Hacker News new | past | comments | ask | show | jobs | submit login
Contact-tracing data harvested from pubs and restaurants being sold (thetimes.co.uk)
199 points by DyslexicAtheist on Oct 11, 2020 | hide | past | favorite | 125 comments



Story from Germany. In the last 2 months I have been getting weekly something like 1-2 calls in the beginning and now, this week almost 10 calls from all kinds of numbers from various german numbers. Looking into them (online, people reporting these calls, all are ads and all kind of bullsh*t).

I don't share my number, it was quite private, I never got these calls, maybe I had 5 calls in 5 YEARS, now I get more than that in one day. Why is this, I think? A lot of restaurants use lists and then just pass them to guests at the tables or make them visible for everyone writing on them. Recently there are places that offer QR codes and individual forms, and it gets better, but having these lists visible, anyone that is at the restaurant can just take a picture of the whole list.

I could say that I entered a different name some time ago and I got a spam call asking "Is this different name?", but that would be illegal and I would get a fine. :)


Welcome to America. I get 20 calls per day on my cell phone with spoofed numbers. I don't even answer the phone if I don't know the number anymore.


Paraphrasing TuringNYC[0] from another recent HN thread[1]:

> Just a decade ago, SMS messages in the US cost 10 to 25 cents per SMS. You also got charged for spam SMS. Prices were completely disjointed from the reality of underlying costs (zero for the telcos).

> In the following ten years, the tech giants sweeped in, competed, provided a better service, with better cross-platform support, for zero dollar immediate cost to the end customer -- gained a massive following (think whatsapp), and are now vilified for their "monopoly" and the "harm" it has caused.)

The only thing holding back a messaging-style disruption of voice services is the universal inter-operability of phone numbers. Various apps can be used for voice calls within the apps themselves but they're not compatible with a phone call from a landline for restaurant booking confirmations and such.

Google Voice achieves this and Twilio got a mention in the other thread, but I'm not sure what else is out there (I'm not in the US so it's not a problem I need to solve for myself). Seems that US telco's are still asleep at the wheel in regards to their consumer-level services and will devolve into providing purely network connectivity and losing entirely any of the services that sit atop the network.

What's ridiculous is that such things have become necessary. That there's no (enforced) legislation to prevent selling any and all contact information that passes a receptionists desk.

[0]https://news.ycombinator.com/user?id=TuringNYC

[1]https://news.ycombinator.com/item?id=24749971


Indeed. In addition to that (if that wasn't enough!), I've started getting an increasing amount of spam texts in the last couple of months too.


I suggest signing up for the DNC list[0]. It will at least stop legally operations which sometimes sell their list to more shady operations. It at least helps. I often report calls too.

Maybe one of you all that is good at phone apps could make one to fill out the forum automatically. I'm not sure why this already isn't a feature in Google considering they screen calls.

[0] https://www.donotcall.gov/


20 per day? I maybe get 2 per week!


Unfortunately those lists are mandated by law. We had an idea to pitch to the government to introduce a better system but they won't hear it after RKI's/SAP's super-magic contact tracing app they spent 15 million euro on...


I think it's important to remember how March-us was thinking. It was much more important back then to have a working system than the best possible system, and frankly if this is the price of good contact tracing it's probably worth it.


That's the problem, though - we're finding that the majority of exposures are coming from super-spreader events, not one-off, individual encounters. They haven't released statistics yet for how good it's been working, so there's no way to know if their approach was helpful.

Even then, SAP is the one that developed it for 15 million. The important bits were already completely by the universities. SAP just made a UI for it - for 15 million euros. That's an insane, absurd price to pay.


Provide a disposable number and e-mail address. For example, use a pre-paid 2nd SIM for this purpose and discard it after a year (mine gets cancelled after 6 months of no use). With regards to e-mail there's various solutions for that.


I’m exhausted just thinking about that.

When one has to become an OPSEC professional just to get a goddamn burger without getting haunted afterwards, something is deeply wrong.


I wholeheartedly recommend masking your email and phone number with blur/abine. Every website I have an account with literally thinks I have a different email address. You can also mask your credit card number but you have to pay extra for it so I don't.

My only regret is that I do still get the spam texts and calls. I am thinking that I should somehow make my current number a google voice number or something so that there can be just an automated system that asks them to press any number to connect. Something that simple would stop 100% of my spam calls because they are all robocall recordings.

