Image: Getty Images/Tina Tiller

SocietyAugust 30, 2021

What’s gone wrong with Bluetooth tracing?

Andrew Chen

Guest writer

Share Story

×

Share Story

×

Image: Getty Images/Tina Tiller

It was supposed to give our contact tracing capabilities a substantial boost, but in the latest outbreak, Bluetooth has proved next to useless. What happened?

We know that contact tracing is a critical part of our ability to contain any outbreak of an infectious disease. Bluetooth tracing, offered through NZ Covid Tracer, is part of that process in New Zealand. Or at least, it should be. Technical folks over the last week have noticed that the most recent Bluetooth data made available to the NZ Covid Tracer app was on August 17 – the day we found out about Case A with the delta variant and the country went into lockdown. No Bluetooth keys have been uploaded to the central server since then, despite there being 511 positive cases at the time of writing. This therefore means that there have been very, very few Bluetooth-based exposure alerts sent to users. So why is there no Bluetooth tracing data when there have been many locations of interest and related alerts sent out for QR code-based locations?

What are we talking about?

Before we go too far, let’s recap on what Bluetooth tracing (BT) is supposed to do. Our Bluetooth system is built on the Apple/Google Exposure Notification Framework (often referred to as GAEN or ENF). Once it’s enabled on your phone, you go about your life as usual. As you wander around, your phone broadcasts an ID number (also known as a “key”). When your phone is physically close to another phone with BT enabled (within a couple of metres), the two phones exchange keys, and record them in a diary/log. If one of the two phone owners tests positive for Covid-19, they are then asked by public health officials to (voluntarily) upload the keys on their device to a central Ministry of Health (MOH) server. Phones with BT enabled are checking that server on a regular basis, and if there are new keys, will download them and check them against their log. If there is a match, then the user is notified about the match, and prompted to isolate and get a test. Importantly, MOH does not know the identity of people who have matched, so this system relies on people doing the right thing when notified. This is pretty similar to the QR code/venue-based system that runs in parallel, with the key difference that contact tracers can still send out an exposure notification if the case wasn’t using the app, by looking up the location in the system and finding the corresponding Global Location Number (GLN).

That’s it in a nutshell – there are other technical elements like rotating keys to help protect privacy and filtering to deal with noisy signals, but they are less relevant for the current problem. Prior to the current lockdown, there were approximately 1.5 million devices participating in BT each day, corresponding to about 35-40% of the adult population. But MOH told TVNZ that “fewer than 10” Bluetooth-based alerts had been sent out. And a number of people have verified on their device that the last listed (GAEN-based) exposure notification check in the system settings was on the August 17 or 18. Given the rate of uptake across the population, it seems implausible that across 500+ cases there would have been no Bluetooth keys to upload to the MOH server, as that would imply that none of the 500+ individuals had BT turned on.

Close contact thresholds

One of the possible explanations that has been mooted is around the thresholds used for determining that one Bluetooth device has been close enough for long enough to another Bluetooth device to be considered a close contact with a reasonable risk of virus transmission. When the devices exchange keys, they also note how strong the signal is (as a proxy for distance) and the length of time they see the signal for. The GAEN protocol essentially multiples these together to create a score, and there is a threshold that says if the score is above that value, then the two devices should be considered close contacts. While this is not an exact measure (especially due to the high variability of the signal strength), it can roughly translate to a close contact definition like “within 2m for 15 minutes”.

The thresholds can be inspected by asking Apple for the configuration settings used in the NZ Covid Tracer app. The code probably doesn’t mean much to most people, but essentially the NZ thresholds are currently based on the Linux Foundation Public Health (LFPH) thresholds, mostly because Ireland uses the LFPH thresholds now, and our Bluetooth implementation is based on their code. However, a close contact definition of “2m for 15 minutes” seems incongruous with the data on how the delta variant of Covid-19 spreads. The increased transmissibility, and the documented cases of people getting infected simply by walking past an infectious person, indicate that the thresholds need to be much lower than they were in the past. This is the same reason why MOH has broadened its contact definitions to capture more people, basically treating anyone who was in a venue at the same time as an active case to be a close contact.

This has two implications on the current outbreak and the lack of Bluetooth keys being reported. Firstly, if the thresholds were too high, then the Bluetooth system could miss a lot of contacts that should be considered contacts. Secondly, if the public health officials know this, then they might have less confidence in the Bluetooth system.

