Corona-Warn-App In Personal Use


After some back and forth and long debates about the correct consideration of the basic data protection regulation at SAP and T-Systems, the German government commissioned an app that was released in mid-June by the Robert Koch Institute (RKI) and made available for free and voluntary download. According to the government, this Corona-Warn-App has been downloaded more than 20 million times to date. That is better than nothing.

However, at least 50 million, i.e. more than 60 percent of the population, would have to download and actively use the app for it to have its full effect. Despite all efforts to protect personal data, we are far from achieving this. And the Germans' lagging in the digitalization of everyday life does the rest. Some people have downloaded the app but left their smartphones switched off in their pockets when they go to the supermarket or the park.

But active use also means making your own positive Covid-19 test known in the app. If the tested person gets a QR code for it, he can scan it directly into the app with his smartphone. Otherwise he must manually make a corresponding message in the app. From this point on, the app can inform all owners of smartphones on which the app is installed whether they have stayed risky long and close to this infected person.

Apparently, this works quite well, and it is good that such an app is available. The data does not end up with the government, the RKI or the police. You don't even learn about the infection of the other person immediately and in real time when you meet them. The infected person remains anonymous and protected.

Warnings that cause unnecessary panic

But it is not as simple as it sounds and probably understood by many. The app may well issue warnings that might tempt the user to a Covid-19 test, even though this would not be necessary. Two examples from my own experience of the app's functionality and that of a friend should illustrate this.

Increased Risk Corona-Warn-AppOn the weekend before last I received the warning against a red background: "Increased risk - 24 risk encounters - 3 days since last encounter". It was the first time I saw this red background. I was startled and thought I understood I had 24 encounters with infected people. With 24 people? That was my first thought. Where was I that I could have met so many positively tested people? I could think of nothing.

On the advice of a computer scientist that the "risk encounters" could also mean the proximity to positively tested persons through walls or ceilings, I did some research and actually found out that a family living in an adjacent apartment had been hit by the virus. The Bluetooth sensor of my smartphone had registered the positive detection through walls and ceilings.

Since I was unable to reach my family doctor or the health department at the weekend, I had already arranged a test appointment for Monday at a municipal test center, which I cancelled now. Neither did I have any symptoms, nor did I have contact with the affected family. Today my app shows for the first time again on a green background: "Low risk - 2 low risk encounters". The 14 days that the app had stored the Bluetooth ID of one or more smartphones in my system were over yesterday.

Lack of transparency of how the app works

A second example with a friend: Red was displayed, "Increased risk - 2 risk encounters - 9 days since last encounter". The friend could remember exactly who he had met on that day that did not belong to his household. A craftsman had worked with him in the same room for about an hour.

Another kind of Increased RiskMy friend has no symptoms and will not go to the family doctor. Because there is a high probability that the craftsman was not infected and infectious at the time of his visit. He may have felt something three or four days later, had himself tested and then, eight or nine days after the encounter, got a positive result. Now my friend's app indicated the risk encounter, but it had taken place before the infection of the craftsman who later tested positive. Within 14 days, my friend's smartphone and that of the craftsman had come dangerously close, but at a time when there was no danger at all.

I checked with the developers of SAP and the app, as well as with the German government and the RKI to see if such possibilities were mentioned. No such mention. I did not find any reference to such cases anywhere on the Internet. I would not be surprised if some App users have done a test in the last few weeks because they were similarly unsettled and knew nothing about this possibility of false warning.

It is not bad that the app knows so well about possible risk encounters. What is bad is that the descriptions of how it works are so focused on privacy and technology that its warnings can very easily be misinterpreted. 24 risk encounters may have been actual risk encounters with 1 to 24 people. They may also have been encounters through walls and ceilings that were completely harmless.

Knowing this makes it much easier for me to use the app. Maybe also for one or the other reader. Therefore: Please pass it on!

Go back