Govt releases contact tracing app – Expert Reaction

The New Zealand Government has released a contact tracing app to help people keep a record of their movements amidst Alert Level 2.

The announcement comes after weeks of uncertainty regarding when, and if, it would arrive and what technology would be employed.

The SMC asked experts to comment on the app.

Professor Dave Parry, Head of Department of Computer Science, Auckland University of Technology, comments:

“The COVID-19 App developed for New Zealand is relatively simple. Effectively, it records where you have been and when, so that you can tell the contact tracing team if you have potentially been in contact with COVID-19. It also records your contact details which may also be used by the contact tracing team.

“The Singaporean and Australian apps use Bluetooth to detect who you have been in contact with – as long as they also have the app. Bluetooth apps can only give approximate distances to other people and usually need more power, meaning you have to charge the phone more often. They also need everyone to use the app and usage has been very low at around 10-15% in Singapore.

“The NZ app just records where you have been using its own QR codes to ‘check in’ to places. This is technically much simpler – we are already doing this recording as we check-in to shops, etc. However, because there are many different apps and paper-based ways of doing this, getting the data quickly to the contact tracing team is hard, and following up contacts quickly is very important so that they don’t infect others. This was an issue early in the outbreak – many health IT systems don’t talk to each other so following up people from different regions was slow.

“The advantages of this approach are that it supplies exactly the information needed by the contact tracing team and won’t add lots of other information about probably non-significant contacts. It doesn’t depend on everyone using it, unlike the Bluetooth approach, and it should use less power. It should not release any private location data unless you need to be contact-traced and that is covered by privacy law anyway. It puts the onus on contact tracing very much onto the contact-tracing team, rather than being a ‘personal’ warning system. It depends on people checking in accurately, although I think most people will be happy doing that although the onus is on you to remember to do it.

“The biggest issue with this app is that it doesn’t really bring much benefit to the person using it. It doesn’t replace the check-in systems to businesses or even allow you to automatically send your history to the contact tracing team, although this is promised. I found the interface to set it up rather clunky and I suspect a lot of people will give up. It also asks for a lot of information (admittedly voluntary) that it doesn’t need. People are used to very easy-to-use apps and for something designed to be used by the whole population this feels like a government app. Not impossible to use, but not delightful either. I think this will be a major issue in terms of the value of this app.

“In terms of privacy and security, two-factor authentication – usually something you know and something you have – can be set up, but that is complicated. I would strongly support releasing the source code for this app so that the security community can test it and examine it; this is a much more reliable way of protecting data than ‘security by obscurity’.”

No conflict of interest.

Dr Andrew Chen, Research Fellow, Koi Tū – Centre for Informed Futures, University of Auckland, comments:

“The new government COVID-19 app is really designed to help manual contact tracers get more of the information they need: up-to-date contact details for people, and helping people remember where they have been over the last 31 days. The app is relatively simple but it has good privacy and security protections in place, and appears to be safe to use. It is not the Bluetooth or proximity tracking solution that people may have heard about overseas, particularly in Singapore or Australia. We should view this as ‘manual contact tracing plus a little bit more information’ rather than fully automated contact tracing. The Ministry of Health may be adding more features in the future but users will be notified about this.”

No conflict of interest.

Associate Professor Malcolm Campbell, GeoHealth Laboratory, University of Canterbury, comments:

“This new app, NZ COVID tracer, or the digital diary, is a useful supplement to the hard graft of contact tracing. There are still two main ways to keep ourselves safe; washing our hands and social distancing. But this new app allows us to keep track of the where, when and who of our movements to help us contain the virus quickly if there is any flare up in cases we need to know. Where, when and who: where we have been, when we were there and who we were with.

“The app allows us to keep track of our three ‘Ws’ by recording this important where, when, who information. I track myself everywhere on a mobile app on my smartphone to understand my location history, so this government app is less invasive than some of the other tracking that already goes on in the background for many of us. If we check into a place on social media, it is similar to that. But, unlike apps from technology companies, it would appear that we are in control of our data. In other words, there is plenty of control in the hands of citizens, we have a choice to share the data, which is good.

“The slight downside is that the app wasn’t released sooner, as it can be a little confusing scanning and checking in multiple times, and some business have got their own solutions already, but I’m sure we will get there, despite some teething problems.

“The other important point is that any app or technological solution like this ignores or excludes those who don’t have access to smartphones and apps: the ‘digital divide’. That’s when pen and paper are the solution.

“I’ve downloaded the app and I will be using it, if we all can, that would be great!”

No conflict of interest.

Simon McCallum, Senior Lecturer, School of Engineering and Computer Science, Victoria University of Wellington, comments:

“There are two parts to contact tracing: A.) knowing where a person infected with SARS-CoV-2 went and  B.) finding everyone else who was in those places. The NZ COVID Tracer app is intended to help with part A, and the visitor log maintained by businesses is intended to help with part B. Either A or B by themselves are useless. So the advice must be we need to do both.

“NZ COVID tracer seems to have been designed from a business perspective rather than a user perspective. The lack of transparency of using business numbers rather than location and name seems unnecessary. The code for the app should be open source to increase trust in the handling of data and in the quality of the development process.

“There are other ways of doing A and B. For recording a diary, everything from a personal paper record of everywhere you go through to apps like Open Street Maps with the GPX tracking turned on can be used and retain the information privately. Rippl and other apps are also acceptable ways of recording where you have been.

“For part B, we are required to leave our contact details with businesses, often in public view, which is an issue for many people. A simple anonymous approach is for trusted organisations such as the Ministry of Health, iwi, and/or churches to provide codes to people. You could allocate many codes per person either as QR codes on phones (like boarding passes for Air New Zealand) or physical QR business cards. When you visit a shop they use their phone to scan your code. If there is a positive case the business contacts your trusted organisation rather than having your details. This provides a non-digital solution that relies on local communities rather than businesses.

“The Bluetooth systems are designed to combine A and B so that, instead of every business having to be a store of contact information, that anonymous information is stored in each person’s phone.

“There are also some user experience issues with this app. The user’s motivation to do the ‘work’ of recording every business they attend is missing. We know from previous apps without motivation or compulsion this sort of behaviour will evaporate over time. There are also issues with older phones, people without phones, and building trust in our most at-risk communities.

“Hopefully in the next few weeks the app will be updated to provide both the A and B of tracing, and provide user engagement. The Government can continue its push for transparency by making the code open source and allowing independent experts to analyse the process.”

Conflict of interest statement: Simon McCallum is an active member of the Labour Party.