Google Exposure Notifications System should optionally preserve exposure data on app uninstall

MikeMcC399 commented 4 years ago

Current Implementation

This is an enhancement request to the Google Exposure Notifications System (ENS).

Online documentation is found on https://developers.google.com/android/exposure-notifications/exposure-notifications-api#methods

Method stop() Disables the broadcast and scan process. You can call this directly. It's also called when a user uninstalls the app. When it’s called as part of the uninstallation process, the database and keys are deleted from the device.

With ENS Version v1.8 (214815000) after uninstalling CWA, re-installing and completing the onboarding process, (Android) Settings > Google > COVID-19 Exposure Notifications > three-dot icon > Exposure checks shows one entry corresponding to the time when CWA was re-installed which is in line with all previous exposure check data being deleted by the previous uninstall.

Suggested Enhancement

The Google Exposure Notifications System should give the user the choice to keep the database and keys when uninstalling a COVID-19 app, such as CWA.

(Note https://github.com/google/exposure-notifications-internals/issues/3 where Google recommends routing requests for ENS through the regional Public Health Authority/App developer.)

Expected Benefits

The ENS data is collected over a maximum of 14 days and represents irreplaceable health-data value for the user and the community.

It may sometimes be necessary to uninstall and reinstall CWA for troubleshooting purposes. This should not put the user in the situation of having to decide between finding and fixing an issue, but then losing all related exposure data.
Supports wishlist item https://github.com/corona-warn-app/cwa-wishlist/issues/153 "Test a new version as beta in the community" since this may involve uninstalling then reinstalling another version.
Related to https://github.com/corona-warn-app/cwa-wishlist/issues/8 "Backup exposure history to transfer to new/reseted phone". If this item is implemented then it would also provide a way to save the data.

Edit: Updated to correspond to current Google ENS UI v1.8.

Internal Tracking ID: EXPOSUREAPP-2838

ghost commented 4 years ago

Hello @MikeMcC399 ,

I have transferred the issue to Jira. thanks for sharing your Idea!

Thank you, LMM

Corona-Warn-App Open Source Team

MikeMcC399 commented 3 years ago

Has this ever been discussed with Google?

Why is it possible for Apple iOS to keep the exposure data when CWA is uninstalled, whereas Google Android Exposure Notification System deletes the data without warning?

https://www.coronawarn.app/en/faq/#delete_random_ids also discusses the differences between iOS and Android.

thomasaugsten commented 3 years ago

Google argumentation is the user is not aware of the situation when he is removing the app there are still data left on the device regarding the framework and where he can delete the data.

MikeMcC399 commented 3 years ago

@thomasaugsten

Google argumentation is the user is not aware of the situation when he is removing the app there are still data left on the device regarding the framework and where he can delete the data.

I'm sorry that I don't understand this sentence and it doesn't answer at all the differences between iOS and Android.

the user is not aware of the situation when he is removing the app

What situation is this referring to? Does "situation" mean result of removing the app?

there are still data left on the device regarding the framework

What data is left on the device? I checked the documentation https://developers.google.com/android/exposure-notifications/exposure-notifications-api#methods and it stills says:

"Method stop() Disables the broadcast and scan process. You can call this directly. It's also called when a user uninstalls the app. When it’s called as part of the uninstallation process, the database and keys are deleted from the device."

where he can delete the data.

Who is "he" in this sentence? Google or the user? If it is the user then why is it referring to a place to delete data, when the user does not want to delete data, but instead wants to keep it? If "he" is Google, then I still don't understand.

thomasaugsten commented 3 years ago

When the user uninstalled the last app there are still the collected RPIs in the Google Android System space. The App cannot delete the RPIs. Google is assuming the user is not aware of fact there are still RPIs saved and where the user can remove the RPIs. This is the reason why Google has the guideline to remove all collected RPIs from the phone when the last Covid19 App ist removed by the user. Apple has a different opinion and is handling this different.

MikeMcC399 commented 3 years ago

@thomasaugsten Now I understand what you meant. Thank you!

alanrick commented 3 years ago

When I switch Active Region (recommended procedure when traveling between EU countries) are the RPIs deleted?

I’d hope they aren’t. But when I switched to the Irish app and later back to the CWA without de/re-installing either, the CWA displayed a message implying that they had been reset. Ie. The Apple framework has been active for months non-stop, but the region changed 2 days previously.

Attached is the export and screenshot in the hopes that someone can answer this. ExposureChecks-2020-11-27.zip

4CE2DE01-61CE-4511-A2E7-299ACAAC24EE

MikeMcC399 commented 3 years ago

@alanrick

When I switch Active Region (recommended procedure when traveling between EU countries) are the RPIs deleted? I’d hope they aren’t. But when I switched to the Irish app and later back to the CWA without de/re-installing either, the CWA displayed a message implying that they had been reset. Ie. The Apple framework has been active for months non-stop, but the region changed 2 days previously.

It is not necessary to switch apps when travelling between EU countries that are using the European Federation Gateway Service. See https://www.coronawarn.app/en/faq/#interoperability_countries. Ireland is on that list.

The question about preserving keys when uninstalling (which you didn't do) is answered in https://www.coronawarn.app/en/faq/#delete_random_ids where it says that iOS keeps the keys, whereas Android deletes them.

I can only speak from experience with Android where if you do not uninstall but just change the active app then the keys are not deleted, but the visible history is, so at first glance it looks like the keys have gone, whereas they haven't. Since CWA doesn't have direct access to the keys it just tells you how long since it was last made active, so that display is also misleading.

The log you attached has entries for both apps.

alanrick commented 3 years ago

Thanks for explaining. So they’re not deleted or ignored.

I’d assumed app-switching is necessary because some countries test on or after arrival.

You can only insert a positive coronavirus test result in the app of the country where the test was taken.

https://ec.europa.eu/commission/presscorner/detail/en/qanda_20_1905#gateway

But that’s another thread.

MikeMcC399 commented 3 years ago

@alanrick

You can only insert a positive coronavirus test result in the app of the country where the test was taken._ https://ec.europa.eu/commission/presscorner/detail/en/qanda_20_1905#gateway

That is indeed the text which the EU is currently showing.

As far as Germany is concerned, the official advice given out by the Robert Koch-Institut has been updated to:

"If you are in another EU country or in one of these countries and have made a molecular biological test (PCR test) which is positive, you can upload it to the Corona-Warn-App. To do so, it is necessary to verify your identity by calling the TAN hotline 0800 7540002. You will receive a 10-digit TAN with which the test result can be registered in the app. Attention: The TAN is only valid for one hour!"

Of course you are also right that this is a different topic, so if that needs clarification, I'd suggest a new topic under cwa-documentation.

Edit: There have been updates to https://www.coronawarn.app/en/faq/#test_in_other_country regarding the phone numbers. There is now an additional link to the topic: See also How to reach us from abroad.

MikeMcC399 commented 2 years ago

The outcome of this request lies with Google and is out of the influence scope of CWA.
The feedback from the CWA Open Source Team indicated that Google would not change and this feedback is now more than a year old.

Closing as unlikely to be implemented.

dsarkar commented 2 years ago

@MikeMcC399 Thank you for your assessment, internal ticket updated with your assessment.

corona-warn-app / cwa-wishlist