of granular info to certified ENF apps via their API, but I also don't see any real privacy issue arising from that tbh.

[Ein-Tim]

@dsarkar

Thanks!

@daimpi (Just FYI:)

This would contradict @mh-'s finding here...

So or so with this answer the question from @nareshcch is answered, or?

[Ein-Tim]

I think this can be closed @dsarkar.

[dsarkar]

@nareshcch, @Ein-Tim, @daimpi, and community. Thanks for fruitful discussions and contributions. As suggested, closing this one! Best, DS

---

Corona-Warn-App Open Source Team