22 May 2020

Our contact tracing app - how effective will it be?

From The Detail, 5:00 am on 22 May 2020
Illustration of thermal photography through a telephone during the period of confinement during the coronavirus pandemic, covid-19. Thursday April 30, 2020.

Photo: Idriss Bigou-Gilles / Hans Lucas/ AFP

New Zealand finally has a Covid-19 tracing app, weeks after other countries developed theirs - but questions remain around what role it fills, which organisations can actually utilise it, and whether this is sending us down a dystopian pathway.

More than 100,000 people have downloaded NZ Covid Tracer since it was released on Wednesday, but the actual role it performs is nothing new: until new versions are rolled out, you'll still have to fill in your details on old-fashioned pen-and-paper when you go to a restaurant or retail store.

In its current incarnation, the app collects two separate kinds of data, which are stored in two separate locations.

When you join up, users are asked for their full names, phone number, and address: this is to ensure your details are up-to-date in case you haven't used the health system for a while, and the information is collected by the Ministry of Health, and stored on secure servers in Australia.

It also collects data when you use the app to scan QR codes at the entrance to a store. This data is NOT shared with anyone else; it's stored on your phone, and can only be shared if you consciously choose to do so. If you come into contact with Covid-19 that information will prompt you to remember where you've been.

Dr Andrew Chen is a research fellow at Koi Tu - the centre for informed futures at the University of Auckland. He says the app won't replace the pen and paper for now, but in a few weeks hopefully a streamlining method will be found so people don't have to do both. 

He says the app appears well-designed - in fact it asks you for less information than other services lots of people are already signed up for.

"It seems pretty safe. They've done all the right things in terms of getting a privacy impact assessment an d independent security audits. And because they're not storing very much data, it's probably fine." 

However there are inconsistencies, Dr Chen says.

"Right now we're in this situation where the government has released an app that has its own QR codes; we've got all of these systems that were released last week that use different QR codes. And if you used an app that uses a QR code from a different system, it won't be able to read it. We need to fix this." 

Another issue is the accessibility: not everybody owns a smartphone, and not everybody who owns a smartphone necessarily knows how apps work - not is everyone connected to the internet. 

And, of course, there's the precedent: once Covid-19 is over, what happens then? Are we normalising constant remote surveillance by governments of their own citizens? 

"A lot of these systems that we're talking about the companies and governments are very aware of the privacy concerns and so they have all said that the data that is collected by these systems for the purposes of managing the Covid-19 pandemic can only be used for the purposes of managing the Covid-19 pandemic - and these systems will be shut down and the data deleted when somebody decides that it's all over."