Warn contacts on positive home-use rapid test

[dari-ta]

Problem and Motivation

Rapid Tests for use at home are likely to be available in the near future. Currently, a positive test result with a home-use rapid test needs to be verified by a PCR test before being reported in the CWA. If it was possible to reliably report a positive home-use rapid test before a verification by a PCR test, contact persons can be warned earlier. This would increase the usefulness of the CWA and can lead to an earlier isolation of potentially infectious persons.

Feature description

It should be possible to report positive results with home-use rapid tests in the CWA.

This feature must meet these requirements:

• [R1] To avoid misuse, It must not be possible to submit a negative or no test result as a positive test result.
• [R2] The feature must be implemented as simple as possible for the end-user

Feature proposal

A reporting function for home-use rapid tests can be implemented in many ways, this is just one possible solution.

Basic solution

Home-use rapid tests need to be altered to show the user a verification number on positive tests. This could be done by using more than one marker for a positive test result by encoding the verification number with the number of positive test markers. E.g. one positive test marker would encode a ‘1’, three positive test markers would encode ‘3’. Each test is produced with n markers (n is in 1,…,N). Likely ranges could be N = 4 or N = 5 to avoid unnecessary production costs and to keep a good readability (R2). The verification number must not be visible on an unused or valid negative test. The verification number is used to avoid the submitting of negative results (R1).

[Fig A]: The new layout for rapid test strips. Each test strip has a different number of positive indicators. This number is used as a verification number for the validity of the positive result

Every produced home-use rapid test has a unique serial number. The CWA backend needs a database with tuples of (serial number, verification number). The serial number can either be printed on the test enclosing or encoded in a QR Code which is distributed alongside the rapid test (R2).

The end-user uses the rapid test as usual. After receiving a positive result, the end-user can enter the serial number and verification number in the CWA. The CWA backend verifies that the serial number and verification number match. If they match, the CWA triggers the warning for all possible contact persons in the same way as ist does when registering a positive PCR test result.

[Fig B]: Activity diagram for the test process including the end-user, CWA frontend and CWA backend. The test production and test distribution process is not pictured.

This solution requires:

• Altering the home-use rapid tests to include verification numbers
• Altering/Creating a UI for test result submission
• Storing of (serial number, verification number) tuples. This might be unnecessary if a hash function is used. It must be made (nearly) impossible for the end-user to calculate or guess the verification number from the serial number (R1)

Unresolved Issues

These threats exist:

• [T1] It is possible for the end-user to try each combination of a known serial number and any possible verification number. Especially because the range of verification numbers is limited.
• [T2] It is possible for an outstanding person to guess (serial number, verification number) tuples and submit them to the server. This could lead to the submission of positive results for not-yet used tests.

The first threat T1 can be mitigated by allowing only one submission for each serial number (or maybe up to two submissions). This will introduce the possibility for another threat:

• [T3] An outstanding person could guess a serial number and an invalid validation number and submit them. This would block any further submissions for this serial number by the actual end-user

[Fig C]: Threat Model. Submitting a positive test result is the primary weak point.

T2 and T3 need to be resolved before an actual implementation is possible.

The threat target for T2 and T3 could be decreased by using self-verifying numbers as serial numbers. This would decrease the range of possible valid serial numbers but can not resolve the issues completely. Another potential solution would require that the serial number for each rapid test is activated when it is sold. This decreases the timeframe in which the corresponding serial number can be attacked.

Additional use cases

• If positive rapid test results can be verified, they can be used as a means to order quarantine. At least for a limited number of days until a regular PCR test result is available.

Related Issues

• 371 This issue is about on-site rapid-tests. A solution may include both on-site and home-use rapid tests

Are you interested on working on this Issue?

Yes (for the software part)

---

Internal Tracking ID: EXPOSUREAPP-5391

[jucktnich]

I heard you can put something sour on the test strip and it will cause a positive result, your sample first has to be neutralised on a special field of the test. If this is true, there are two problems

• You can trigger a positive test result by putting some coke on the test strip
• Some users may don't read the instruction and cause accidentally a positive test result

[dari-ta]

This is a good point that i missed. On the other hand, this is a general problem with home-use rapid tests which can only be mitigated if the test was done by a professional. I think this is a risk we have to take in order to provide faster warnings.

A partial solution would be to use a weaker warning level for those rapid tests (some kind of "pre-warning"; a positive rapid test would be validated by a regular PCR test afterwards). This would give people the chance to enter self-quarantine faster while not being legally binding.

[jucktnich]

I think that you won't cheat yourself by putting coke on a rapid test but you may cheat others by doing so.

[pkreissel]

I think this is not possible for at home tests, because it can be used for trolling. We have the problem of very motivated extremely crazy people who still don't believe the pandemic exists, and they will use any possibility to make life miserable for the rest of us. We cannot prevent people from faking positive results using any liquid with a low ph-value. So this is only possible to use in a controlled environment with trusted personell.

[jucktnich]

I think I've got an idea to solve the ph-value problem. Putting some stripes on it, which will show when the ph-value is under a certain value. (So if the ph-value is to low, there are too many stripes, and the app knows, that the ph-value was too low and doesn't count it as positive.)

[pkreissel]

@jucktnich That might prevent Cola from faking the test, but you can still use a red text marker and a ruler. In short: Its not possible to defend an at home test against a motivated adversary.

