CovidCard carrying Kiwis?

New Zealand’s COVID Tracer app is “on track to achieve nothing”, according to Sam Morgan. The numbers support him: only one in six of those eligible to download and register the app has done so, and each app user has scanned just 2.5 QR codes since the app debuted in late May. In recent days just one of every eight QR-code posters has been scanned, by anyone at all. These problems are fundamental – and neither more downloads nor more posters will solve them.

Should COVID-19 get past border quarantine, New Zealand’s contact tracers will be trying to unravel chains of transmission like those at NSW’s Crossroads Hotel cluster. And it is highly unlikely that NZ COVID Tracer app will help. Morgan presents a spirited case that New Zealand should abandon it and embrace a CovidCard instead.

I agree that the NZ COVID Tracer app has been a flop. But there is a significant chance that CovidCard could flop just as spectacularly. They share some characteristics: both are “skunkworks” projects, developed out of the public eye and reflect deep (and untested) assumptions about what the public will, and will not, accept.¹ And both appear to embody a “New Zealand should go it alone” attitude that, in the midst of a global pandemic, may be unhelpful.

What does the public know about CovidCard? Until Morgan’s article, very little indeed.² A Google search reveals a 22 June NewstalkZB report covering a post-Cabinet press conference with the Prime Minister: “there was ‘enthusiasm’ to continue exploring the bluetooth Covid card option, but Ardern said the technical capability, privacy issues and the expected uptake were issues still being looked at”. That’s about it from official sources.

So, let’s examine the CovidCard proposal.

A CovidCard worn visibly on your person

The CovidCard is a device best worn “around your neck on a lanyard or clipped to your top”, which exchanges encrypted ID numbers with nearby CovidCards via Bluetooth (ie, short-range radio signals).

The Government would issue them for “free” (though they’d cost taxpayers about $40 per card). It would take six months to deploy them to five million New Zealanders. They would have a 12-month battery life. To achieve widespread usage “might ultimately require a degree of mandating in places of congregation”. I interpret this as meaning that you may be excluded from crowded venues, e.g. pubs, buses, concerts and churches, unless you display your CovidCard. 

If you test positive for COVID-19, then “your contacts would be immediately notified … even before the contact tracing teams connect with them”. Morgan’s article does not specify how this immediate notification would happen. Indeed, this functionality appears to conflict with his privacy assurances: “there is no personally identifiable information stored on CovidCard. No contact data leaves your card. The card does not know where you are. There is no GPS or connection to the Cloud.” But a centralised database is presumably required to support immediate notification, one that keeps the card ID number and contact details of every New Zealander.³ Unauthorised or malicious use of this data would have significant, perhaps severe, privacy consequences for some New Zealanders. The CovidCard proposal is silent on these risks.

Morgan presents CovidCard as following a Singaporean lead: “Singapore is already doing it after giving up on their app.” This claim does not appear to be correct. The Singapore Government’s TraceTogether website is live and reports 2.1 million app downloads to date (about 35% of the population). And according to a BBC report, the Singaporean TraceTogether token (ie, CovidCard) is intended as a complement to the existing TraceTogether app. The token is aimed at thousands of vulnerable elderly people who don't own smartphones. Morgan proposes 5 million CovidCards and no app. New Zealand would be going it alone.

Why did the NZ COVID Tracer app flop?

Contact tracing is essential for limiting the spread of COVID-19, and thus protecting everyone’s health. So why have so few people downloaded the app? And why are those with the app so reluctant to use it? I can think of a few reasons:

• The app requires too much effort – registration, passwords, two-factor authentication before using the app strikes me as overkill. As is having to explicitly open the app and then scan every code.
• Lack of clarity over the app’s purpose – and whether this complemented or duplicated the customer registers kept by businesses.
• COVID fatigue – we’re over lockdown and want to get on with our lives as normally as possible.
• Low disease risk – our individual likelihood of becoming seriously ill from COVID-19 is extremely low.
• Privacy concerns – we fear someone may misuse data collected about us.⁴

As far as I’m aware, getting a good contact tracing app – one that the population is keen to use – has not been easy in any country.⁵ But why did New Zealand end up with a such a flop?  Possibilities include:

• The not invented here syndrome – a persistent decision-making error arising from an attitude-based bias against external knowledge. Or more simply, people and organizations avoiding things that they didn’t create themselves.
• The processes around selecting an approach and designing an app were not transparent in New Zealand.

In other countries, the design and adoption of COVID-tracing apps has been the subject of much public debate. While some of that debate is poorly informed, much is intelligent. Public debate has informed decisions about the overall approach and spurred improvements in privacy protection and software performance. It has also helped to build public trust in the apps.

I am not aware of any public explanation as to why New Zealand chose to build an app based on QR codes. In Preparing for further outbreaks – have we got the right app? I concluded that the app was poorly suited to supplementing the country’s tracing system, and that the system could be bolstered by swapping to a Bluetooth-based alternative. But the Ministry of Health has not, to my knowledge, engaged with its critics. Its app FAQ appears to argue that they did not adopt Bluetooth because it is not perfect. However, perfection is always a misleading comparator. Would a Bluetooth-based app better supplement manual contact tracing than a QR-code based app? This is a reasonable question, but the FAQ neither poses nor answers it.

Could CovidCard flop as well?

CovidCard would require less effort on a day-to-day basis, so that’s a plus for it over NZ COVID Tracer. But it’s not obvious how CovidCard would help with the last three reasons for the app’s low use: COVID fatigue, low disease risk and privacy concerns.

