A new version of the the NZ COVID Tracer app will be launched on the Apple App Store and the Google Play Store late Thursday.
The functionality is provided by the Google and Apple Exposure Notification Framework, which most Android devices and iPhones already support. The Ministry of Health says people should continue scanning in with the QR codes, as keeping a digital diary is still important in staying ahead of the fight against COVID-19.
The SMC asked experts to comment on the update.
Dr Farkhondeh (Ferry) Hassandoust, Lecturer, Business Information Systems, AUT University, comments:
“Updating the NZ COVID-19 tracer app with Bluetooth functionality is an efficient way to alert the user when they come within close proximity of someone who has tested positive for COVID-19. In addition, the app can warn users when they have retrospectively had contact with a person who did not know they were COVID-19 infected at the time. Our newly published AUT research found that privacy was one of the most critical concerns of the general public in terms of using (or not) contact tracing applications. In the case of NZ’s COVID tracing app, privacy is built into the Bluetooth upgrade and has been endorsed by the Privacy Commissioner because of its focus on users’ privacy.
“However, despite the benefits of Bluetooth technology in the NZ COVID tracer app, there are some potential issues with this functionality. For example, environmental factors may affect the accuracy of Bluetooth. Bluetooth signals may collide with walls and be absorbed by our clothes. These factors could potentially confuse the contact tracing capabilities, making a Bluetooth device that is two metres away appear to another device as if it is 10 metres away and vice versa. Therefore, there are risks of the upgraded app showing false positives and false negatives.”
No conflict of interest.
Professor Dave Parry, Department of Computer Science, AUT, comments:
“This upgrade to the COVID tracer app follows a very similar route to that used overseas. It is using the Bluetooth model developed by Apple and Google (for android). This extension basically records a list of anonymised numbers that represent other phones that have been relatively close for a few minutes on your phone. These numbers change every few hours so you broadcast different numbers that represent your phone at different times. If someone gets notified that they have COVID, then they can choose to upload the numbers that their own phone has “seen”. Your phone checks the list of “seen” numbers every few hours. A bit like checking Lotto numbers, if one of your numbers is on the list then the app will tell you that you have potentially been in contact and that you should contact the tracing people. The QR code system is still going, that gives you a human-readable list of the places you have scanned into, the Bluetooth numbers don’t give you any meaningful information.
“Apple and Google have developed a robust, secure and privacy-preserving system and it’s good to see the NZ government adopting this. There is no real risk to privacy, at each stage you have choose to release your data and all the tracing centre knows is the original person who tests positive (which they know anyway) – if you are a potential contact, you just get an alert asking you to communicate with the tracing people. As the Ministry says, the QR codes say “where” you have been and the Bluetooth says if you have been near someone who has tested positive, (but doesn’t tell you who they are or where that happened).
“It’s very good to see that the Ministry has released the source code. This is a very common way of spotting security issues – having the world-wide community of experts looking for problems and reporting them is much safer than hoping that criminals don’t find anything or assuming that the code writers have thought of everything.
“There is a possibility this approach could be extended to Bluetooth beacons and cards – like the proximity cards you use for PayWave etc. In some ways it would be easier if the QR scanning added this approach too – by having Bluetooth beacons as well. It would mean not having to get your phone out to scan the QR codes and could also let you carry a card or bracelet if you don’t have a phone. This is more than just implementing the current Apple/Google system although it is relatively simple to do. These approaches could be particularly useful in places as such as hospitals and managed isolation, to get early notification of possible transmission. In these cases you may not be as concerned with privacy so you could use the data to make a model of routine contacts even before someone tests positive, and identifying how you can reduce unnecessary contacts.”
No conflict of interest declared.
Dr Andrew Chen, Research Fellow, Koi Tū: The Centre for Informed Futures, The University of Auckland, comments:
“A multi-layered defence is critical to our approach for protecting ourselves from COVID-19. The Bluetooth Tracing functionality being added to the NZ COVID Tracer app can be one of these layers. The longer name for this function is the Apple/Google Exposure Notification Framework (ENF), which has been adopted by over 25 countries around the world. With our low case counts here, we have had the benefit of time to watch how the tool has been used in other places and learn from their experiences. While it has taken some time for the functionality to be added to our app, it’s good to add another layer of defence.
