Bluetooth Low Energy is unsuitable for COVID-19 contact tracing, say inventors

[Syntax Error]

@cdev : The UK goverment has overcome this problem by telling it's citizens to return to work AND to avoid using public transport. Easy... if you can afford to pay the parking fines which are still being enforced.

With regard to the BLE tracking apps, I would like to know just how many concurrent connections a BLE app can handle. I know the manual says upto 20, but in the real world with everyone milling about like zombies in face masks?

[SilverSolder]

@cdev : The UK goverment has overcome this problem by telling it's citizens to return to work AND to avoid using public transport. Easy... if you can afford to pay the parking fines which are still being enforced.

With regard to the BLE tracking apps, I would like to know just how many concurrent connections a BLE app can handle. I know the manual says upto 20, but in the real world with everyone milling about like zombies in face masks?

BLE is an unstable mess, IME.  I worked on a project once that used BLE to communicate with some hardware...  every version of the OS behaved slightly differently, connections were randomly dropped and reappeared, etc. etc. -   it all fueled the deep hatred for everything Bluetooth that I still harbour today!

[cdev]

A couple of years ago I went around to all my computers and physically disabled the bluetooth on my own computers. But I didn't remember the exact reason why until a search here jogged my memory..

https://www.eevblog.com/forum/microcontrollers/major-bluetooth-security-issue-blueborne/msg1300894/#msg1300894

Bluetoooth has serious security flaws that seem to be able to result in attackers being able to completely pwn a machine..

https://www.bleepingcomputer.com/news/security/blueborne-vulnerabilities-impact-over-5-billion-bluetooth-enabled-devices/

This article claims that 5 BILLION devices are vulnerable. Basically all bluetooth devices.

This is why I literally almost never use it anymore. To the point of having taken steps to disable it so it literally cant be turned on.  On older hardware (all of my hardware, basically, at that point, and I have not bought new)  that they refuse to fix, the security issue seems to be that bad.

@cdev : The UK goverment has overcome this problem by telling it's citizens to return to work AND to avoid using public transport. Easy... if you can afford to pay the parking fines which are still being enforced.

With regard to the BLE tracking apps, I would like to know just how many concurrent connections a BLE app can handle. I know the manual says upto 20, but in the real world with everyone milling about like zombies in face masks?

BLE is an unstable mess, IME.  I worked on a project once that used BLE to communicate with some hardware...  every version of the OS behaved slightly differently, connections were randomly dropped and reappeared, etc. etc. -   it all fueled the deep hatred for everything Bluetooth that I still harbour today!

It's a security nightmare.

This quote is from 2017

With a buffer overflow in the bluetooth kernel module, you can execute code to modify kernel data structures.

Read their technical white paper, each exploit is discussed in detail with offending code snippets from the OS stack source / disassembled stack binaries.

I read the technical paper, well, skimmed to the best of my attention span; Bluetooth is tough for the very reasons this hack exists it doesn't use a separate layer like TCPIP it just has all the packing and protocols built in - super dumb, kinda hard to follow. Anyhow, I am STILL not seeing how BT data is becoming OS level instructions. He talks about how the linux kernel is particularly susepible to this exploit because you will have some awareness of the kernel calls and structures.

I guess my issue is I'm coming from Bluetooth modules that run their own stacks and the host CPU just interfaces, almost never applications where the host CPU is running the BT stack itself. That said... since a lot of the hack involves L2CAP, and BLE uses the same L2CAP as BT, I wonder if low energy exploits may be coming.

[Zero999]

We also need good old fashioned contact tracing, which involves manually finding those who've had close contact with an infected person, testing them and isolating them if they're positive. The app might be able to help with that, but it's not a magic bullet.

[cdev]

I don't know about the situation in the UK, but it seems likely to be similar to here.

TRUMP - 'When you test, you have a case. When you test, you find something is wrong with people. If we didn't do any testing we would have very few cases'.

See it in context:
https://twitter.com/atrupar/status/1261017121078861826

[Zero999]

I don't know about the situation in the UK, but it seems likely to be similar to here.

TRUMP - 'When you test, you have a case. When you test, you find something is wrong with people. If we didn't do any testing we would have very few cases'.