And CovidCard might come with its own, specific problems. A potentially serious one is software updates. Bluetooth contact tracking requires complex software, and no (responsible) software professional would guarantee getting it right first time.⁶ Smartphone apps have a big advantage here ­– they can be quickly and seamlessly updated over Wi-Fi and mobile phone networks. How would a software update for 5 million CovidCards work? Would they all need to be returned and reissued? How much extra would this cost? And how many times might it be necessary?

A further concern, arguably a deal-breaker, is that CovidCard would not be fully deployed until 2021. That leaves a long gap, during which the virus may re-establish in the New Zealand community. And, under some conceivable scenarios, the pandemic could be fizzling out by then.

Consider all options

CovidCard could be an expensive flop. Before spending $100 million, it would be prudent for the Government to consider other options.

Morgan’s pitch for CovidCard dismisses all Bluetooth-based apps as being “fatally flawed”. In doing so he rules out following Singapore. New Zealand could adopt their TraceTogether app and supplement it with CovidCards for those who do not own smartphones. This would be much cheaper for New Zealand, and a lot quicker to implement. (Richard Easther suggests a subsidy for smartphone upgrades to address the problem of not all Kiwis having suitable smartphones to run a Bluetooth tracing app, rather than a free CovidCard for everyone.)

Another possibility is for New Zealand to follow the 13 countries that have adopted apps based on “Gapple” – the Google/Apple exposure notification API.⁷ One of these countries – Ireland – has a similar population to New Zealand. It spent just €850,000 on app development, including testing, security and data protection impact assessment. That’s just 1.5% of the estimated NZ$100m bill for CovidCard. The Irish app is tracking contacts now, not promising to do so in 2021. And initial take-up has been excellent – 1.3 million people downloaded it in just eight days, reaching 35% of the population aged 16+. Spain and Gibraltar have released apps based on the same source code, with Northern Ireland to follow. New Zealand too could quickly and cheaply follow Ireland’s lead.

None of these options are perfect. But some are better than others, perhaps much better.

A decision is pressing, but it shouldn’t be rushed

It is difficult to know whether New Zealand’s border controls are effective at blocking the re-introduction of COVID-19, or whether the country has just been lucky so far. It makes sense to bolster secondary lines of defence, including automated collection of social contact data to bolster manual contact tracing. Waiting until after an outbreak is too late – contact tracers need to be able to look back weeks in time to see who might have spread the disease to whom.

The CovidCard proposal is now in front of Government. It has an impressive list of backers. But CovidCard is not the only option, nor is it clearly the best. A quick, transparent and public decision-making process at this point would best serve New Zealand.

My take outs

• Swapping NZ COVID Tracer app for CovidCard risks replacing one expensive flop with another.
• Alternatives exist, and these deserve full and transparent consideration.
• It’s time for transparency and public debate over the best automated supplement for contact tracing.

Notes
1, A skunkworks is an "enriched environment that is intended to help a small group of individuals design a new idea by escaping routine organizational procedures."
2. Is the CovidCard really a silver bullet?, published 3 days after Sam Morgan’s article, supplies a few more details, including the team behind the proposal and some results from early testing.
3. The central database would also need to store any relevant decryption keys. Unauthorised use of those keys could compromise the privacy and security of all CovidCard users.
4. Privacy is a complex topic. It is an open question what erosion of rights New Zealanders will accept in times of crisis. Collecting and storing data on people’s contacts with others is an erosion of a “right” to privacy, though of a lesser degree than proscribing contact with others, as happened under alert level 4. Privacy guarantees, and their credibility, are important for the voluntary uptake of tracing technologies, and for compliance with mandated use. I plan a follow-up blog post on contact tracing and privacy.
5.See, for example, Coronavirus Tracing App a Test for Privacy-Minded Germany, Norway pulls its coronavirus contacts-tracing app after privacy watchdog’s warning, Covid-19 and the privacy trade-off, UK abandons contact-tracing app for Apple and Google model and the Inside Story of Ireland’s Covid Tracker app.
6. The software might need updating to fix errors or because its design parameters have changed. One example of a design parameter that may change is what counts as a “contact”. Current guidance suggests 15 minutes within 1–2 metres, but I expect this to change over time reflecting further experience with disease transmission and tracking technology. What would happen should guidance change to say 8 minutes within 2.5 metres? Would the Government need to recall, reprogram and reissue all CovidCards? (Full disclosure: my first career was in software development. I never managed to code a bug-free version 1.0. Nor did I meet any programmer who did.)
7. Gapple is not an app itself, but a framework that provides Bluetooth-based functionality by which contact tracing can work. It builds support for Bluetooth-based contact tracing into the Android and iOS operating systems. Gapple overcomes specific problems that plagued earlier contact-tracing apps, including battery drain, unreliable distance estimation, and degraded performance over time on iPhones. While only health authorities can build apps that use Gapple, doing so is quicker and easier than building such apps from scratch. Austria, Brunei, Denmark, Germany, Gibraltar, Ireland, Italy, Japan, Latvia, Mexico, Philippines, Poland, Saudi Arabia, Spain, Switzerland and Uruguay have released apps using Gapple. Another 13 countries including Australia and the UK have announced their intentions to use Gapple or are actively developing Gapple-enabled apps.

Photos: In the absence of automated tracing, social distancing works. From top: Ivory Lake, Westland; Davis Snowfield, Westland Tai Poutini National Park; Great Island, Fiordland National Park. Dave Heatley