However, the first justification does not actually explain what we are observing with the Bluetooth keys. This is because the central server should contain the keys of infected persons, which does not depend on any matching operation or any thresholds. The matching is done on the device once it has pulled the relevant keys from the server. So even if the thresholds are too high, we would still expect to see cases uploading their keys to the central server and to see devices performing the checks. To my understanding, MOH is investigating lowering the thresholds, but they need to do this carefully as lowering it too much could lead to many false positive matches (people being told they’re close contacts when they’re not). The second justification may have more merit, and we’ll come back to why it matters later.

Case demographics and digital exclusion

Another possible explanation for the lack of BT notifications is based on the actual people involved in the current outbreak. At the time of writing, Ministry of Health statistics showed that almost 60% of the active cases were under the age of 30, and 70% of the active cases were Pacific peoples. These two demographic groups are known to be less likely to be participating in BT. The reasons for this are less clear, and before I offer some of the justifications that have been discussed among experts, I’d note that the data to support these is incomplete at best.

The very young (11% of the cases are under 10) are not likely to have a smartphone. Young people generally appear to be more reluctant to participate in digital contact tracing, allegedly because they perceive the risk and consequence of getting Covid-19 to be low. Pacific Peoples are more likely to be digitally excluded so they may not have a smartphone. People in both groups may be more likely to have an older smartphone that is not compatible with BT, or they may have older batteries and are worried that BT may drain the battery life.

All of the above reasons come with strong caveats, because I don’t want readers to run off and say “aha, the lack of Bluetooth keys is easily explained by [insert lazy stereotype here]”. It’s just not that simple, and to make matters worse, I don’t think this is a good explanation because it doesn’t account for the rest of the active cases also not having their Bluetooth keys on the MOH server. There was a high enough proportion of people participating in BT for us to expect that at least one case (beyond Case A) would have had keys available to upload.

Household transmission

Another mooted explanation is that after the initial rush of cases that were likely infected in the community, the majority of the cases have been within households. After all, if delta is infectious enough to be transmitted in open air after walking past an active case, then it’s pretty likely that living in the same house as an infectious person will lead to infection. Where a contact tracer is talking to a household contact, it seems plausible that they may not ask for the Bluetooth keys to be uploaded, because (a) the chain of transmission has already been established, and (b) if they know that the new case has been isolating at home for a couple of days, the risk of transmission outside of the home is relatively low. Again, this does not explain what’s happening for all 500+ cases, but it is logical that when the contact tracer is trying to move quickly and collect the most useful and relevant information, that they might focus on other information sources.

Capacity constraints and processes

This leads us to one of the more compelling explanations – that contact tracers are simply prioritising other tools ahead of BT. Digital contact tracing in New Zealand is not an automated process that runs by itself. It augments the human-led contact tracing process by providing information and processes that sit on top of the manual approach. So, for an active case’s Bluetooth keys to be uploaded to the MOH servers, a contact tracer has to (a) establish that the active case had BT on across the infectious period, (b) decide that sharing those keys would be useful to support contact tracing efforts, and (c) provide the active case with a code to type into their NZ Covid Tracer app to release the keys to the server. Then the active case has to (voluntarily) enter the code.

There are a couple of reasons that, when combined together, may explain why this process might not happen. With the location or venue-based approach (which is based on QR code data, manual entries, and interviews with the case), it is likely that most of the contacts will already be found. The venue-based approach casts a much wider net than the BT approach, because you can be in the same venue without necessarily being close enough to trigger the BT system. Imagine that an active case is wandering around a supermarket – there might be very few people who are within 2m for more than a few minutes, but there would be a lot more people who were anywhere in the supermarket at the same time as the case.

This argument is further strengthened by the high BT thresholds currently in place, meaning that fleeting encounters outside of venues are unlikely to be captured by BT anyway. With the number of cases currently in the community, contact tracers are at full capacity (even using up all the extra surge capacity) just trying to call contacts and provide them with instructions. So, time-constrained contact tracers may decide that the extra time required to walk a case through the process of uploading BT keys is not worth it. After many discussions and thinking through all the possible explanations, it’s probably not a complicated technical reason that is leading to the absence of BT data being contributed to the contact tracing system. It’s probably a much simpler explanation: the contact tracers aren’t asking for the data.

