Coronavirus: Concerns too many tracing apps could do more harm than good, as NZ moves to level 2

Friday, 15 May 2020

When New Zealand moved to Covid-19 alert level 2 on Thursday, businesses were allowed to reopen.

Shoppers are having to download multiple apps or fill in contact tracing forms, risking their privacy and pushing their patience. Meanwhile, the Government refuses to provide a time frame for its long-awaited coronavirus tracking app.

Since alert level 2 came into effect from 11.59pm on Wednesday, all businesses were able to open, provided they complied with public health guidance about physical distancing and contact tracing. In response, a flood of digital contact tracing registers have been made available and promoted, raising concerns about a fragmented system that could undermine trust and transparency.

The Ministry of Health in recent weeks has bolstered its capacity for contact tracing — an essential tool in its fight to track down, isolate and eventually eliminate the coronavirus. But it's a laborious process, interviewing an infected person about their recent movements and notifying close and casual contacts.

Other countries have been speeding up the process with digital systems — some more invasive than others. Using an extension to the WeChat app, Chinese authorities were able to control movement and entry to public spaces and public transport. Singapore asked all its citizens to download an app called TraceTogether, which used bluetooth signals between phones to log contacts who come within 2 metres. The Australian Government recently launched a similar app, called Covidsafe.

* Clark strengthens contact tracing oversight

Rippl has been endorsed by Wellington City Council as its contact tracing app of choice

* Health Ministry consults with spy agency GCSB for Covid-19 tracing

* Coronavirus: Apple, Google debut major effort for Covid-19 contact tracing

Prime Minister Jacinda Ardern has said the Government also planned to make a voluntary app available to help track the movements of people with the virus. However, self-imposed deadlines have been and gone. By the time level 2 rolled around, organisations were told to refer to a paper template.

Meanwhile, opinions remain divided on whether an app was the way to go. As well as technical issues around iPhone compatibility, battery life, and Bluetooth signal interference, they raised issues around privacy and mass surveillance.

At level 2, hospitality businesses were asked to keep records of the customers they serve. 'Whether or not they're engaging in technological tools to do that, or doing that in a more traditional way, we do have an expectation that this is occurring,' Ardern said.

Dr Andrew Chen, an expert in person tracking technology at Auckland University, said the plethora of private sector systems and apps being developed, albeit with good intentions, could lead to fragmentation and ultimately, disengagement from the public.

'Once you download your third app of the day, you might decide you don't want to use it, and that undermines trust and confidence.'

While some businesses were collecting just the essential information — date of contact, name and contact details — others were more detailed.

Wellington's Unity Books is signing up customers for track and tracing.

The lack of consistency meant contact tracers were likely to receive data in different formats, and potentially waste time figuring out how to interpret it rather than getting on with calling people, Chen said.

'I'd like to see some sort of coordination from the Government. In an ideal world, [an app] would have been ready at level 3, because the technology was needed then.'

However, while software developers could build a QR code system in a day, it was easy to forget all the checks and balances the public sector needed to apply.

'What does data governance look like? What does privacy look like? What about people who can't participate? And, critically, does it give public health systems the information they need? If the data isn't in a format the Ministry of Health can use, it won't use it,' he said.

'What this is showing is that government IT is hard. Technologists don't always appreciate that.'

Any solution had to be 'public health first', he said. 'We can argue for a long time about whether it should be this or that technology. But I think technologists' role is to show public health folks what the options are and then allow any solution to be public health-led.'

But already, there have been reports of privacy breaches. One woman complained to Newshub that a Subway worker had stalked her after she plugged her details into the store's contact tracing system.

Privacy Commissioner John Edwards said it was essential that businesses used contact tracing information exclusively for pandemic management.

Subway replaced its contact tracing system on Wednesday, Subway said.

In an attempt to offer some level of coordination, on Monday, Wellington City Council endorsed contract tracing app, Rippl.

Mayor Andy Foster said with many council services reopening under alert level 2, they needed a secure tool which was easy to set up and use, which also protected peoples' information and privacy.

A Contact Tracing Assurance Committee has been set-up to strengthen oversight on what the Health Minister David Clark is describing as a crucial part of the Covid-19 response.

Antony Dixon, client success director at Paperkite, the software company behind Rippl, described the app as 'privacy first'.

After an organisation registered with Rippl online, they would receive a unique QR code to print and display at their entrance, he explained. People with the Rippl app on their smartphone could scan the code as they entered, and check out as they left. The app didn't request any personal contact details or use location tracking services, he said.

A user's check in and out data was stored on their device. If they were later thought to have been in contact with someone carrying the virus, they would be sent an alert and asked to contact the relevant authorities.

'The Subway situation, that could never happen with Rippl,' Dixon said.

The company has offered to collaborate with the Ministry of Health, he said, and has sought clarity around what was wanted from an app.

'We're still waiting for answers.'

He'd welcome some sort of official seal of approval, he said, to show they were complying with health standards.

The app was free for many Wellington organisations, but the company had also received interest from further afield, including one query from Belgium, he said.

Alan Chew, managing director of Houston Technology in Hamilton, has also contacted the ministry with ideas for apps based on QR codes.

'It's low cost and easy to use,' he said. It was also less complicated than location-tracking technologies.

He felt for businesses trying to do the right thing despite a 'regrettable dearth of useful advice' from the Government.

His advice to them was to wait for the ministry to come out with its own app or a certification process for existing apps.

'Do what you can to meet the bare minimum of contact tracing requirements, don't go out there and buy apps that aren't currently certified.'

He was confident the Government would come up with a solution by the end of the month.

However, in the meantime, accidental or deliberate misuse of the data could 'tarnish the whole concept of contact tracing', he said, potentially compromising the clout of any future Government or certified app.

The Ministry of Health didn't respond to questions about its progress or expected time frames. It referred Stuff to Ardern's comments on Tuesday, when she told reporters the Government was still considering a range of options.