I think that, as long as you're okay with paying for a service, it can be fairly easy. It's when you want to do it all yourself that you have to be an OPSEC professional. There is plenty of middle ground of paying someone who knows what they're doing to provide the ability to better mask who you are and make it expensive for someone to spam you. Make them waste their time talking to your automated answering service for a change.

But yeah, it's frustratingly complicated. Some of this stuff just seems like it should be a built-in feature of modern telecommunications. My cell provider should give me the ability to present an automated message for free, and at least block numbers... mine doesn't even let me block numbers, I have to do it at the phone level so I still get voicemail messages. That kind of stuff seems like it should be considered basic service.


spamgourmet.com has been around for years (two decades at this point I think?) and does give you disposable emails without the need to configure anything about the alias before using it.


In this day and age we all have to mind our OPSEC.

Right now, due to COVID-19, sometimes we are sacrificing some of our privacy. But we still have choices, too.

You don't have to go to a restaurant to buy a burger. You can buy a burger at a butcher or grocery store. Or not buy one.


That's a complete waste of time, energy, and money. You can do the same thing with Twilio for cheaper.


I don't know if this is the case with Twilio, but many others (like Google Voice) are US-only.


I just fill in made up data. I have no interest to participate in contact tracing.


And you believe your interest in privacy is more important than others interest in stopping the spread of a pandemic? Be aware, this is the same argument anti-maskers are making.


Unfortunately, this is now illegal in Germany and has a monetary fine attached to it.


And how do they intend to enforce that? It’s not like they know who put in fake data, that’s literally the whole point of fake data


I've actually heard of some places checking your ID after writing down your info to ensure you entered the data truthfully.


I live in Germany. That has not happened to me. I was never contacted after sharing my email and phone number on those lists.


The UK government doesn't even trust itself with test and trace data privacy: https://www.bbc.com/news/technology-54328644

Without privacy guarantees people don't use it. If people don't use it the whole system fails.


I work in part for the NHS, and have been told to turn off the app while in the hospital. In part, I think this is because they are scared of the effect that false positives will have on (already precarious) staffing numbers (just like the police -- which, owing to austerity, are horrendously under-manned).

That being said, I haven't installed the app. I know I "should", but I just do not trust it. I've completely and utterly lost all faith in the government, and although I have the .apk executable sitting in my downloads folder just waiting for me to disassemble it and read through it myself, I haven't yet.

It's almost as if decades of sophisticated spying and "dark practices" have conditioned the entirety of the UK to not trust their government, or something. I use a VPN (or three) at home, tor where appropriate, and root my phone and cut out the Google dial-home. It's a very big ask to get me to install a government-developed application. I just have a deep, probably irrational, fear of it watching everything I do.


"... have been told to turn off the app while in the hospital."

(This is for England only, I have no idea what the rest of the UK is up to)

The algorithm the app uses is pretty simple and in your case would be going off like a siren nearly daily. It announces itself in the vicinity via bluetooth and listens for similar announcements. Each device has a random, self generated ID and this is changed regularly. If someone gets a positive test and reports via the app then their ID at the time is sent out. Apps will compare their list of known IDs and times they were seen with the positive list. Basically if your app decides that it saw a "positive" ID for something like 15 minutes or more then it will flag it to you. Then it is up to you whether to isolate, get tested etc. It is not an offence to ignore the app but it is if you ignore an official Check and Trace operative.

This is why you are told not to use it at work. The algorithm is designed to work for people going about "normal" life and your life in the NHS is not normal. It can't possibly work for you or my cousin working as a matron in a hospital. The algorithm basically measures exposure and the current thinking is that 15 mins is long enough to flag a warning. So don't stop and chat for ages in the supermarket/park/pub or whatever to your mates - say hi and use a phone later. If you do go to a pub or restaurant then you have to accept that there is a risk.

If you are worried about the sign in QR code thing not having a sign out until midnight, you can create your own home "sign in" to do the same job. See https://www.gov.uk/create-coronavirus-qr-poster .

There is no need for conspiracy theories! The source code is on Github so no need to mess with the apk. You may want to check that the source generates the .apk though. I'm not a fan of some things that have been done here but the new app is the right way to do it in my opinion. It's very, very simple and has no personally identifiable data involved. It's basically one simple rule of thumb that is good enough to semi-automate part of the C&T function. It is not good enough for your trade though and you should not use it at work.