Transparency and clarity

Questions about the lack of Bluetooth keys have been put to MOH over the course of the last week, by myself and other members of the public, as well as by a number of journalists who have also asked me for comment. MOH has not provided a clear, defendable answer until the 1pm press conference on Sunday, August 29, when in response to a journalist question, Bloomfield pointed to the contact tracers not asking for Bluetooth information at the first case interview due to the number of cases, and also the demographic groups of the cases being less likely to use BT. He also claimed that “we have been using it where people have said they have Bluetooth turned on, and we’ve used that to send out messages”, but we know based on the MOH server that this has actually only happened for Case A. He added “we have given [the contact tracers] a nudge around that”.

I thought a lot about whether to write this article or not, because anything that might cause people to stop using NZ Covid Tracer is counterproductive in the age of delta. But MOH has had long enough to respond to queries and be upfront with the public about why Bluetooth isn’t being used. New Zealanders have been asked time and time again to “turn Bluetooth on”, and I have spent a lot of time trying to explain how it works, how to turn BT on, and why people should use it. It is frustrating to see the data potentially isn’t being used to support contact tracing. If, as I suspect, the explanation is that contact tracers simply aren’t asking for the information, then we need a policy decision as to whether this system is actually useful for contact tracing. If it is useful, then the contact tracing processes need to be amended to ensure that they are asking for BT information. If it is not useful, then we can have a different debate. Either way, this is about making sure not only have the right tools to help us fight the virus, but that we are using them effectively.

Andrew Chen is a research fellow with Koi Tū: The Centre for Informed Futures at the University of Auckland.

Police stop cars at a checkpoint during the Auckland Covid-19 outbreak in 2020 (Photo: Brendon O’Hagan/Bloomberg)

SocietyAugust 30, 2021

Are police stretching their legal Covid-combatting powers?

Andrew Geddis

Contributing writer

Share Story

×

Share Story

×

Police stop cars at a checkpoint during the Auckland Covid-19 outbreak in 2020 (Photo: Brendon O’Hagan/Bloomberg)

Several examples of police overreach this lockdown illustrate the potential problem with giving law enforcers such broad powers to combat the virus threat, writes law professor Andrew Geddis.

Back in those hazy, hard-to-recall days of March 2020 as we first entered into lockdown level four limbo, I wrote a Spinoff piece discussing the police’s (necessary and important) role in enforcing our collective Covid response. However, I concluded that piece with a caution:

“History also is replete with examples of turning to authority for security, only to find that the cost of doing so is much higher than expected. And the people who will wield that power are, after all, people. Subject to the same sort of impulses that cause a person to think that they are going to need 60 rolls of toilet paper in their house; or that Asian people somehow are more susceptible to carrying the virus.”

Now that we’re trudging our way through Lockdown Level Four ep 2: Delta Strikes Back, there’s some evidence that this note of warning was warranted. In particular, over the weekend footage emerged of police officers first demanding the name of, and then ordering away, former Green Party candidate and climate change activist Luke Wijohn who was filming them carrying out a rather physical arrest.

That feels wrong. It looks like police overreach. I don’t think the police should have been able to do what they did. However, the individual officers very well may have had the legal power to do so. The following contains a bit of lawyerly discussion for which I crave your forgiveness in advance, but it does kind of come with the territory.

Let’s begin with the normal position. Filming the police engaged in policing activities in a public place is not, generally speaking, unlawful. Had this particular footage been taken outside of lockdown, the police would have had no grounds to order the person doing it to stop or demand the filmer’s personal details.

Of course, we’re not in normal times and level four lockdown rules apply. How does that change things? Well, being in a level four lockdown doesn’t of itself make it unlawful to film the police engaged in policing activities. Had Wijohn done so from, say, his front garden then the police would have had no grounds to order him to stop or demand his personal details. What level four does require, however, is that people stay in their homes, only leave their homes for certain limited purposes, and then return to their homes afterwards.

Taking Wijohn at his word, he had good legal reasons for leaving his home under the current order establishing level four lockdown. He was both “undertaking exercise” under paragraph (e); and also assisting a fellow resident (his girlfriend) carry out essential personal movement (travelling home from work at an essential business) under paragraph (s). So, the legality of his leaving home to walk on the street is not in question. What is less clear is whether having a lawful reason for walking on the street under level four lockdown then allows you to engage in other incidental activities not specifically permitted under the current order. Does the current order permit you, having left your home for a legally permitted purpose, to sit and admire a view, or rest in the sun doom-scrolling Twitter, or stand and film a potential case of police brutality?

