Cwa-wishlist: Support Exposure Notification Express

[mss1010]

Current Implementation

A server implementation for the Corona Warn App is created

Suggested Enhancement

Enhance the implementation / Support the new "Exposure Notification Express" framework from Apple and Google.

Expected Benefits

Google and Apple will take care of the "app" part centrally, without the need that every country develops and maintains their own apps. This would save a lot of time and money. Also, we can expect that their native implementations will be integrated with their OS more closely, so that several current issues of the seperate apps can be solved more easily and centrally.

---

Internal Tracking ID: EXPOSUREAPP-2464
Internal Tracking ID: EXPOSUREAPP-2512

[svengabr]

Hey, @mss1010 and thank you for reaching out. I have moved your issue from cwa-server to the wishlist as this is something which also reflects on the whole application (Frontend and Backend)

I will create a ticket internally and leave this open here for discussion.

Best regards,
SG

Corona-Warn-App Open Source Team

[Ein-Tim]

Related to this Issue in the iOS Repo

[svengabr]

Official statement from Deutsche Telekom:
https://www.telekom.com/de/blog/konzern/artikel/warum-die-erfolgreichste-app-des-jahres-auch-weiter-wichtig-bleibt-607230

[kbobrowski]

@svengabr thanks, this statement says that nothing will change for the user of CWA, but it does not seem to say anything about the decision to support Express or not? If I understand correctly these two modes can work in parallel, and user will fall-back to Express in case CWA is not installed

[mtb77]

@kbobrowski true, at the moment we don't have additional informations from the development team. but this topic has a high visibility right now. I hope we can clarify that in the next days - but I can not give a guarantee that we will give a profound answer before end of the week.

Thanks,

Sascha

Corona-Warn-App Open Source Team

[svengabr]

The RKI and BMG provided a statement regarding ENE. I have updated the FAQ website accordingly:

https://www.coronawarn.app/de/faq/#ene
https://www.coronawarn.app/en/faq/#ene

[mh-]

So one of the advantages of CWA is “EU-Interoperabilität”?

[kbobrowski]

@svengabr thanks for the update, it's not mentioned directly but I think by the way it is formulated we have to assume that Exposure Notification Express won't be supported.

Regarding new FAQ entry itself, I think it can be improved, as it seems to contain number of innacuracies:

Regions that operate an app adapted to their own needs will continue to receive the encounter notifications from the Exposure Notification Framework directly and exclusively. In Germany, all exposure notifications are routed exclusively to the CWA.

According to Apple docs regions that operate a custom app can still offer Exposure Notification Express in parallel as an alternative / fallback.

Integrated laboratory connection, faster notification process

ENE integrates with information from laboratories using deeplink sent via SMS / email, which is perhaps even more robust and faster method than QR code or waiting for a call / postal mail.

Data protection conformity

Not sure what it refers to exactly, is there a concern that ENE would be showing more information to the user than intended by RKI? Or that the Diagnosis Keys could be downloaded by anyone, not only by CWA users? (the latter is already the case, as Telekom CDN does not require authentication)

EU interoperability with legal certainty and data protection.

ENE offers worldwide interoperability.

Parameterization (e.g. when an encounter is evaluated as a risk does not come from Google/Apple, but can be defined by each country)

ENE can be parameterized by each country.

On top of this ENE also offers worldwide availability. If I understood correctly the issue of deploying app in foreign app stores, the concern was that RKI may be in violation of foreign country laws regarding deploying of health-related app. By also allowing ENE in parallel with CWA, RKI would no longer have responsibility here (in case someone is using ENE), so foreign countries would only be able to sue Apple / Google if they find ENE being in violation of their laws (which is extremely improbable). This would make it possible for all the people in Germany to participate in contact tracing, not only those with European app stores.

[kbobrowski]

As to the other points:

Flexible verification process

I guess it refers to couple of ways of verifying test result (QR code / teleTAN). ENE requires another approach with email / SMS deeplinks. But adopting ENE does not mean ending the product life of CWA, it would just provide user with even more flexibility, as user would be able to choose between 3 options, not just 2. Personally I would have opted for email / SMS deeplink verification process.

Legal conformity, e.g. age rating

Regarding age rating - Android version of CWA is rated at 0 years in Play Store, although according to FAQ the app should be only available from 16 years as it "processes data that is particularly worthy of protection under the GDPR", so RKI does not have enough control here to ensure legal conformity regarding age rating, ENE adopted or not. With ENE RKI would be able to define legalConsentText, which can include requirement of being at least 16 years old and other legal requirements.

Integration of hotlines

With ENE there seems to be no need for hotlines, as verification is done via email / SMS deeplink, and with technical issues about the app itself user would need to contact Google / Apple, not RKI technical hotline. Of course it is still possible for the user to choose CWA over ENE, if the user prefers, and then to contact RKI hotlines. If RKI would like to still leave some number for the user to call in ENE, it would probably be possible to add this information in agencyMessage

Backend servers still have to be operated

Well this is not really the advantage of CWA over ENE ;)

[alanrick]

Integrated laboratory connection, faster notification process

This is poorest performing aspect of the CWA, which appears to be less than 8%. (@micb25 ‘s dashboard - graph 10 )
Is there any evidence that the ENE performs better than the CWA in Germany?

150

[Ein-Tim]

@mtb77
Any update about this?
Or is the position from RKI/etc. still the same?

[Blackjacx]

For me this sounds like DTAG, BMG and RKI just want to promote "The most popular app of 2020" and burn more money than to support a centrally developed solution by Apple/Google which would be compatible worldwide.

Corona doesn't stop at borders and so shouldn't the development of a software solution that fights this virus especially not for marketing reasons.