Stay safe.


> Without privacy guarantees people don't use it.

The vast vast majority of people don't know anything about privacy guarantees and this does not factor into their decisions in any way.


To the contrary, contact tracers in many countries have been having a lot of trouble getting people to give up the names of their contacts, or even to answer contact tracers.

"Privacy" is not an abstract generic concept. It is context and consequence dependent.

When "contact data" has the monetary and social value associated with a mandatory 14-day quarantine, people accurately consider restrictions on future movement, not privacy. Those who don't, quickly learn the hard way or from a friend. They don't need the word "privacy", only "don't do that again".


> To the contrary, contact tracers in many countries have been having a lot of trouble getting people to give up the names of their contacts, or even to answer contact tracers.

Where I live people put their full names, email addresses and phone numbers happily down on on a piece of paper for everyone to see!

> "Privacy" is not an abstract generic concept.

It is to these people!


> Where I live people put their full names, email addresses and phone numbers happily down on on a piece of paper for everyone to see!

Did they? Ask your woman friends. I'll bet a _lot_ of them are using fake details. They have genuine threat models that the sort of people who decide "lets just have a piece of paper with everybody's name and phone number at the front door" never have to think about.


Give them a few months to experience mandatory quarantine even when symptom-free. Learning is fun!


> even when symptom-free

It's really unfortunate that much of the spreading of Covid-19 may be people with no symptoms, who believe incorrectly that because they have no symptoms, they don't have it, can't have it, present no risk to anyone and certainly aren't spreading the virus.

A friend tells me they have a friend who insists on hanging out because "I can't have it, I don't have any symptoms".


> Learning is fun!

I don't get why you're being so snarky - it's actually against the rules here.


It could be rephrased as "Learning is necessary"?

People are sharing names, email addresses and phone numbers based on assumptions and models of reality developed over many years, e.g. they have experienced zero observable consequences from all previous sharing of this information. Based on their historical observations, it's not illogical to continue sharing.

But policy has changed in 2020. Now the data goes into databases with a physical consequence: temporary blacklisting from work, play, school, travel, even non-essential medical treatment.

This is why people who have already been contact traced (they are already experiencing and learning the consequences) have been reluctant to give the names of their close contacts, because they know personally the consequences that will be imposed on their contacts, facilitated by their disclosure of contact names.

Until people have this first-hand learning experience, it's difficult to put the data in context. Most importantly, being contact traced does not mean they are sick or will get sick from the (possibly symptom-free and false-positive PCR test) contact being traced, yet they and their contacts would be asked to pay an expensive price.


It matters at least somewhat to 90% of the general public and is very important to almost 50%:

https://www.instituteforgovernment.org.uk/sites/default/file...

So no, you're extremely wrong.


People will say anything in response to a question.

What do people really care about and will actually action? Very different to what you think.

Turns out 99% will use Google and Facebook and crack on despite the tracking and not really care about it.


20% said after the Snowden revelations that the way they used their email changed "a great deal". You might have noticed that facebook engagement has completely collapsed while whatsapp (E2E encrypted, supposedly) popularity surged.

I mean, yes, I get the strong impression you don't care.


Facebook engagement did not collapse because of privacy concerns.

People stopped using it because it stopped being a good way to keep in touch with friends and instead became a Bazaare containing every single person you've ever met for a millisecond. People no longer felt connected, and gravitated to more curated communication channels where they could choose who they talk to.


Is even Facebook engagement collapsing? From my point of view, the main strength of facebook isn't even the friend networks. The main strength is that it has became a replacement for company websites. Many companies no wonder have a website or email you can contact them, all contact is done by Facebook.


You have any actual data backing up the claim about FB engagement? I don’t think there’s any validity to that


> 20% said after the Snowden revelations

I really struggle to believe that 20% of people have heard of Snowden in any meaningful way to form an opinion.

I'm picturing 20% of the people who live on my street. When I talk to them I don't get the impression most of them follow the news in that much depth. Many have been retired and zoned out from any kind of public life for many years. (Not a criticism - maybe they have other interests than me. Maybe they're happier than me for that?)

> I get the strong impression you don't care.

No, sorry you've imagine that out of nowhere. It isn't implied by anything I've said - I haven't talked about my personal beliefs at all.

I'm just a realist about what the people around me outside the tech and media bubble are reading and thinking.