See it in context:
https://twitter.com/atrupar/status/1261017121078861826

I honestly don't want to get into politics.

I hope the authorities in the US are ignoring everything Trump says about COVID-19.

China is currently doing very well to control the outbreaks through testing and contact tracing, even though most of the social distancing measures have been scrapped. They're testing 1 million per day in Wuhan, over ten times the entire UK.

I believe the UK government want to increase testing and contact tracing, so the lockdown can be gradually eased, without a massive increase in cases. Unfortunately I doubt the infection rate has reduced to a level which can be controlled by the current testing and contact tracing capacity. Hopefully the current R₀ is well below 1 and the tiny increase due to the recent slight relaxation will not raise it above 1 before testing and contract tracing capacity catches up.

I think contact tracing could be more important than testing in bringing the R₀ down, without a lockdown. If those who have had close contact with someone who's shown COVID-19 symptoms, can be traced and isolated for at least 7 days, it should mitigate most of the spread. The contact tracer will judge who needs to isolate and who doesn't, based on risk factors such as the closeness and duration of the contact. For example if I develop a fever and have recently visited my nephews, aged 6 and 8, the whole family will probably have to self-isolate, where as one of my colleagues, who I don't work that closely with, might not have to. Testing would be good to cut down on the numbers who are unnecessarily isolating, but we should be able to drastically reduce the spread without testing lots of people, or isolating everyone, just by contact tracing.

[David Hess]

China is currently doing very well to control the outbreaks through testing and contact tracing, even though most of the social distancing measures have been scrapped. They're testing 1 million per day in Wuhan, over ten times the entire UK.

China *says* that but given how duplicitous they have been and the independent reports which contradict  them, why should they be believed?

[cdev]

I believe the UK government want to increase testing and contact tracing, so the lockdown can be gradually eased, without a massive increase in cases. Unfortunately I doubt the infection rate has reduced to a level which can be controlled by the current testing and contact tracing capacity. Hopefully the current R₀ is well below 1 and the tiny increase due to the recent slight relaxation will not raise it above 1 before testing and contract tracing capacity catches up.

I think contact tracing could be more important than testing in bringing the R₀ down, without a lockdown. If those who have had close contact with someone who's shown COVID-19 symptoms, can be traced and isolated for at least 7 days, it should mitigate most of the spread. The contact tracer will judge who needs to isolate and who doesn't, based on risk factors such as the closeness and duration of the contact. For example if I develop a fever and have recently visited my nephews, aged 6 and 8, the whole family will probably have to self-isolate, where as one of my colleagues, who I don't work that closely with, might not have to. Testing would be good to cut down on the numbers who are unnecessarily isolating, but we should be able to drastically reduce the spread without testing lots of people, or isolating everyone, just by contact tracing.

It's labor intensive when you have screwed up at the beginning as we have. If you look at the US, subtracting the area that I am in, where the new infections are falling, its still rising quite a bit.

The only reason the graph for the US seems to have leveled off is the NY Metro Area reductions. So it is entirely bad policy to relax restrictions now.

So we here in the US cant say we leveled the curve because we haven't.  I bet the same thing applies to the UK.  I saw pictures of people riding the London Underground and buses without masks, lots of people crammed in.  A number of other countries relaxed restrictions and new cases started to soar again, so that has turned out to have been a mistake for them. Lots and lots of new cases, fast.

There is no reason to think it would be any different in the UK or US.

[Marco]

A number of other countries relaxed restrictions and new cases started to soar again, so that has turned out to have been a mistake for them. Lots and lots of new cases, fast.

I think most countries have decided to accept Swedish infection/death rates so they can have an economically feasible level of distancing and containment measures are just window dressing.

[Zero999]

China is currently doing very well to control the outbreaks through testing and contact tracing, even though most of the social distancing measures have been scrapped. They're testing 1 million per day in Wuhan, over ten times the entire UK.

China *says* that but given how duplicitous they have been and the independent reports which contradict  them, why should they be believed?

True, but there doesn't seem to be any evidence they're lying either. They aren't any signs that it's getting out of control such as hospitals packed full of COVID-19 patients, or bodies piling up, like they were before.