“Bluetooth Tracing works with smartphones exchanging Bluetooth signals with each other to indicate that they were close to each other. Since Bluetooth signals are relatively short-range, this limits how far apart the phones can be when exchanging signals. The phones can measure how long they are physically proximate for, and give an approximate sense of distance based on the strength of the signal. Most importantly, the phones do this exchange anonymously – they do not reveal who owns the phone, and the phones use a newly generated ID number every day.
“If someone tests positive for COVID-19, then the Ministry of Health can upload the ID number for their phone for each day. Everyone else’s phones will check the Ministry of Health list automatically a few times a day, and check their own logs to see if they were close to the infected person’s phone. If they find the infected person’s ID number, then a message will be shown to the user giving further instructions based on the type of exposure the user might have had. The message might be different if two phones (and therefore people) were in close proximity for a few hours in comparison to two phones being relatively far apart for a few minutes. The message might encourage a user to get a test, or to call public health officials. The two owners of the phones are not directly identified to each other by the Bluetooth Tracing system.
“All checks for potential overlaps and exposures are done on the phone itself – the Ministry of Health do not get access to your data. Apple and Google do not get access to your data either, and have set strict rules around how the data from Bluetooth Tracing can be used only for public health purposes.
Because of this design, Bluetooth Tracing does not and cannot replace manual contact tracing, but it can be a helpful tool in speeding up the process. If you have been infected with COVID-19 but don’t know it yet, then you will want contact tracing to be as fast as possible to help you avoid unintentionally transmitting the disease to others.
“Bluetooth Tracing sits in addition to other tools and layers. Use of the NZ COVID Tracer app and Bluetooth Tracing is voluntary. It is still important that we keep personal diaries of where we have been and when – one way to do this is through scanning QR codes, but other methods like taking photos of where you have been, using Google Timeline, or a pen-and-paper diary are also helpful. With Bluetooth Tracing, the phones know about other phones that are close to them, but that system does not record where the phone is, so it cannot be tied back to a specific location. The personal diary is still important, particularly to help contact tracers find people who may not be using Bluetooth Tracing as quickly as possible.
“For people without smartphones, or with smartphones that are too old, unfortunately they can’t use this system yet. I hope that the government will look at further options such as vouchers for smartphones or wearable devices that will enable every New Zealander who wants to participate to be part of the Bluetooth Tracing network. Bluetooth Tracing currently works with Apple devices running iOS 13.5 or later, and other smartphones running Android 6.0 or later with Google Play Services and Bluetooth Low Energy available.
“Importantly, the code for NZ COVID Tracer has also been made open source. This means that anyone can have a look at the code behind the app, and check that the app is doing what the Ministry of Health says it’s doing, particularly in terms of keeping the data secure and private. I invite anyone who is inspecting the code to get in touch and compare notes. Based on the described architecture and design of the app, and the track record of the Apple/Google Exposure Notification Framework internationally so far, the app protects your privacy and it should be safe to use.
“The NZ COVID Tracer app should update automatically, but people who are interested in using Bluetooth Tracing can check for updates from the 10th of December onwards. You will need to turn on Bluetooth Tracing manually – this is to ensure that people are opting-in to the tool and exercising a free choice. Once it is turned on, it will stay on until it is turned off. No further action from the user is necessary. Bluetooth Tracing itself does not use any data, although you may need data or WiFi to download the app, and to check the list of ID numbers from the Ministry of Health.
“Bluetooth Tracing is only useful if enough people have phones with it switched on – it needs enough people participating in the system to cover a sufficient proportion of interactions. I think we want to be aiming for at least 60% of the adult population using Bluetooth Tracing. We will have to wait and see whether we can reach that target over the next few weeks, but I’m optimistic given the uptake of the existing app. COVID-19 is still very real and becoming more serious rather than less serious in many places around the world, so an additional layer of defence that is quick and easy to implement for many people is helpful.”
Conflict of interest statement: Andrew has provided some informal advice to the Ministry of Health this year, but there is no financial relationship.