Do you live on a street in the Valley with 100 Google engineers? Most people don't.


>I really struggle to believe that 20% of people have heard of Snowden

72% in the UK.

>Do you live on a street in the Valley

You don't... really believe in polling do you?


> You don't... really believe in polling do you?

People say all kinds of things in response to polling. That's why polling gets it wrong again and again. For example... the 2016 election.

Guess what: phone my 90 year old neighbours with a question about Edward Snowden... they aren't going to even pick up the phone!

Look at what people PRACTICALLY do rather than what they poll to do. You'll find it doesn't match.


> People say all kinds of things in response to polling.

That's correct. The US is currently conducting a poll to decide most of the composition of its government (including some local and many national political positions) and as you claim, the voters will say "all kinds of things".

But the answers stick anyway. Even though they say "all kinds of things" you live in a democracy and those "all kinds of things" decides the rules. Now, given that I'd be trying to maybe get them to say smarter things, but if you prefer to just smirk about it I cannot stop you.


> but if you prefer to just smirk about it I cannot stop you

I don't understand where this snark is coming from?

Am I saying something that you don't wish was true?

The reality is... most people out there don't care about privacy nor Snowden. The reality is most of them are trying to make enough to feed their families this week plus pay their bills and don't have the energy to think about anything else. I'm not smirking about it. I didn't express any opinion about it. I'm telling you the facts!

Are you assuming I think this is good? Where did you read that? You've imagined it!

You're confusing a reality check with an opinion on how I think things should be!


How... how wrong do you think the polls were in 2016? Clinton won the popular vote by 3 million votes, and Trump's electoral college victory was narrow.


> how wrong do you think the polls were in 2016?

This is a bizarre question. They predicted Clinton would win. She didn’t.


People in the UK are writing their names & mobile numbers down at the door to most restaurants now - just one big long piece of paper that everyone can read.

I'm sure people say it's important in the abstract, but not in practice, and not right now.


If it's anything like here in Sydney, people are writing some name and some phone number down. Every woman I know uses a fake name, and most of them are using fake numbers too.

Covid risks are _way_ lower here than risks of random creeps misusing names/numbers of women...

I'm less affected by those particular risks, but I still use a burner Twilio SMS number and a burner gmail address that doesn't get used for anything else, with plus addressing to help try identify where a leak happened. If that account starts getting spam to [email protected] or [email protected], I might get a smoking gun about who leaked it.

If the spammers are cleaning their lists of that well-enough-known email tracking trick and sending enough smtp to make the address a problem to use, I can just walk away from that gmail account and set up a new one.

I'm contemplating building an automated system of "rolling 4 week validity email addresses" that I can easily enough work out on-the-spot, perhaps month/week-of-month encoding so I'd use [email protected] this week (102 being october 2nd week) and only have the addresses live long enough for contact tracing purposes. Perhaps using something t5hat works the same as gmail's "plus addressing" but different enough that spammers list cleaning tools won't know about it. That'd involve running my own mail server though, and the risks here right now are so low (in the single digit cases per day in a city of 5million people) that I'm more motivated to just lie on the contact forms instead...


> It matters at least somewhat to 90% of the general public and is very important to almost 50%: https://www.instituteforgovernment.org.uk/sites/default/file...

From the linked web page: "sample size 1006 respondents". Given the UK population of around 68 million that seems a small sample.


The size of the UK population is irrelevant to the statistics. Absolute sample size determines the expected error, and a thousand people is plenty provided they are selected at random.


Assuming it was a properly conducted poll(I have no idea if it was or not), you get surprisingly accurate results with that sort of sample size.


I feel like we need to extend the laws we have that govern credit reporting agencies to these other businesses that aggregate personal data. Which hopefully will put them right out of business.


Are credit bureaus any better? I mean I know equifax messed up royally and I have no reason to believe that all the rest aren’t pushing on every conceivable limit of the law to maximise the profit to be made from information they scrape about me without my consent, then pay lip service to protecting it.


You can see your credit report, challenge information you think is incorrect. And there are restrictions on what information they can collect on you. You can lock your report as well. Some types of pulls require your signature.

None of these other grey market data collection firms have to do any of that. One thing I noticed is these guys are collecting data that would fall under HIPPA.

Go ahead do some searches for Hepatitis C and then look at your ads on Facebook.