The Chinese are used to this. They've done it before and once the government finally realised it was a problem they seem to have being dealing with it quite well. It's highly likely the higher levels of the government weren't aware of it, at the start when the local authorities were trying to hide it. The fact the authorities know exactly where the current coronavirus clusters are, indicates they've been testing and are able to deal with them.

I know China gets bashed a lot by westerners and often quite rightly so, but I believe they're more able to deal with this more effectively than most western governments.

I believe the UK government want to increase testing and contact tracing, so the lockdown can be gradually eased, without a massive increase in cases. Unfortunately I doubt the infection rate has reduced to a level which can be controlled by the current testing and contact tracing capacity. Hopefully the current R₀ is well below 1 and the tiny increase due to the recent slight relaxation will not raise it above 1 before testing and contract tracing capacity catches up.

I think contact tracing could be more important than testing in bringing the R₀ down, without a lockdown. If those who have had close contact with someone who's shown COVID-19 symptoms, can be traced and isolated for at least 7 days, it should mitigate most of the spread. The contact tracer will judge who needs to isolate and who doesn't, based on risk factors such as the closeness and duration of the contact. For example if I develop a fever and have recently visited my nephews, aged 6 and 8, the whole family will probably have to self-isolate, where as one of my colleagues, who I don't work that closely with, might not have to. Testing would be good to cut down on the numbers who are unnecessarily isolating, but we should be able to drastically reduce the spread without testing lots of people, or isolating everyone, just by contact tracing.

It's labor intensive when you have screwed up at the beginning as we have. If you look at the US, subtracting the area that I am in, where the new infections are falling, its still rising quite a bit.

The only reason the graph for the US seems to have leveled off is the NY Metro Area reductions. So it is entirely bad policy to relax restrictions now.

So we here in the US cant say we leveled the curve because we haven't.  I bet the same thing applies to the UK.  I saw pictures of people riding the London Underground and buses without masks, lots of people crammed in.  A number of other countries relaxed restrictions and new cases started to soar again, so that has turned out to have been a mistake for them. Lots and lots of new cases, fast.

There is no reason to think it would be any different in the UK or US.

Yes contact tracing is a lot of hard work but it's certainly more cost effective and easier than the alternatives.

I agree it's a bad policy to reduce restrictions without any clear plan of how to prevent a second wave.

If we don't have sufficient testing capacity one possible solution is test pooling. A large number of samples are taken, some of each pooled together and tested. Each sample only needs to be tested, if the pool tests positive, thus cutting the number of tests required.
https://www.thelancet.com/journals/laninf/article/PIIS1473-3099(20)30362-5/fulltext

[SparkyFX]

China *says* that but given how duplicitous they have been and the independent reports which contradict  them, why should they be believed?

They don't want their people to die and having to bear the associated political implications?

[Syntax Error]

China *says* that but given how duplicitous they have been and the independent reports which contradict  them, why should they be believed?

They don't want their people to die and having to bear the associated political implications?

Tiananmen Square 1989

[David Hess]

True, but there doesn't seem to be any evidence they're lying either. They aren't any signs that it's getting out of control such as hospitals packed full of COVID-19 patients, or bodies piling up, like they were before.

Evidence from doctors and journalists who China has been persecuting for revealing what has been happening?  Who is left to report?

They don't want their people to die and having to bear the associated political implications?

That is a laugh.  Their only political considerations are maintaining order (suppressing unrest) and maintaining their reputation with other nations.  The next best thing to controlling an epidemic is advertising that you are.

[SparkyFX]

Tiananmen Square 1989

students protesting for changes in the government != all sorts of people (including party members) die from an illness
I reckon there is no secret second source of information and they can not afford to misinform themselves about this one. A virus simply makes no distinction what the infected person believes. Especially as China can benefit from international support, therefore involvement of the WHO and them keeping track of developments. Politicizing science is usually a bad idea - as well as media hyping it (to some extent),

That is a laugh.  Their only political considerations are maintaining order (suppressing unrest) and maintaining their reputation with other nations.  The next best thing to controlling an epidemic is advertising that you are.