[jucktnich]

What's the point with the text marker and ruler?

[jucktnich]

Ps.: I don't think, that the Querdenken movement can say, the people should download the app and fake Rapid tests, because they often said the government tracks with cwa.

[cfritzsche]

Finally some movement here: Apprently upload from antigen test will be supported soon: "Der Bund will im Laufe des Aprils zudem die technische Möglichkeit schaffen, auch Schnelltestergebnisse in der Corona-Warn-App anzuzeigen und in einem „zeitnah“ folgenden zweiten Schritt auch eine Warn-Funktion durch Schnelltests freischalten. „Hierbei wird den Gewarnten angezeigt, ob die Warnung durch einen PCR- oder durch einen Schnelltest verursacht wurde.“ Der Bund will überdies allen Anbietern von Testzentren die Möglichkeit geben, sich an das System der Warn-App anzuschließen." https://www.handelsblatt.com/politik/deutschland/kampf-gegen-die-pandemie-bund-ruestet-seine-corona-warn-app-mit-check-in-funktion-auf/27026914.html

[raceface2nd]

@dari-ta Your motivation is good. But after 6 months intensive work on quick test concepts from my side I strongly recommend NOT to trust results of home made tests. Even if many of the test kits are approved for non professionals there are many possibilities to test incorrect. E.g. one has to respect an optimal temperature range to make the test and to store the test kit.

There have been suggestions in the past weeks to let customers make there tests in front of stores which would result in many many many wrong results in spring, autumn and winter. Testing personal also have to exactly respect the amount of extraction liquid used while testing. If it's too much then the dilution of the sample is too high and the proteins might not be detected and if they use too less liquid the sample liquid may not reach all active areas on the test area on the cassette.

Even more I as a company owner would not trust my employees in this according to upcoming insurance issues. If one is making the test incorrect that it shows negative or simply tells me that the result is negative as she/ he is declining the existence of the virus I might come into a situation to close my company for a while when the virus spreads in the company. The I might be faced with monetary claims by infected people, people with physical long term harms or my clients because I might not be able to fulfill my contracts.

As a business owner I ever would prefer to contract professionals in testing my employees.

[jucktnich]

For the problem with undercooking you could do a similar thing like with the ph-value. But I don't think, that this much effort is appropriate.

[abrock]

AFAIK current tests (or at least the one I've been given) must be examined 15 minutes after starting and will always show a positive result after one day. Therefore preventing coke from showing a positive result doesn't prevent anyone from faking a positive result.

[jucktnich]

Really? My self rat was two days after the test negative...

[achisto]

AFAIK current tests (or at least the one I've been given) must be examined 15 minutes after starting and will always show a positive result after one day. Therefore preventing coke from showing a positive result doesn't prevent anyone from faking a positive result.

Definitely not the case with every test. Here are my seven latest rapid tests (not self tests but the rapid tests we have at work) and they date back as far as 4 weeks. All of them are still negative, just as in the beginning.

[abrock]

I did a test which was negative after 20 minutes but showed positive four hours later

It's difficult to photograph, but in reality it clearly shows a weak positive line. I made another (different) test which was negative.

[alexander-n8hgeg5e]

I am referring to the issue 5092 i created, essentially the the same topic as this wishlist item Somehow it could work like this: A report about a positive self-test goes into the calculation with a lower probability of infection (lower risk), in order to take account for the expected rate of fake reports. The factor could be adjusted with every update to reflect the real amount of fake reports. Anyway a risk warning in the CWA does not mean you are infected, so it is always a probability. I don't know about the implementation nor details about the CWA, so i don't know what would be needed to implement this. The app would need a fine grained risk status. Maybe a colorized number with intermediate color shades from red to green,... I think the resulting risk status would be more useful because it would be more up to date. People know that the risk status is a risk and not a fact. If there would be always a high risk displayed then people start to ignore it, on the other side if there is always no risk and people get infected anyway, it has a similar effect. You need to find the right spot that results in a varying value that people start to use to infer their risk from. At the moment i think/guess there is a problem (is it? I don't really know) because many infections are not reported. If this can't be improved it is a greater degradation of usefulness than the false reports.

[Ein-Tim]

I want to relay that this is one of the most requested features on Twitter. Especially the time-saving aspect is pointed out by most users.

[dsarkar]

@Ein-Tim Thanks for the feedback, we will forward this.

[MikeMcC399]

@dari-ta

The feature to "warn contacts on positive home-use rapid test" is implemented in the release Version 3.0: CWA warnings now possible after positive self-test.

[dsarkar]

implemented in iOS and Android app with EXPOSUREAPP-14171 and EXPOSUREAPP-13454

[Ein-Tim]

@dsarkar I don't know why you applied the "Fix 3.1" label to this issue, but this has been implemented with version 3.0.

[dsarkar]

@Ein-Tim Thanks!

[dsarkar]

Dear @dari-ta, @jucktnich @cfritzsche @alexander-n8hgeg5e @abrock @achisto @pkreissel @raceface2nd @MikeMcC399 @Ein-Tim, dear community,

thanks a lot for the suggestion of this feature and all the discussions here. We are closing this issue now as implemented in R 3.0.

Best wishes, DS

---

Corona-Warn-App Open Source Team