This is also the case in Germany. It's why you have all sorts of different ID numbers, and need to sign documents to allow different offices to communicate.


I was staggered by how quickly these QR solutions were stood up. They aren't standardised and just take you to a webform and maybe a PDF of the drinks menu, but the speed was impressive.

Not surprised but still disappointed to learn that they're done by opportunist cowboys. Most things like this in Britain are.



It's likely contact tracing in public spaces will remain in place long after the virus: every time a new source of tracking data exist, they don't want to relinquish it because they find additional uses for it and this is especially useful for building social graphs.


DPAs really need to step in here and start enforcement actions. GDPR Art. 5 (1) b prohibits abusing data for another purpose, and hiding a "consent" for that somewhere in the T&C is not sufficient.

Also, due to the incredible damage such cases cause (people will provide fake data), there need to be severe penalty for such abuses - not just financial, serious jail time.

Edit to add: Art. 6 GDPR is pretty clear -processing data is legal only to the extent that one of the subclauses applies. a) Something hidden in T&C isn't valid consent, b) selling the data is not necessary to fulfill the contract (serving food), c) collecting the data is but selling the data isn't necessary for compliance with the contact tracing obligation, d) selling the data isn't necessary to protect the interests of the customer, e) there is no public interest in selling the data (quite the opposite!), leaving only f) legitimate interest. Anyone claiming that will likely learn that others disagree with this being a _legitimate_ interest that is not overridden by the data subject's right to privacy.


> there need to be severe penalty for such abuses - not just financial, serious jail time.

punishment for who? those making the poorly thought out policy or the restaurant / pub owners who suddenly see themselves as the nominated enforcers of these data collection activities? rule #1 should be not to collect data you don't have a safe way to process. GDPR or not this shouldn't even be collected.


> rule #1 should be not to collect data you don't have a safe way to process. GDPR or not this shouldn't even be collected.

My understanding was that the law, at least in England, required for this data to be collected and retained.


I honestly don't know much about Apple/Android implementations of QR code readers... Is there any fundamental issue with using one of these things to share a link to a menu or something? Many restaurants are trying to avoid menus it seems (which makes sense) and I could see a QR code making this easier for people.

I don't like the idea that my OS/browser history basically knows everything about me, but I don't really see how visiting a menu is a serious problem, given that the same systems also generally have my ___location data too... Is the concern that people who visit restaurants are much more likely to be spreaders of COVID? Could just looking at a menu (implying visiting the restaurant) be enough to implicate me of something?

I'm just left wondering in all this mess. Who watches the watchmen?


> Is there any fundamental issue with using one of these things to share a link to a menu or something?

There is no problem with making a QR code that links to a menu in PDF format and that would be private & secure. The problem is that the majority of those QR codes would link to a page on the restaurant's website where various trackers are embedded and Zuckerberg is not far away, and most people browse without private mode nor ad-blockers so their browser is known by those trackers.


The QR codes need to send you to a name & address form for contact tracing - that's why.

Scanning a code and putting in your name & address is mandatory at all eat-in places in the UK (or writing it down on a list).


Not quite, the restaurant is required to demand a QR scan or name & address, you are not required to tell the truth in responding (i.e., it is not a criminal offence to do so).


Yes, that is true :)

To build on that - It is also true that up to 2 weeks ago, the QR scan 'without giving your name and address' option was not an option and all solutions required giving your name & address.


In Spain most restaurants now have replaced menus by a QR code on the table. It just takes you to a static page or pdf with the menu, usually on their own website. There's no issue.

But also there's no contact tracing done that way.


One of the reasons QR codes don't get used much is people simply don't know how to scan them.


Indeed, and this is one classic problem of QR code adoption (in the US, at least), so it'll be interesting to see whether this trend of QR-code menus actually drives adoption.

See also: https://picturesofpeoplescanningqrcodes.tumblr.com/


Except unless one is an happy iPhone owner, chances are they don't have any means to scan QR codes on their phones.

Specially elderly people with their feature phones, or plain classic ones


I created during the last ~10 years ~80 email aliases for stuff that I bought on ~80 different websites (usually in the form of <my1stname_remotecompanyname@mydomain>) and I never even once received a single spam email on those addresses/aliases.

On the other hand, I received tons of spam email on my single generic email address (sometimes I'm "weak" because I don't want to login into my email admin GUI etc.. and I just use that generic/main address).

