search

PersonalDataIO / CoronaRiskScoring

4 stars 2 forks source link

How is ExposureConfiguration set in Immuni? #5

Open pdehaye opened 4 years ago

pdehaye commented 4 years ago

The CoronaRiskScoring project is trying to assess how different contact tracing apps are being parametrized. We are first focusing on apps using the Apple API as it will enable quickest comparison.

Project considered We are looking at Immuni.

What we need We need pointers to the places in the code where the following parameters are set:

Nice to have We would also like to understand what is done with ENExposureDetectionSummary and ENExposureInfo, after the risks are calculated.

Excellent to have This is only the beginning for us. We want the above so we can track how the parameters are being changed. It is likely actually that this is passed dynamically to the apps. If so, we need to know the process behind these changes, so we can ask the right people for this information.

If you have pointers in the right direction, they would be greatly appreciated.

pdehaye commented 4 years ago

It looks like some defaults are set here, possibly for the duration of the trial period. This here might be code to do the updates.

This or this might be the place where those parameters are updated.

The parameters can be queried through requests like this:

https://get.immuni.gov.it/v1/settings?platform=ios&build=666

pdehaye commented 4 years ago

Indeed:

pdehaye commented 4 years ago

You can find some background on how to configure e.g. the Apple API here.

pdehaye commented 4 years ago

The configuration of the Immuni app has changed!

This project doesn't have a scraping system in place yet, but at https://get.immuni.gov.it/v1/settings?platform=ios&build=1 it said yesterday (pretty printed, same for Android):


"exposure_configuration": {
    "attenuation_thresholds": [50, 70],
    "attenuation_bucket_scores": [0, 0, 3, 5, 7, 7, 7, 7],
    "attenuation_weight": 1,
    "days_since_last_exposure_bucket_scores": [1, 1, 1, 1, 1, 1, 1, 1],
    "days_since_last_exposure_weight": 1,
    "duration_bucket_scores": [0, 0, 0, 3, 5, 5, 5, 7],
    "duration_weight": 1,
    "transmission_risk_bucket_scores": [1, 1, 1, 1, 1, 1, 1, 1],
    "transmission_risk_weight": 1,
    "minimum_risk_score": 1
  },

while it says right now

 "exposure_configuration": {
    "attenuation_thresholds": [50, 70],
    "attenuation_bucket_scores": [0, 5, 5, 5, 5, 5, 5, 5],
    "attenuation_weight": 1,
    "days_since_last_exposure_bucket_scores": [1, 1, 1, 1, 1, 1, 1, 1],
    "days_since_last_exposure_weight": 1,
    "duration_bucket_scores": [0, 0, 0, 0, 5, 5, 5, 5],
    "duration_weight": 1,
    "transmission_risk_bucket_scores": [1, 1, 1, 1, 1, 1, 1, 1],
    "transmission_risk_weight": 1,
    "minimum_risk_score": 1
  },

In both cases, the exposure_info_minimum_risk_score remains at 20.

We see (comparing to the API) that before there was some balancing of Bluetooth-proxied distance and duration (because 3*7 > 20, 5*5 > 20, 7*3 > 20).

Now that balancing is mostly gone and amounts to "has a signal been seen for more than 15 minutes at attenuations less than 73dB". Since that attenuation level is huge (and 5*5>20), it looks like there is no longer any effort to measure distance from Bluetooth, everyone just gets notified if they spend more than 15 minutes in the same room as an infected person.

There are also privacy/security implications, given paparazzi and replay attacks.

vincenzoiovino commented 3 years ago

Dear all, may you confirm that currently Immuni in Android flags as risk signals at attenuation below 63dB (not 73) for >=15 minutes? Thanks in advance. Kind regards