[Discussion][Solved] How a red alert turns into green alert.

[TeRe20200]

Hi everyone, I am writing on behalf of a friend of mine who encountered the following issue:

She had a red encounter pushed on her app on Monday, 7th of December, after a colleague of hers was diagnosed with Covid. (Said colleague had first symptoms on saturday, 28th, got tested a week after and got her results on monday 7th). My friend saw that colleague for the last time on friday, the 27th.
The Monday (7th of Dec.) alert my friend got was the following:

Today my friend got pushed another 2 encounters, which was very irritating, as no one else at work (and my friend strictly goes to work and then straight home) was diagnosed with Covid around her. The alert looked like this:

My friend knew that today at 8:30 pm her very first encounter would be erased from her log (as 14 days had passed) and as she checked per app, all the red logs were gone and she had two low risk encounters on her app:

This seems to be a very big bug, showing 2 low risk encounters as high risk encounters? How is this even possible?

[Ein-Tim]

Hey @TeRe20200

I'm not one of the developers/community managers here.

Thanks for reporting!

Please note that "Days since Encounter" in the High Risk Card are not correct:
corona-warn-app/cwa-documentation#422
The days shown there are the days since any encounter, also from Low Risk ones.

Also if you have a High Risk Encounter than there is the Quoute: "x Risiko Begegnungen", but there also Low Risk Encounters are included: corona-warn-app/cwa-wishlist#233.

---

So I think what happened here is that your friend had two High Risk encounters, the last was 10 days ago (as of 07th december) and also one Low Risk encounter.

The firs screen really shows:
2x Encounters with High Risk
1x Encounter with Low Risk

Today at the morning, one High Risk Encounter dropped out of the 14 days window and a low risk encounter, which happend 3 days ago, was found.

So what the second screen is really showing is:
1x Encounter with High Risk
2x Encounters with Low Risk

Now, today, between 16:29 and 20:32 the one Encounter with High Risk dropped out of the 14 days window, leaving back the 2 Encountes with Low Risk.

---

THIS IS ONLY AN ASSUMPTION

To confirm this, I would like to take a deeper look into this. Could you maybe ask your friend to export her EN-Log here?
This Log does not contain any private information, but the number of encounters.

She could also provide us her CWA Version and the iOS Version.

How to export Exposure Notificaiton Logs under iOS 13.7 or newer

German:

Einstellungen ➡️ Begegnungsmitteilungen ➡️ Status von Begegnungsaufzeichnungen ➡️ Begegnungsüberprüfungen ➡️ Überprüfungen exportieren

English:

Settings ➡️ Exposure Notifications ➡️ Exosure Logging Status ➡️ Exposure Checks ➡️ Export Exposure Checks

To upload the file here, rename it form .json to .txt

Thanks and have a nice evening!

[TeRe20200]

@Ein-Tim thank you so much for your quick reply and your very well written explanation.

As a matter of fact my friend was next to the colleague the whole week from monday, 23rd to friday, 27th. The colleague felt sick on saturday (28th), stayed home from then on and got her testresult more than 8 days later, on monday the 7th.
Just out of pure curiosity: What would the app have shown on monday the 7th receiving the red encounter? Just ONE red encounter with the information "10 days since last exposure" (as in friday)?

I am very curious what you will find out "what happened" , find it attached here. Thank you, once again, for spending your time on this issue. I forgot to ask abozt CWA and iOS -Version, as soon as I know, I will let you know.

Exposure.txt

[Ein-Tim]

Just out of pure curiosity: What would the app have shown on monday the 7th receiving the red encounter? Just ONE red encounter with the information "10 days since last exposure" (as in friday)?

Yes this is what should be shown...

[Ein-Tim]

Okay, I can share a detailed analysis if you like to tomorrow, but I can definetly say that the 2 encounters which are shown to your friend now are not the same encounters from the beginning. Everything is working correctly. @TeRe20200

[TeRe20200]

@Ein-Tim Please forgive me if I am asking stupid questions here, I just want to understand the following:
My friends colleague gets the positive result on the 7th and logs it in. In the past 14 days (counting from the 7th on) my friend saw said colleague on the 24th, 25th, 26th and 27th. Why doesn't the coronaapp log every daily encounter with her colleague as a new "Begegnung"? Because then it would have made sense that she got an alert that said "4 encounters, the last one 10 days ago". Didn't I read somewhere that the same person can give you more than one "encounter alerts"? Because what she can say for sure is that she only had ONE person that was tested positive around her for the last 14 days. So the very first screenshot in red with 3 exposures, last one 10 days ago must be ONE red exposure and 2 green ones - all pushed on the same day as the 10 days count back to friday where she saw the positive person for the last time.

And I find it very confusing, that once you get a red alert the green alerts ones can rise the number of encounters shown in red, because to my friend (and me) it looked like she had 3 red alerts, as we didn't know the number was including green alerts. This is very misleading to be honest....

[Ein-Tim]

@TeRe20200

Why doesn't the coronaapp log every daily encounter with her colleague as a new "Begegnung"?

