Why the NZ Covid Tracer app may not be working for you

Tuesday, 26 May 2020

Lots of people have downloaded the Government's NZ Covid Tracer app but confusion over its purpose, and how it works, remains.

ANALYSIS: For a service that is designed to make navigating the post-Covid world simpler, the Government's coronavirus 'tracing' app appears to be causing a fair amount of confusion.

In its first release, the NZ Covid Tracer app does little more than provide the Health Ministry with people's up-to-date contact information.

As a bonus, it can also serve as a basic 'aide-memoire' to help people record their visits to the likes of food outlets and shops during the Covid-19 pandemic.

The idea is that people scan a QR code when they visit a venue, and the app creates a log of the places they have visited, and when, on their smartphone.

The Health Ministry's explanations of how the app could later evolve into a 'true' tracing tool have been somewhat ambiguous.

QR codes to check into venues have become commonplace, but these are not necessarily the same as those recognised by the government app.

* Coronavirus: Here's my experience using the new Covid-19 tracker app

* The Detail: Questions surround the NZ Covid Tracer app

But it is clear from privacy documentation that a later release of the app could allow people to automatically share details of their visits with the Health Ministry, if they choose to do that.

That may mean the ministry will then be able to use the app to automatically alert people who had visited a business at the same time as someone subsequently diagnosed with Covid-19.

But it can't do that yet.

So far 405,000 people have downloaded the initial version of the app.

The Health Ministry hopes about 62,000 'high traffic' businesses will display the QR codes that people need to scan to log their visits on their phone.

But up to now, only 15,500 of the QR posters have been printed out, and the ministry acknowledges that the number of businesses actually displaying the codes may be fewer than that.

Confusion has arisen because many cafes and bars are displaying separate QR codes that can be used with commercially-developed apps.

Those apps are used to meet their legal requirement to maintain their own register of visitors during alert level 2, as an alternative to keeping a register using pen and paper.

But the QR codes generated by those apps are — or were until very recently — different from the ones that businesses needed to display for the government app.

That means that businesses that want to support the Government app but which also want to use QR codes to maintain their own register, may need to display two separate QR codes — one to do each job.

That appears to have been a recipe for chaos.

Anecdotally, it appears many people who have downloaded the government app are scanning those 'commercial' QR codes and are puzzled when they don't update the register on their phone.

'The ministry is aware that some people are having difficulty scanning QR codes with the NZ Covid-19 Tracer mobile app.

'This is because the app is designed to work with the official QR codes only,' ministry spokeswoman Aimee Gulliver explained.

'The app will not work with other QR codes.'

The Health Ministry released details of a data standard for software developers on Friday that should allow businesses to display a single QR code to fulfil both functions.

That integration is critical, as it means businesses using commercial apps will only need to display one QR code, that will both update the business' register and the register created by the government app for their customers.

Wellington company Paperkite reported on Tuesday that it had now integrated the QR codes in its commercial tracing app, Rippl, which it sells to businesses for $49 per venue for a three-month subscription, ending the problem for its customers.

There has been mixed feedback on how 'user-friendly' the government app is.

Aura general manager Peter Bailey warns there are reasons QR codes went out of favour prior to the coronavirus pandemic.

It does require users enter and confirm a 10-digit password containing a mix of character types on their phone, which some people may find a fiddle — especially given the limited functionality the app provides in its first iteration.

Peter Bailey, general manager of IT security firm Aura Information Security, has a different niggle.

He believes people should be aware that QR codes had largely fallen out of favour prior to their revival during the Covid-19 pandemic.

They are essentially 'blind links' that could take people anywhere, he notes.

'So long as you are clicking on a genuine QR code you are okay.'

But the opportunity exists to generate 'false' QR codes and get people to click on them, to direct them to malicious websites, he says.

Bailey agrees the risk of hackers using fake QR posters to distribute malware during the Covid-19 pandemic is low, but says 'it is there'.

'If you had a business with a dishonest owner that wanted to gather people's information, instead of putting the correct QR code up they could put up their own one for people to use.

'Or if the QR code is at the front of a store, a criminal could switch it out and replace it with their own one while no-one was looking,' he says.

It is probably fair to say that there are usually much easier ways for hackers to get people to click on malicious links, from the comfort of their keyboards.

Most people should not be too concerned by the inherent risks of QR codes, especially if they are prominently displayed at reputable, well-frequented business.

But Bailey suggests that if people click on a QR code and find their phone isn't behaving the way they'd expect it to, then they should be concerned.

Notwithstanding those perhaps largely theoretical security concerns, the government app could become a useful tracing tool in future iterations, with QR codes integrated with commercial contact-tracing apps.

But one question is how many of the 405,000 people who have already downloaded the app will have given up on it before then, assuming it not to be that helpful — especially if they believe the coronavirus has been permanently eliminated from their community.