[Goose]

I couldn't agree more.  I do sympathize a bit with the current owners of these systems, having been exposed to state information systems and the organizations that run them early in my career, back in the mid 90s.  These systems are ancient and full of technical debt.  Resources and talent are scarce.  I could see my way to excusing the fact that a bug occurred and that it did not cause technical alerts or error logs.

I myself have been "exposed" to DOD systems that are even older. However, CalREDIE isn't that ancient. It was brought online on January 4, 2010.
https://www.cdph.ca.gov/Programs/CID/DCD...rview.aspx
At least it (probably) wasn't written in COBOL. My experience is that anything involving personal data has all kinds of audit trails as to who entered what and when. I still can't believe that nobody at CalREDIE knew that data was being rejected. It may be that for whatever reason that fact didn't flow up the chain, or something similar. I really hope we find out what actually happened, but I doubt we will.

But I cannot excuse ANY of the following:

a) Not having cross-checks and compensating controls in place when the workaround went in place on July 25. Everyone should have been on high alert and scrutinizing the data after that.

b) Not questioning the reported data for the last couple weeks, when even casual observers on this board could clearly see that the trends defied reason.

c) Learning of the magnitude of the problem on Monday - which is already ridiculous, given (a) and (b) above - and only having a fix by Saturday or Sunday (if that actually comes through...)

d) Not having just one error, but multiple errors (i.e., expired security certificate).  Who knows how many more errors are lurking?  

Totally agree. The level of incompetence is staggering, especially given that they have be at this for months.

I'd also be on-board with frequent, statistically valid samples of public employees in each county as a better indicator of prevalence than what we have now.  If you just take a small number of people, you can return the results much more quickly. It really doesn't help anyone to receive results that are more than a few days old. But it would help us to know in near real-time where the virus is surging and waning.

Not going to happen, for good reasons. First, public employees aren't "typical". They don't represent the public at large or anything like it. Second, in Santa Clara County the prevalence of the disease is minuscule (relatively). Even at 200 positive tests per day, the number of people who would test positive in a sample of 1000 people is about 1.4(assuming a 14 day positive interval). If you get 0 in your 1000 tests, what does that tell you? If you get 2, what does that tell you? Almost nothing. Testing a smaller number of people will most of the time result in 0 or 1 positive. 1000 additional tests is not a drop in the bucket either, given our testing issues. On top of that, the minuscule number of cases are not randomly distributed. They exist in "pockets" of infection. Finding those pockets in a county of 2 million people is difficult/impossible. That is what contact tracing should do, but apparently we can't do that either.

[Goose]

I couldn't agree more.  I do sympathize a bit with the current owners of these systems, having been exposed to state information systems and the organizations that run them early in my career, back in the mid 90s.  These systems are ancient and full of technical debt.  Resources and talent are scarce.  I could see my way to excusing the fact that a bug occurred and that it did not cause technical alerts or error logs.

I myself have been "exposed" to DOD systems that are even older. However, CalREDIE isn't that ancient. It was brought online on January 4, 2010.
https://www.cdph.ca.gov/Programs/CID/DCD...rview.aspx
At least it (probably) wasn't written in COBOL. My experience is that anything involving personal data has all kinds of audit trails as to who entered what and when. I still can't believe that nobody at CalREDIE knew that data was being rejected. It may be that for whatever reason that fact didn't flow up the chain, or something similar. I really hope we find out what actually happened, but I doubt we will.

But I cannot excuse ANY of the following:

a) Not having cross-checks and compensating controls in place when the workaround went in place on July 25. Everyone should have been on high alert and scrutinizing the data after that.

b) Not questioning the reported data for the last couple weeks, when even casual observers on this board could clearly see that the trends defied reason.

c) Learning of the magnitude of the problem on Monday - which is already ridiculous, given (a) and (b) above - and only having a fix by Saturday or Sunday (if that actually comes through...)

d) Not having just one error, but multiple errors (i.e., expired security certificate).  Who knows how many more errors are lurking?  

Totally agree. The level of incompetence is staggering, especially given that they have be at this for months.

I'd also be on-board with frequent, statistically valid samples of public employees in each county as a better indicator of prevalence than what we have now.  If you just take a small number of people, you can return the results much more quickly. It really doesn't help anyone to receive results that are more than a few days old. But it would help us to know in near real-time where the virus is surging and waning.

Not going to happen, for good reasons. First, public employees aren't "typical". They don't represent the public at large or anything like it. Second, in Santa Clara County the prevalence of the disease is minuscule (relatively). Even at 200 positive tests per day, the number of people who would test positive in a sample of 1000 people is about 1.4(assuming a 14 day positive interval). If you get 0 in your 1000 tests, what does that tell you? If you get 2, what does that tell you? Almost nothing. Testing a smaller number of people will most of the time result in 0 or 1 positive. 1000 additional tests is not a drop in the bucket either, given our testing issues. On top of that, the minuscule number of cases are not randomly distributed. They exist in "pockets" of infection. Finding those pockets in a county of 2 million people is difficult/impossible. That is what contact tracing should do, but apparently we can't do that either.