It should have done this.
TBH I've asked myself the same question. If your friend was in close contact with the colleague, the App should min. have showed 4 encounters.
It could be that the ENF (the underlying API from Google/Apple) missed one contact day, decided that the two contact days were high risk and one was low risk.
Now the question is: Why did the ENF decide like this?
This question nobody can really answer...

---

Didn't I read somewhere that the same person can give you more than one "encounter alerts"?

Yes this is correct, see:

https://www.coronawarn.app/en/faq/#count_per_day

---

And I find it very confusing, that once you get a red alert the green alerts ones can rise the number of encounters shown in red, because to my friend (and me) it looked like she had 3 red alerts, as we didn't know the number was including green alerts. This is very misleading to be honest....

Yeah I know...
There is a open Issue in the Wishlist Repo about this: corona-warn-app/cwa-wishlist#233

But at least we will see an improvement reg. the days with the next release, 1.8.0. There the exact date will be shown and also this will be the date of the last risky (red) encounter, and not the date of any encounter.

[Ein-Tim]

So, here's what I found in the EN-Log:

Hash	Time	Matches	Meaning
93E9F0A2427C5EE94F8E48CCC41C45750742F88C6354A17EF94E4D5D12EF291F	2020-12-07 20:27:49	3	Hourly file, reporting 3 Encounters
1A9ED80561685CEC9DB933243156323CC2459659BEB46189B34A73D5A6480116	2020-12-09 14:35:45	3	Daily file reporting 3 encounters, which were already reported by the horuly file before
1A9ED80561685CEC9DB933243156323CC2459659BEB46189B34A73D5A6480116	2020-12-10 07:15:08	2	One Encounter drops out of the hash (older then 14 days)
1A9ED80561685CEC9DB933243156323CC2459659BEB46189B34A73D5A6480116	2020-12-10 23:23:20	1	Another encounter drops out of the hash (older then 14 days)
959FB0F3BA33AD3863866FC13CA028B48C14F2A9756EE619AC0DBFB7B7E4BFDC	2020-12-11 08:20:47	1	A new encounter comes in via a hourly file
10C19780EFADAB65554100F3A6ACA0C9552B0E9784538AA70303F639D36EFE4A	2020-12-11 16:29:09	1	Another new encounter comes in via a hourly file
1A9ED80561685CEC9DB933243156323CC2459659BEB46189B34A73D5A6480116	2020-12-11 20:32:10	0	The last known encounter from the beginning drops out of the 14 days window

---

I hope this table helps you to understand. 1A9ED80561685CEC9DB933243156323CC2459659BEB46189B34A73D5A6480116 is the hash from the beginning (3 Matches). As you can see all the encounters contained by this match drop out of the 14 days window...
The encounters shown now are all new ones.
Please note that this table is only showing the relevant changes.

---

So as you can see, everything is working correctly here. If you are happy with the answer, please close this Issue.

[ndegendogo]

@TeRe20200 I have just looked at the exposure log file you posted.
Just a hint how to read it - the newest entries are shown at the top, so if you want to read it in chronological order, then you start at the bottom).

On 27 Nov 19:37 we see 1 match. Note that 19:37 is timestamp of the check, not of the encounter (just to avoid any misunderstanding). From the log file we cannot tell if red or green (but as you have not reported any red warning on that day, we assume this is green). It is contained in an hourly file with hash=40CC.. and 1449 keys in total.
Next day and all the following days we see the same match, now in a daily file (hash=8756..., with 20078 keys). We see it on 07 Dec 04:19 the last time. At 08:21 it is gone.
Now comes the interesting part. Same day 07 Dec at 20:27 we see 3 matches in an hourly file (hash=93E9.., key count=955). From your report this is the red warning. The app counts every day separately, and cannot distinguish if it is the same person or a different. However, I assume that all three are related to this collegue, and maybe all three red. The latest (most recent) 10 days ago, as shown on your screenshot.
Why not 4? I think the 4th was already 14 days old and therefore not shown.
Next day these three appear in a daily file (hash=1A9E.., key count=14913), then start to drop out in the evenings. On 10 Dec evening only one is left.
On 11 Dec 08:20 a new match appears, then at 12:24 another. So total number is 3 now, as shown on your second screenshot. Overall risk score is still red.
In the evening the last red fades out (14 days old), and now we know that the other two are green, because the total risk score is green now.

@Ein-Tim you were faster than me to answer 😊

[dsarkar]

Dear @TeRe20200, @ndegendogo, @Ein-Tim, and community

@TeRe20200, thank you for posting your question here. @ndegendogo and @Ein-Tim did a great job analyzing it. We think this issue is solved now, however, we would suggest not to close this nice example for future reference and better visibility.

Best wishes,
DS

---

Corona-Warn-App Open Source Team

[ndegendogo]

With the hourly files there is so much more transparency what is going on. With daily files only this level of detail would just not be possible.
I appreciate this a lot.

[TeRe20200]

@Ein-Tim & @ndegendogo
Thank you A LOT for helping me and my friend to understand the issue - thank you for your quick answers and your time.

[heinezen]

Since the questions here were all answered and the information in the thread becomes more and more outdated, I will close this issue.

Thank you everyone for participating

---

Corona-Warn-App Open Source Team