One mans suppression of unrest is another mans way to work in the sense of a greater good. Not every unrest is a good thing/has a positive outcome, or would make sense in case of a pandemic... you can't protest a virus. I think we agree that the methods they used make a difference to western countries, but well, this is how China operates and they won't change that overnight. Sure this is all up to interpretation, i think that initially some authorities were trying to address the spread of unconfirmed information to avoid a panic while this unfolded. This is one of those cases in which a bureaucracy was faced with something for which no way of confirming it existed, which leads to wrong decisions.

Which brings us back to the topic, if Bluetooth devices are suitable to do contact tracing or if it is just a hastily propagated pseudo-solution. There are other ways to leverage the benefits of the information age, that might have bigger impact, like digital transfer of documents, test status and so on to help people get along, but also have a potential for abuse or privacy issues.

[julianhigginson]

Yeah, but this is a virus. It doesnt work like radioactivity or as a aura around people. That 1.5m rule they say everywhere is better than nothing but it is not even close to modeling all the transmission methods. You can spend probably hours within 1.5m from someone, and turn up fine, if you are facing the opposite way. On the other hand if someone sneezes at you from 10m, you might get what they have. Or you touch a door knob, that someone infected touched a day ago.
Or they grab a bottle of milk, that you buy, put in the fridge, the virus goes to sleep mode, and reactivate itself two weeks later.
So I guess bluetooth should track these as well.

There is a way for mobile phones to help in this situation. Build in an infrared temperature meter, to quickly measure forehead temperature.

My point is that something DOES NOT have to be perfect or work in 100% of cases to still be valuable. 

At the end of the day it's not specific performance of the tool in specific individual cases, but if rolled out over a population it allows R0 to be brought down lower than it would be otherwise.

If all it turns out to do is create a bunch of bad possible transmission links that prove to be a waste of time to the tracing effort, then sure, stop using it.. but that would want to be borne out of real data.... My expectation is that because it's  capturing links to people you have been near for extended periods of time, it could be very useful.

[julianhigginson]

It's a security nightmare.

This quote is from 2017

Blueborne is old news. Do you think anything new still has these vulnerabilities at a level that will cause practical risk to an everyday user?

If anything, it's just one more reason to make sure hardware manufacturers need to be forced to build critical security issue update support into their prices.
https://duo.com/decipher/an-analysis-of-blueborne-bluetooth-security-risks

I really don't see blueborne as any kind of modern reason to leave bluetooth turned off these days unless you have a very specific reason to do so. In fact the only time I ever hear of it these days is when my old music scene friend from years ago keeps banging on about it on facebook as a reason why all wireless communications is faulty spyware and 5G needs to be stopped.

And unfortunately, pretty much anything to do with any device running a general purpose OS is a security nightmare.

Check out what was just discovered about thunderbolt (fundamental issue for at least all of the TB1-3 interfaces) if you want scary.
Any computer with a thunderbolt port turned on is now up for evil maid attacks.
And there's no bios fix to be had, it's a fundamental fault with the direct RAM access that a fast port like this needs to be able to work
https://thenextweb.com/security/2020/05/11/theres-a-new-thunderbolt-bug-check-if-your-computer-is-affected/

or look at the latest issues around iOS exploits  - exploit vendors have stopped offering $ for them for now, as they have too many.
https://www.theregister.co.uk/2020/05/14/zerodium_ios_flaws/

[Zero999]

True, but there doesn't seem to be any evidence they're lying either. They aren't any signs that it's getting out of control such as hospitals packed full of COVID-19 patients, or bodies piling up, like they were before.

Evidence from doctors and journalists who China has been persecuting for revealing what has been happening?  Who is left to report?

We're not talking about an individual, like a child who you won't believe because they lied about doing something naughty, but they say they're honestly telling the truth this time, so you should believe them. All governments are multilayered. It's possible the local authorities covered it up and the national government were ignorant at the start of the crisis, but when they found out they dealt with it. This is like a teacher not telling the head about a group of pupils' bad behaviour, because the fear they'll get into trouble for not being able to deal with them, but once the head found out there were behavioural problems in the class, they dealt with the culprits and are keeping an eye out for any troublemakers who slipped through the net.