This issue has taxed greater minds than mine. But in a practical sense, it might not actually matter for the present case. Because, under the Covid-19 Public Health Response Act 2020, parliament has said this:

An enforcement officer who has reasonable grounds to believe that a person is contravening or likely to contravene a Covid-19 order may—

(a) direct that person to stop any activity that is contravening or likely to contravene the order:

(b) direct that person to take any action to prevent or limit the extent of the person’s non-compliance.

In other words, if the police reasonably believe that your actions are not permitted under the relevant level four rules, they can tell you to stop them and do something else instead. Failing to comply with such a direction is an offence for which you can be arrested, charged, and (if convicted) sentenced to up to six months’ imprisonment or a fine of up to $4,000.

Furthermore, when exercising the power to issue a direction, parliament has empowered the police to do this:

[A]n enforcement officer may direct a person to give the person’s full name, full address, date of birth, occupation, and telephone number, or any of those particulars that the enforcement officer may specify.

Again, failing to do so is an offence for which you can be arrested, charged, and (if convicted) sentenced to up to six months imprisonment or a fine of up to $4,000.

As such, the uncertainty as to whether the current Covid order permits you to stop and film the police while out on the street for an otherwise legally permitted purpose means that a police officer could claim to reasonably believe it is not allowed. And on the basis of that belief, they can direct you to stop doing it and provide them with your details. And if you don’t comply with these directions, they can arrest you and put you through the criminal justice process. Maybe at the end of that process you are acquitted; a court may very well find that, in fact, the Covid-19 order does permit you to stop and film and so the officer had no legally-relevant reason to believe you were contravening the level four lockdown rules. But that will happen months later, by which time you’ve lost hours of your time, experienced extensive stress, and spent a lot of money on lawyers.

Now, did the police in question really believe that Wijohn was acting in contravention of level four lockdown restrictions, or did they see this as a convenient way to stop him doing something that must be really annoying for officers who are “just trying to do their job”? The answer to that lies only in the mind of the individual officers at the scene; if they themselves even know, given our subjective tendency to interpret events and motivations in ways that put us in the best light. But it sure looks somewhat suspicious; do we really think the police would seek to move Wijohn on and take his details were he, say, stopped on Oriental Parade filming the subtle play of the city lights on the rippling surface of the sea? And that illustrates the potential problem with giving the police such broad powers to combat the virus threat. They are both necessary, but also fraught with the potential for self-serving mission creep.

Nor is this the only example of the police stretching, or even outright misapplying, their legal Covid-combatting powers. As National MP Chris Bishop spotted, the police sent out a Facebook warning that driving somewhere for the purpose of exercising is forbidden under level four. However, the level four rules specifically permit outdoor exercise and recreation in a place “that is readily accessible (including by using [a person’s] vehicle) from [a person’s] home or place of residence”. To the police’s credit, the post was amended once the error was noted – but you might think that more care would be taken in making sure the already massive limits on our freedoms weren’t accidentally extended even further by way of social media statement.

And the ODT reported this about police investigating reports of a street party in North Dunedin, but finding only groups of flatmates keeping to their own bubbles: “Residents were given advice to keep music turned down and to move indoors to prevent perceptions of partying.” Sure, this was only “advice” as opposed to a legally mandatory direction, but I’m not sure your average Leith St breatha is going to be fully au fait with the distinction. Also, “perceptions of partying” is my new favourite band name.

I accept that it may appear churlish to question the police’s lockdown enforcement actions when we’re balancing on the edge of a delta disaster that could see our freedoms radically restricted for weeks, or even months. Especially when the police are having to deal with people seemingly determined to ignore the lockdown rules – Covidiots demanding the right for others to die; mountain bikers believing they are bulletproof; supermarket shoppers who can’t abide a mask – on top of their regular law enforcement duties. Surely, if ever there was a time to cut them some slack, it is now?

Well, maybe. However, the other side to that coin is that it is precisely when power is being exercised in emergency situations that we need to be most alive to its potential overreach. Because, “we’re doing this for everyone’s good” can be a very seductive rationale. And behaviour in emergency times can become a template for practices when life returns to normal. Which means we need to trust the police to ensure that our lockdown rules are collectively followed, but also not be afraid to point out when they appear to be doing otherwise.