The official contact tracing app, released to aid in the fight against Covid-19, is now available for download. So what does it do, what’s good about it, and what are the problems?
What’s all this then?
As of last night, the government has an official contact tracing app. It’s called NZ COVID Tracer, and is available free from the app store and Google Play store. If you want to know the size, it is 41.5MB.
What does it do?
Strangely enough, one of the things it doesn’t do is automatic contact tracing – we’ll get into why that is the case below.
What NZ COVID Tracer does do is function as a “digital diary,” according to PM Jacinda Ardern. It operates by having app users scan QR codes in public places they visit, so that a record of where they have been is kept. If users choose to allow it, those details are provided to the National Close Contact Service, “so they can quickly get in touch if you are identified as a close contact of someone who has Covid-19,” according to the Ministry of Health website. It has therefore been designed to support, rather than replace, existing contact tracing efforts.
Essentially, two sets of data will be collected by the app, says Auckland University expert Dr Andrew Chen. It will collect personal information for contact tracing purposes – information that can be shared with the NCSS – and track locations to help your memory, which is information that will not be shared.
Do I have to download it?
No, all use of the NZ COVID Tracer app is purely voluntary.
But it would be helpful to sign up?
Yes, signing up will make the job easier for contact tracers if they need to get in touch with you.
Is it the same as what Singapore and Australia have got?
No, the system being used here isn’t the same at all. Those are Bluetooth-based apps, and the NZ version is not. What’s the difference? AUT computer science professor Dave Parry explains:
“The Singaporean and Australian apps use Bluetooth to detect who you have been in contact with – as long as they also have the app. Bluetooth apps can only give approximate distances to other people and usually need more power, meaning you have to charge the phone more often. They also need everyone to use the app and usage has been very low at around 10-15% in Singapore. The NZ app just records where you have been using its own QR codes to ‘check in’ to places.”
How does the data from those QR code check-ins get used?
There have been quite strong statements from all concerned that the data will only be used for contact tracing, and only when needed. So in context, the data will have not be used to prosecute someone for having 11 friends over for dinner, for example. This point has been welcomed by Civil Liberties NZ chairperson Thomas Beagle, who says it’s “exactly what I think they should be doing and is key to building public trust”.
However, Beagle has concerns that the assurances over privacy are not backed up by law, and that there is “nothing stopping the police or intelligence agencies from applying for and receiving the appropriate warrants to access it.” He wants that to be changed immediately, so that there is “some form of legal protection for the data captured by the app to stop other agencies accessing it for purposes not related to the Covid-19 pandemic”.
The data will also auto-delete after 31 days, because that will be more than enough time for any potential infection to play out.
So should we be concerned about privacy from using the app?
On balance, the expert views lean towards the app being fairly benign from a privacy perspective. The Ministry of Health has released a Privacy Impact Assessment, and over the course of about 10,000 words it came to the conclusion that the risk is low. The Privacy Commissioner’s office was heavily consulted during the creation of the app, and commissioner John Edwards says the app was created “using Privacy by Design principles which put privacy at the foundation of the process”.
Will it actually work?
Honestly, the biggest drawback of it all from the perspective of fighting Covid-19 is the very limited scope. There are good privacy and security-related reasons for that of course, but we can’t expect this app to be a silver bullet – it just isn’t designed for that at this stage.
Will more functionality be added to make it more effective?
Here’s where a few fishhooks start coming in – at this stage, adding Bluetooth functionality or other aspects to the app hasn’t been ruled out. And according to Thomas Beagle, that could start to present problems with what people have agreed to share.
“The scope of the application may be increased with a number of other features such as Bluetooth contact-tracing and so on,” says Beagle. “I believe most people leave auto-update on for apps, so anyone choosing to install this app with its limited scope is also de facto installing all the future expanded versions of the app as well.” He clarified that he wasn’t accusing the government of developing a Trojan horse or anything like that – rather, people should just know what they’re signing up for.
What about the other apps that have been developed?
Those can continue to be used of course, because as mentioned above, NZ COVID Tracer is just designed to support wider contact tracing efforts. One alternative app is Rippl (discussed in this article) which has been adopted by both Wellington and Dunedin City Councils. Rippl developer Antony Dixon says on balance the official government app would require more from users. “The setup process is multi-step compared to Rippl. Some features of the app required a data connection. Rippl requires no registration and can be used straight away to check in at venues without a data connection.” He also critiqued the possibility of Bluetooth functionality being added to the app, saying overseas that had introduced “stability problems” for apps.
Anything else worth knowing about it?
To store the data that it will hold securely, the Ministry of Health has contracted Amazon Web Services, owned by Jeff Bezos, the richest person in the world. As the NZ Herald’s Chris Keall notes, “after so much buy-local campaigning, it’s amazing that a US company would get such a huge cloud computing contract”.