I therefore guess that whoever sells addresses and/or whoever generates spam does care about the email not being traceable to a single source? (they therefore do filter the lists that they have/get?)


I do the same thing with emails, I just wish there was a similar solution for phone numbers.

It's would be ideal for privacy as well, as phone numbers are frequently used to combine datasets across companies.


I use a similar technique. Both VMware and New Relic have sold/lost email lists to spammers in the past couple years.


Good reason not to visit pubs and restaurants which require reservations beforehand. This is not were my contact details are being collected fore. I think they private watchdog should look into this.


Is this about the new digital menus? (Paywalled for me)

Unbelievably, we went to a restaurant last weekend where there was absolutely no service so we had to use their WiFi to even see the drinks menu. Once connected, we had to go through a convoluted process to order and before even being able to place an order, I had to sign up for an account with the online service. This was before we could even order tap water. Food orders were done the regular way, with regular people, in person. They refused to take drink orders (including for water) any other way than online.

Last night my wife and I went out to dinner and neither of us brought our phones (for the first time in forever). It was great. They had to give us regular menus, like the good old days.


You're lucky they let you in. Many places I've seen have made the NHS one mandatory on the door now.


To clarify, it was at a small hotel where we were staying and we were tagged in generally (the restaurant only had a few diners all of whom were staying there too).


Don't use/carry phone in restaurants. Request paper menus, they almost always have them somewhere, or posted on a wall, no matter what the policy says. Reward a different restaurant if they don't. Voting with your feet has market power.


Well, paywalled. But not reading an article has never stopped me from commenting before! Haha!

I’m going to file this story:

third-party/corporate contract tracing apps sitting on mountains of valuable contact information ask themselves, what should we do with all this free milk?

...together with common _business_ practice from some US companies such as Walgreens and Target who require you to show ID for any purchase of alcohol or tobacco products no matter how old you are (prev age was less than 35). Of course they want to scan your ID for this, which gives them all this State processed and verified PII with extra data not related to age verification—-for free.

Recall in 2013 Target had a data breach of 40m user cc and debit card info.

There is some responsibility for protecting payment data (quick search says it cost Target $300m).

Data on your DL, AFAIK, is unregulated, so what is the consequences of mishandling your contact info?


[flagged]


That was about reporting to the government, which is, after all, more or less a legitimate use as a contact-tracing system.

The article is about it being sold to marketers and advertisers.


I wanted to show how the guy was downvoted for showing a legitimate concern, which turned out to be true hours later.

Everything will end up sold to someone someday. Just keep your info private.


> the guy

You mean planejane9?


Yes. Sorry for not being clear.


Sorry but I do not believe government tracing every contact I make is a "legitimate" government power

Further it is unlikely that these companies would have either even attempted, or if attempted would have gotten wide spread compliance with out government mandates they collect said info.

Government (as always) has created this problem


what's interesting is the question this reply is to.

it looks like lots of EU countries are requiring pub/restaurant owners now to collect guest lists and uhm "it goes down really really well with intoxicated punters /s". don't know who started it but politicians across EU seem to be copying the policy from one another in a desperate attempt to hide their incompetence.


I mean, it's contact tracing or a shutdown..


There's also the option of scientific or mathematical competence, instead of pandemic theater.

Contact tracing was historically used at the start of a disease outbreak where it can be 100% successful. It's nearly useless later, with only partial visibility due to widespread dispersion. Even a 7x24 Person of Interest panopticon could not trace every contact across urban populations.


> Contact tracing was historically used at the start of a disease outbreak

Correct me if I'm wrong - but that's only true due to the historical turnaround time of contact tracing. Even with many cases, contact tracing at the margin can reduce $R_t$. Even in the UK, until the last 2 weeks or so, there were very few cases relative to how many there are now. Especially since covid appears to spread through a disproportionate number of super-spreading incidents compared to say the flu (ie. very right-tailed distribution in the number of people you infect with covid) means that contact tracing can be particularly effective.


What PCR cycle threshold is being used for UK tests and what is the expected false-positive rate at that threshold? Any CT value above 30 is questionable, https://www.nytimes.com/2020/08/29/health/coronavirus-testin...

If contact tracing is relying on flawed input data (PCR "positive" for people without symptoms), how can we avoid societal DoS of medical resources, income, and school from unnecessary contact tracing?