China has changed a lot since the last 40 years. It's not a democracy, but it's no longer a completely closed society. Information leaks out of the country, whether the government likes it or not. If the coronavirus situation is getting out of control again then there would be plenty of reports about it, as there were before, in spite of the cover up. The fact that this time the Chinese have admitted that there are new outbreaks of COVID-19, rather than covering it up as they did previously, suggests they're not lying about it now.

Yeah, but this is a virus. It doesnt work like radioactivity or as a aura around people. That 1.5m rule they say everywhere is better than nothing but it is not even close to modeling all the transmission methods. You can spend probably hours within 1.5m from someone, and turn up fine, if you are facing the opposite way. On the other hand if someone sneezes at you from 10m, you might get what they have. Or you touch a door knob, that someone infected touched a day ago.
Or they grab a bottle of milk, that you buy, put in the fridge, the virus goes to sleep mode, and reactivate itself two weeks later.
So I guess bluetooth should track these as well.

There is a way for mobile phones to help in this situation. Build in an infrared temperature meter, to quickly measure forehead temperature.

My point is that something DOES NOT have to be perfect or work in 100% of cases to still be valuable. 

At the end of the day it's not specific performance of the tool in specific individual cases, but if rolled out over a population it allows R0 to be brought down lower than it would be otherwise.

If all it turns out to do is create a bunch of bad possible transmission links that prove to be a waste of time to the tracing effort, then sure, stop using it.. but that would want to be borne out of real data.... My expectation is that because it's  capturing links to people you have been near for extended periods of time, it could be very useful.

Yes, that is what I've being saying all a long. Contact tracing isn't new. It existed long before smartphones and has other applications than controlling infectious diseases. If there's an outbreak of food poisoning then contact tracing is one of the tools used used to find the source, such as a rat infested restaurant or a supermarket selling out of date food. The app is just another tool in addition to the usual detective work.

Hopefully the authorities were investing heavily in manual contract tracing, not just the app, but training thousands of people to do it, whilst the economy was put into an induced coma. If controls are relaxed before there's sufficient capacity to control the infection, then it'll just flare up again. Some countries are doing better than others, which is partly down to geographical factors, as well as the competence of the governments. More isolated countries, who locked down earlier in their epidemics will stand a higher chance of a better outcomes, than those who are international hubs.

[cdev]

All of my hardware is pre 2017 hardware - which isnt that old, is still so old the manufacturers who wants to sell new hardware didn't upgrade its FIRMWARE, instead saying that EOL hardware wont be fixed. So BT got turned off and it stays off. Only Linux hardware has been kept current. I had the freedom to turn off Bluetooth in all my devices, so I have.

Why don't they use high res CCTV inside of subways/busses? Thats really the only way to do what they want that has any chance of being even remotely accurate.

It's a security nightmare.

This quote is from 2017

Blueborne is old news. Do you think anything new still has these vulnerabilities at a level that will cause practical risk to an everyday user?

If anything, it's just one more reason to make sure hardware manufacturers need to be forced to build critical security issue update support into their prices.
https://duo.com/decipher/an-analysis-of-blueborne-bluetooth-security-risks

I really don't see blueborne as any kind of modern reason to leave bluetooth turned off these days unless you have a very specific reason to do so. In fact the only time I ever hear of it these days is when my old music scene friend from years ago keeps banging on about it on facebook as a reason why all wireless communications is faulty spyware and 5G needs to be stopped.

And unfortunately, pretty much anything to do with any device running a general purpose OS is a security nightmare.

Check out what was just discovered about thunderbolt (fundamental issue for at least all of the TB1-3 interfaces) if you want scary.
Any computer with a thunderbolt port turned on is now up for evil maid attacks.
And there's no bios fix to be had, it's a fundamental fault with the direct RAM access that a fast port like this needs to be able to work
https://thenextweb.com/security/2020/05/11/theres-a-new-thunderbolt-bug-check-if-your-computer-is-affected/

or look at the latest issues around iOS exploits  - exploit vendors have stopped offering $ for them for now, as they have too many.
https://www.theregister.co.uk/2020/05/14/zerodium_ios_flaws/

[cdev]

Are they actually contract tracing?

