Cwa-app-ios: Phone was nerver outside my flat and CWA still shows one Low-Risk Enocounter

[Ein-Tim]

Avoid duplicates

• [x] Bug is not mentioned in the FAQ
• [x] Bug is not already reported in another issue This is a follow up to my comment here: https://github.com/corona-warn-app/cwa-app-ios/issues/1106#issuecomment-698123312

Describe the bug

I have a Backup/Beta phone (an iPhone 6s) which I never take out when I leave my flat, etc. So this Device just lays on my desk in my room...
Today in the morning I looked at the phone and was a little bit surprised. The App shows "1 Risiko-Begegnung mit niedrigem Risiko".
The Settings on the phone are showing 0 matches... (#1106)

There in #1106 the assumption is that this is a false-negative from iOS but, I don't really think so anymore, because the only reasons why this phone could show an Encounter are:

a) somebody on the street (I live on second floor)/one of my neighbors was tested positive and the iPhone 6s recognized it (unlikely to me)
b) the Low-Risk Encounter is false (there was no Encounter?)
c) because I got an Encounter on my main phone (which I always have with me when I leave my flat), an iPhone XR, this iPhone XR "warned" the iPhone 6s (which, afaik is not how the CWA is working, but my uncle called the "Gesundheitsamt" and they really said that Low-Risk exposures are like second Contact notifications...)

You also have to know that Bluetooth is often disabled on this phone... So this makes it even more unlikely that the ENF really detected an Exposure

Technical details

• iOS Version: iOS 14.2 (Public Beta)
• Device: iPhone 6s
• CWA Version: 1.3.0

Additional context

I opend this Issue to Invite @ndegendogo to share his thougts and also to give the Devs (cc @thomasaugsten) a chance to confirm that it is confirmed by Apple that the Match Key Count in Settings is False and that the CWA is showing the right amount of keys.

---

See the Exposure Check log here:
https://pastebin.ubuntu.com/p/2pjBHhBXM3/
And a Screenshot from the CWA if it helps:

[daimpi]

Interestingly I had someone on Twitter reporting a similar issue ~2 weeks ago with an Android device: https://twitter.com/Cd42288295/status/1304494863950458887

The only thing I dunno is whether they had an entry in their exposure log at this time, but I'll go and ask them 🙂.

[ndegendogo]

@Ein-Tim please share also your cwa version, to round it up.

[Ein-Tim]

@ndegendogo
Updated the Issue Text (:

[ndegendogo]

Thanks @Ein-Tim for your invitation to this discussion.

(a) true encounter: I agree with you.
Extremely unlikely for a device that never left your flat.

(b) false positive / bug (in cwa, or iOS / ENF, or at the interface between them): well, you never know, do you? Especially with a beta ...

(c) some kind of data sharing or transmission between the devices: interesting idea.
To be honest, in the first moment I thought: never ever! This would break all privacy constraints and undermine the trust in the app and the whole concept.
But then: let's assume that you synch or backup your data to Apple cloud, including your sensitive health data; of course they will be securely encrypted; and let's assume that both devices are linked to your account.
I could imagine a use case, like: user gets a new device and wants to migrate all his data to the new device. So maybe Apple has indeed implemented such data sharing between devices under same account?

And, regarding the statement from the Gesundheitsamt: I don't think they mean it literally. When they do a manual contact tracing and risk assessment, they follow more or less the guidelines of RKI, and have category KP1 (increased exposure risk, close contact for extended duration) and KP2 (low risk, distant contact or short duration). And if cwa says: low risk encounter but still green, they will handle you as KP2.

[ndegendogo]

I just see: according to #1232 and #754 the IDs seem to be excluded from transmission to the cloud or to a new device ...

[Ein-Tim]

@ndegendogo Thanks for your comment!

I think that b) is most likely in my case, I hope that this is a Beta Issue but fear that also iOS 14(.0.1) has this Issue...

c) This would be very critical from Apple (but they don't do it so 🤷🏻‍♂️)

And, regarding the statement from the Gesundheitsamt: I don't think they mean it literally. When they do a manual contact tracing and risk assessment, they follow more or less the guidelines of RKI, and have category KP1 (increased exposure risk, close contact for extended duration) and KP2 (low risk, distant contact or short duration). And if cwa says: low risk encounter but still green, they will handle you as KP2.

Ahh now I understand! I'm sure they meant that 👍
Thanks!

I would leave this Issue open until @thomasaugsten confirms that the 0 encounters in the Settings are confirmed to be a bug from Apple...

[ActionLuzifer]

Hi!
If this i a bug in iOS, it's also in 13.7.
My second device never left the building, all MatchCount are 0, and all entries have at least one entry in Files-section ( which seems to be a/the problem in #1106 if there were no entry ).

And i have one low warning today.
But i don't know for how long, i didn't open the app every day.

I just opened it today because I also got a real low warning today on my primary device, too.
I hit a key in the sync last night. But i my case it is an Android, S10.

[Ein-Tim]

@thomasaugsten
This has a very very bad taste.
Could you pleas confirm that this is a iOS Bug and that Apple confirmed this?

@ActionLuzifer Thanks for reporting 👍

[thomasaugsten]

The 0 in match key count or abgegelichene Schlüssel is an issue in 13.7/14.0/14.0.1 and addressed to apple
If the App shows a risk encounter this is the encounters directly returned by the API but the API is missing to write this in the log.

[Ein-Tim]

Okay @thomasaugsten, thanks for your reply. I will close this Issue for now, since it seems like the phones have recorded smth. and CWA is definitely returning the right number 👍
@ActionLuzifer Are you ok with this?

[ActionLuzifer]

@Ein-Tim It's ok!