Are there any theories on the root cause of specific people being "super spreaders"? Were those people symptomatic at the time of transmission? If not, how long was the asymptomatic transmission window when they were super-spreading, based on their traced contacts?

Historically, we quarantine the sick. Covid responses have quarantined the healthy, based on claims of pre-symptomatic transmission. If we can quantify an observed transmission window (2h? 1d?) in pre-symptomatic super spreaders, before viral load reaches a threshold that causes symptoms, then we can better estimate transmission risk.


Most of the evidence suggests that PCR specificity is very high - there are not many false positives. [0] Even if there were lots of false positives, the recent spike in cases in the UK can't be attributed to that because there is no reason the errors would be temporally correlated.

The concern over PCR cycle is that you will detect people who are not spreading the disease, but those people had the virus at some point. I'd like more evidence about this societal DoS - contact tracing doesn't take medical resources and unmitigated spread consumes more medical resources, mean discretionary income (in the US at least) is higher than before the pandemic.

> Are there any theories on the root cause of specific people being "super spreaders"?

Yes, there are quite a few papers on the fact that the large majority of Covid-19 spread is by a very small percentage of the people who are infected, moreso than other diseases.

[0]: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7457918/


From https://www.thelancet.com/journals/lanres/article/PIIS2213-2... (2020-09-29)

> To summarise, false-positive COVID-19 swab test results might be increasingly likely in the current epidemiological climate in the UK, with substantial consequences at the personal, health system, and societal levels.

Some examples from the article:

  - Unnecessary treatment cancellation or postponement
  - Potential exposure to infection following a wrong pathway in hospital settings as an in-patient
  - Financial losses related to self-isolation, income losses, and cancelled travel
  - Psychological damage due to misdiagnosis or fear of infecting others, isolation, or stigmatisation
  - Misspent funding (often originating from taxpayers) and human resources for test and trace
  - Funding replacements in the workplace
  - Increased depression and domestic violence
  - Misdirection of policies regarding lockdowns and school closures


Given what we've seen of the response, I'm afraid this might be an unrealistic expectation.


There are tried and true historical responses to the incompetence of a few affecting the lives of millions. Even when forgotten, history shows that populations have repeatedly reinvented those responses.

One effort: https://gbdeclaration.org/

Legal cases are underway in several countries. In one city, a $2B lawsuit against the city resulted in policy change the same week.


The fact that the notion of contact-tracing wasn't immediately met with howls of laughter and/or outrage is perhaps the most depressing aspect of 2020, a year with some extremely stiff competition in the "well, now, that's depressing" category.


No. The fact that we didn't enforce proper privacy controls with harsh penalties is the scandal.

Unless you're arguing we are innately incapable of doing that? That feels like defeatism.


Even if I thought that the corporate world could be controlled, which I don't, I admit complete defeat in expecting the intelligence community to obey any privacy requirements.


It's a tried and tested tool in fighting disease outbreaks. What else would we do?


It works if I’m just a number to the system though right?


When you're dealing with problems that are larger than your city district - and a global pandemic definitely qualifies - you're always just a number to the system. There is no other way.


Eh? Contract tracing has been effective in a bunch of countries. And the framework Apple and Google worked together on works great and protects privacy.

The problem is the government incompetence and/or malfeasance, not contract tracing itself.


> The framework Apple and Google worked together on works great and protects privacy.

Not so.

https://www.scss.tcd.ie/Doug.Leith/pubs/contact_tracing_app_...


I’m proud to say that so far I have refused to give any data away and when forced I used a fake name and fake phone number. Nobody should participate in this idiotic attempt of trying to control a virus. It’s impossible. The only way back to normality is herd immunity. It will have to happen sooner or later, through natural immunity, a vaccine or most likely a combination of both. I have it rather sooner than later. Only way back to normality is to start acting normal now. Everything else is madness. Also the people who make 100% of the sacrifices are working age adults and children, basically those who are virtually at no risk of dying from this virus. Feels plain wrong that people have to give up everything for nothing in return.


> Only way back to normality is to start acting normal now.

You can do that if you wish. Nobody is really stopping you in most countries.

I’m not joining you though. And I would bet that I am joined by enough people that normal cannot be achieved.


You already lost the bet judging by last six months. Will you still pay up?


Correct: working age adults and children, basically those who are virtually at no risk of dying from this virus.

Also correct and much more important: this virus can have incredibly deleterious effects on otherwise healthy people beyond killing them.