An inaccurate Blutooth App is actually a good way to guarantee that their staff is flooded with inaccurate, noisy information probably guaranteeing they dont have time to do the real contact tracing that might be called for.

If they took high resolution CCTV of all those places where people are crammed together, that would be helpful. Also they should only allow as many people on busses and subway cars as can stand safety some modest distance away from others not talking while trying to breath shallowly. Otherwise, as somebody who has commuted a very large chunk of my life, its just impossible.

Worst was when the World Cup was being held right near my workplace.

[Zero999]

I hope they are contact tracing. Yes CCTV is a good idea, perhaps using automatic image recognition could help, although that could cause privacy concerns. Not everywhere has CCTV though.

Another possibility is making people show ID before they go onto a bus or train where social distancing is difficult, then they can be contact traced if someone sitting close to them tests positive.

Looking into this more, I don't think contact tracing alone will be enough to control the virus. There will still need to be significant social distancing in place until we either have a vaccine or sufficient herd immunity gradually develops naturally. It's just too easily spread via asymptomatic carriers to trace everyone. There will be perodic flare-ups followed by containment via lockdowns. Contact tracing will just help to find the flare-ups so the lockdowns can be more localised.

[cdev]

The risk of catching the virus is very low outdoors.
https://www.nytimes.com/2020/05/15/us/coronavirus-what-to-do-outside.html

Its thousands of times higher indoors.

But GPS does not work indoors and Bluetooth both doesnt work for determining location or distance, and its a security + privacy nightmare.  Also old hardware wont be upgraded so those problems are baked in.

[Zero999]

The risk of catching the virus is very low outdoors.
https://www.nytimes.com/2020/05/15/us/coronavirus-what-to-do-outside.html

Its thousands of times higher indoors.

But GPS does not work indoors and Bluetooth both doesnt work for determining location or distance, and its a security + privacy nightmare.  Also old hardware wont be upgraded so those problems are baked in.

Yes it's true the risk of catching the virus outdoors is low and is why many countries have loosened the rules governing outdoor activity such as allowing fishing and golf clubs to open, providing certain conditions are met.

GPS doesn't have to work indoors to be effective. Knowing that an infected person visited a certain premises or took a bus, within the last 7 days is all that's needed most of the time. It's true it's not effective in underground situations such as the Tube, but there are plenty of other instances when it will work, such as catching a bus or walking from the car, across the car park to a supermarket.

Bluetooth doesn't have to accurately determine distance. The user just needs to know it's likely they've been in the vicinity of an infected person, so should self-isolate and preferably get tested. As long as the virus is at a manageable level, it won't even matter that much if it generates a relatively large number of false positives, there will still far fewer people stuck at home, than there would be in a lockdown.  It doesn't matter if not everyone uses it, as long as on average, it prevents one person infecting someone else.

We're not epidemiologists and I doubt the developers are either, so we can't form reliable opinions on how well or not it will work in real life. It's definitely worth a try. Any intervention in disease control has costs and risks, which is why extensive in-field testing is required to determine whether they're worth the benefits.

[cdev]

Where its accurate, the risk of infection is almost zero.

Where its inaccuate, or unavailable, the risk of infection is high. That doesn't make sense to me, does it to you?

[julianhigginson]

well, here's the biggest argument against the app in Australia that I've seen so far.
I'm keeping it on my phone for now, but not sure how much longer if they can't manage to integrate the data with the rest of the contact tracing system they have...

https://www.theguardian.com/australia-news/2020/may/19/nsw-and-victoria-are-unable-to-use-covidsafe-apps-data-for-contact-tracing

[SilverSolder]

well, here's the biggest argument against the app in Australia that I've seen so far.
I'm keeping it on my phone for now, but not sure how much longer if they can't manage to integrate the data with the rest of the contact tracing system they have...

https://www.theguardian.com/australia-news/2020/may/19/nsw-and-victoria-are-unable-to-use-covidsafe-apps-data-for-contact-tracing

"Digital Transformation Agency"  LOL