How is ExposureConfiguration set in Immuni?

[pdehaye]

The CoronaRiskScoring project is trying to assess how different contact tracing apps are being parametrized. We are first focusing on apps using the Apple API as it will enable quickest comparison.

Project considered
We are looking at Immuni.

What we need
We need pointers to the places in the code where the following parameters are set:

• ENExposureConfiguration.attenuationLevelValues,
• ENExposureConfiguration.daysSinceLastExposureLevelValues,
• ENExposureConfiguration.durationLevelValues,
• ENExposureConfiguration.transmissionRiskLevelValues and
• ENExposureConfiguration.metadata.attenuationDurationThresholds

Nice to have
We would also like to understand what is done with ENExposureDetectionSummary and ENExposureInfo, after the risks are calculated.

Excellent to have
This is only the beginning for us. We want the above so we can track how the parameters are being changed. It is likely actually that this is passed dynamically to the apps. If so, we need to know the process behind these changes, so we can ask the right people for this information.

If you have pointers in the right direction, they would be greatly appreciated.

[pdehaye]

It looks like some defaults are set here, possibly for the duration of the trial period. This here might be code to do the updates.

This or this might be the place where those parameters are updated.

The parameters can be queried through requests like this:

https://get.immuni.gov.it/v1/settings?platform=ios&build=666

[pdehaye]

Indeed:

• Android parameters
• iOS parameters
  (in v1)

[pdehaye]

You can find some background on how to configure e.g. the Apple API here.

[pdehaye]

The configuration of the Immuni app has changed!

This project doesn't have a scraping system in place yet, but at https://get.immuni.gov.it/v1/settings?platform=ios&build=1 it said yesterday (pretty printed, same for Android):

"exposure_configuration": {
    "attenuation_thresholds": [50, 70],
    "attenuation_bucket_scores": [0, 0, 3, 5, 7, 7, 7, 7],
    "attenuation_weight": 1,
    "days_since_last_exposure_bucket_scores": [1, 1, 1, 1, 1, 1, 1, 1],
    "days_since_last_exposure_weight": 1,
    "duration_bucket_scores": [0, 0, 0, 3, 5, 5, 5, 7],
    "duration_weight": 1,
    "transmission_risk_bucket_scores": [1, 1, 1, 1, 1, 1, 1, 1],
    "transmission_risk_weight": 1,
    "minimum_risk_score": 1
  },

while it says right now

 "exposure_configuration": {
    "attenuation_thresholds": [50, 70],
    "attenuation_bucket_scores": [0, 5, 5, 5, 5, 5, 5, 5],
    "attenuation_weight": 1,
    "days_since_last_exposure_bucket_scores": [1, 1, 1, 1, 1, 1, 1, 1],
    "days_since_last_exposure_weight": 1,
    "duration_bucket_scores": [0, 0, 0, 0, 5, 5, 5, 5],
    "duration_weight": 1,
    "transmission_risk_bucket_scores": [1, 1, 1, 1, 1, 1, 1, 1],
    "transmission_risk_weight": 1,
    "minimum_risk_score": 1
  },

In both cases, the exposure_info_minimum_risk_score remains at 20.

We see (comparing to the API) that before there was some balancing of Bluetooth-proxied distance and duration (because 3*7 > 20, 5*5 > 20, 7*3 > 20).

Now that balancing is mostly gone and amounts to "has a signal been seen for more than 15 minutes at attenuations less than 73dB". Since that attenuation level is huge (and 5*5>20), it looks like there is no longer any effort to measure distance from Bluetooth, everyone just gets notified if they spend more than 15 minutes in the same room as an infected person.

There are also privacy/security implications, given paparazzi and replay attacks.

[vincenzoiovino]

Dear all,
may you confirm that currently Immuni in Android flags as risk signals at attenuation below 63dB (not 73) for >=15 minutes?
Thanks in advance.
Kind regards