Just because it probably won't kill you doesn't mean it can't fuck you up. In fact I think I'd rather the virus kill me than leave me with permanent damage that destroys any quality of life.


What percentage of patients will have permanent damage that destroys any quality of life?


Any percentage is too high and a risk I'd rather not take. Other people's cavalier attitude towards limiting the spread, thus increasing MY risk of infection is what pisses me off most about this whole story.


By that logic no one should ever be allowed to do anything that exposes others to risk. Every time someone drives a car there's a percentage chance they'll run you over, leaving you crippled with no quality of life. It is unreasonable and unethical to expect others to protect you from all risk.


Nobody really knows yet. Check back in a year or so.


Why do we need to wait a year? There are already millions of people who have recovered from acute infections. If a large percentage are continuing to experience severe symptoms then where is the data?


The numbers are all over the place right now, but some studies are showing up to 50% of people seeing persistent issues (particularly abnormal fatigue). It's not clear yet if that's really what you'd call long-term, though; a lot of it may go away.


Which studies? Please provide a citation.


Nobody can possibly know if it's permanent, of course, but currently it's looking like about 10% of people don't completely recover.


Please provide a citation for that number.


yeah, keep acting normal, that's sure to bring back tourism and economies. broadway just cancelled all their shows until may of next year, a pure business decision, nothing to do with gov't policy.

i understand we're anxious and angry to return to a sense of normalcy, but make no mistake, it has nothing to do with sheer will. business cannot survive on the select few "choosing" to be reckless.

it will return when we get it under control and people's perceive risk (whether valid) goes down.


> nothing to do with gov't policy

Not true. If they were allowed to fill their theaters up, they'd probably have reopened already. The business decision to not reopen is because they can't be profitable with the vastly reduced capacity that the government is currently mandating.


look at any country with open policies. attendance at theaters and the like are at record lows. spending is down. broadway in NYC runs on tourism.

you might survive for a few months, but if the science is correct, you will just shut down again or people will be afraid to go. broadway can't afford to gamble like that.


Look at where exactly? The only equivalent to Broadway I know of is London's West End, and they don't have open policies.


> The only way back to normality is herd immunity.

Contract tracing seems to have worked out great in many countries. And you’re entirely discounting the possibility of a vaccine here. Given that a lot of people will have to die in order to achieve herd immunity (and the science isn’t even clear on exactly how many yet, nor on the long term implications for those that survive a COVID infection) I’m not sure blanket assertions are the wisest choice right now.


[flagged]


Maybe this is a US thing because the virus is so widespread but the guidance here in western Canada is definitely not “stay inside”. And it doesn’t help the cause to tell narcissists who want to live normal lives again that they can’t go outside. They can. They should wear a sufficiently protective mask to protect others, physically distance, and avoid groups and public indoor spaces. If you’re walking on a quiet street, or in a park, etc. you definitely don’t need a mask on. And you don’t need to hide inside, that’s paranoia.


I am explicitly telling the guy I replied to, who sounds like he both lives near me and doesn't exactly have an interest in keeping others around him from not dying, to stay inside.

It wasn't a message to everyone in general.


We now know for a fact that the world-wide IFR is 0.13%.[1]

It's time to give choice back to the people.

I'm not anti-anything. I'm pro-choice. I'm with you.

[1] - Monday Oct 05 the WHO announced there were 750 million cases of Covid worldwide (see tons of news sources). According to the official WHO tracker there have been 1 million deaths. 1 million divided by 750 million is 0.00133333 or 0.13% IFR.


The rest of us are pro-choice, too. We’re choosing to follow the guidance of our well respected public health officials. Even if you are totally free to choose (you are where I live in Vancouver) this doesn’t prevent businesses from being impacted by the majority decision to reduce virus spread by limiting dining out, etc.

The solution, and the inevitable return to normalcy will come when people feel protected. That can come with herd immunity, which is nearly impossible (NYC had excess deaths in the same range as the Spanish flu and only has 20% immunity in the population to show for it) or it can come with advanced treatment, therapeutics and at some point a vaccine.

This is a multi year process but the result will be a return to normalcy, as happened with the Spanish flu.


I think you’re in the minority, one that gets smaller and smaller daily. Downvote all you want.


3-in-4 Canadians say they would support a mandatory mask policy. Hope that gives you some perspective outside your bubble.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: