Cwa-wishlist: App does not work any longer if GPS is deactivated

[bhintermayr]

Error occurs on different mobile devices.

Error message 'Standortdienste deaktiviert' . If I am turning on the GPS (which usually not do) the app works and states "Risikoermittlung aktiv".

This behaviour is new, first recognized today.

---

Internal Tracking ID: EXPOSUREAPP-2215

[kbobrowski]

@bhintermayr the app never worked with Location setting turned off - this was unfortunately false information in the app. Related issue with more technical details why "Location setting on" is necessary: https://github.com/corona-warn-app/cwa-app-android/issues/881

[MikeMcC399]

Hi @bhintermayr,
You need location (Standort) on in Android and this is mentioned in the FAQs in German or FAQs in English.

[bhintermayr]

Ups. That means a wrong status was displayed from day one.
Understanding the dependency on the android interface, but I assume switching on location (permanently) will be a no-go for many users.

[vaubaehn]

@bhintermayr

This behaviour is new, first recognized today.

Can you provide your ENF version, like described here: https://www.coronawarn.app/de/faq/?search=Enf#ENF_version ?
The complete number

[bhintermayr]

15202902003

[vaubaehn]

@bhintermayr thank you, then it might not be related to the new ENF-version currently being rolled out.
Then that new behaviour might be related to the new CWA version 1.2.x, as many users report lately to be irritated about that error message you described. (I have not been affected, running latest CWA version, though)
[edit: see daimpi's next comment - it's tricky to correlate error sources, when app, enf and system get updated during the same time frame...]

[tdiesler]

I'd say that requiring "location on" at the device level stays in direct conflict with the goal of CWA high adoption. Many privacy sensitive folks will simply not care about the intrigate relationship with BLE. The message still is "CWA forces me to tell the world where I am". Please work with Google to fix this.

[daimpi]

@kira99 and I recently had a chat on exactly this topic: https://twitter.com/AlexandraWittm/status/1292784799581704192

Summary: some device manufacturers have seemingly decoupled GPS from "location" in some software versions. So if I disable “GPS” in the dropdown menu on the main screen on the two Xiaomi devices in my family (Xiaomi Redmi 5 Plus with Android 8.1 and Xiaomi Redmi Note 7 with Android 9) they will still happily continue to send BLE tokens (I checked with a BLE Scanner) and no warning will be shown by either Android nor the App itself:

On the other Hand @kira99’s Redmi Note 7 had the same behavior, but recently received a system update and since then she needs to enable GPS otherwise no tokens are send and a warning is shown.

Additionally it seems like Android 11 will address this issue, by having an exception for ENF: https://blog.google/inside-google/company-announcements/update-exposure-notifications/

[treysis]

In the past Google PlayServices would send the warning about disabled location settings. It might be that many people have disabled notifications from PlayServices, and due to this they would not be warned about turned off location, neither.

Also, in the past you could select in location settings to not use GPS, while still allowing BT+WiFi. Since some Android version (I think 9, but I don't recall), this option is now reversed: you can turn off BT+WiFi while location is on, but you cannot turn off GPS without turning of location settings. It seems though that some manufacturers went their own way.

Unfortunately, Google can't do much about this. This would only work if the government would force manufacturers to release a firmware update to all Android devices running Android 9 or higher. Which seems extreme at first, but then again forcing shops and other venues to close is even more extreme.

[daimpi]

After updating the Xiaomi Redmi Note 7 to "MIUI Global 11.0.1 Stable" today, it now also needs location enabled in order for ENF to work properly (also notice how it now says "Standort" instead of "GPS"). So at least in this case this seems to be purely a manufacturer thing and not anything related to CWA:

[tdiesler]

IMHO, it should not be necessary at all that the user is exposed to bluetooth AND location permissions. Instead, it should be possible for CWA to bypass location permissions as part of the BLE API contract. The user would then only be exposed to (required) bluetooth permissions. The OS knows that a CWA is requesting stuff from the BLE interface and could hence handle location stuff transparently for CWA clients.

I'd think that requiring location permissions, is quite likely going to reduce acceptance significantly for this app.

[daimpi]

IMHO, it should not be necessary at all that the user is exposed to bluetooth AND location permissions. Instead, it should be possible for CWA to bypass location permissions as part of the BLE API contract.

This will only be possible with an Android update/modification and cannot be pushed via play services, which are used to provide ENF.

I've elaborated on the reasons behind this in more detail here (German).

[treysis]

This has been elaborated already back in June shortly after the release.

[MikeMcC399]

@daimpi

Additionally it seems like Android 11 will address this issue, by having an exception for ENF: https://blog.google/inside-google/company-announcements/update-exposure-notifications/

The ENS release notes https://developers.google.com/android/exposure-notifications/release-notes#locationless_scanning say that ENS is ready for Android 11 and locationless scanning.

"Locationless scanning
With Android 11, version 1.6 and higher of Exposure Notifications works without having to enable Location Services. This means there are now additional cases in which it is not necessary to prompt users to manually enable this setting.

To simplify checking when locationless scanning is available on the device, we have updated the SDK (v1.6.1) to include deviceSupportsLocationlessScanning(). This method returns a boolean value indicating whether a given device supports locationless scanning."

(Android 11 has been released https://developer.android.com/about/versions/11 .)

[MikeMcC399]

CWA Android 1.5 Data Privacy statement now says:

https://www.coronawarn.app/en/privacy/ > https://www.coronawarn.app/assets/documents/cwa-privacy-notice-en.pdf

In 8. What permissions does the app require?
b. Android smartphones

"If you have a smartphone running on Android version 10 or lower, location services need to be enabled for your smartphone to search for Bluetooth signals from other smartphones. Please note that no location data is collected in this process."

It's also available through
CWA > three-dot-menu > App Information > Data Privacy

By implication, it means location services do not need to be enabled on Android 11.

I don't have an Android 11 physical device to try it out on, but on a Pixel 3a, Android 11 emulator with "Use location" disabled, Exposure Notifications did not show any warning.

(On Android 10, as expected, there was a notification
Exposure Notifications inactive
To use this feature, turn on location.)

So, in summary it seems to be working and documented as expected in Android 11. In Android 10 and below there are no changes and Location Services need to be enabled to allow Bluetooth Low Energy to work.

[daimpi]

@MikeMcC399

So, in summary it seems to be working and documented as expected in Android 11. In Android 10 and below there are no changes and Location Services need to be enabled to allow Bluetooth Low Energy to work.

Yes that seems to be correct except for a minor UI element which hasn't been adjusted for Android 11 yet but the devs are already on it 🙂.

[MikeMcC399]

@daimpi
Thanks for the pointer to https://github.com/corona-warn-app/cwa-app-android/issues/986#issuecomment-718856339!

You are right and the issue still occurs on CWA Android 1.5.1!