Covid 19 coronavirus: What's wrong with Australia's tracing app - and an NZ firm's alternative

Around one-third of respondents to an informal poll I ran on Twitter said they wouldn't install a government tracking app on their smartphone - even with official assurances it wouldn't be used for anything but Covid-related location tracing, and that data would be wiped at the end of the outbreak (both provisions NZ Privacy Commissioner John Edwards is pushing).

The result mirrored a demographically-weighted survey by Sticky Beak - and real-life experience in Singapore, where despite the advantages of a tech-savvy and straight-edge population, only around one in five have downloaded the Government's TraceTogether app, according to a recent Reuters report.

Many who left comments after said they just didn't trust the Government, or the multinationals who could well be roped in to process or store the data.

But the experience across the Tasman indicates there could be a whole lot more problems beyond Big Brother suspicions.

Would you install a govt contact tracing app on your phone? (Assuming there’s a pledge to only use it for Covid 19-related tracing and delete all data after the outbreak)

— Chris Keall (@ChrisKeall) April 27, 2020

People on iPhones, especially, are finding the Aussie Government's official movement tracing app awkward or confusing - meaning data is not being collected at all, or only some of the time, in some cases.

The Australian Government released its COVIDSafe app three days ago. It's now clocked two million downloads as people install it on their Apple (iOS) handsets or models from the likes of Samsung whose phones run on Google's Android software.

The Australian Department of Health released the app (see explainer clip above), which captures location data from your smartphone, then stores it on a government server. You can register with either your real name or a pseudonym, but you have to provide your real phone number and address.

It uses your phone's Bluetooth radio (ordinarily employed for the likes of connecting wireless headphones) to record people you encounter within 1.5 metres for 15 minutes or more (providing those people are also using the app).

If you're subsequently diagnosed with Covid-19, the people you've been in close proximity with will receive an alert. It doesn't identify you; it just lets people know that they were in the proximity of a sufferer.

The department hasn't been very forthcoming with technical details, but a reverse-engineering effort by Aussie R&D company QTEAM reveals that Australia's COVIDSafe is based on the Singapore Government's TraceTogether app - which is also on the table as our government assesses app options (an announcement is expected within a fortnight).

That's a sensible option, if authorities are after a Bluetooth-based tracking system. As our Prime Minister Jacinda Ardern has said, you don't want to waste time re-inventing the wheel.

QTEAM gave COVIDSafe a clean bill of health for security and privacy. But the company did note a drawback that the Herald has previously highlighted, via the experience of Jonathan Brewer, a Kiwi telco consultant spending his lockdown in Singapore. That is, iPhone users need to run the app in the foreground.

• Covid19.govt.nz: The Government's official Covid-19 advisory website

That means to manually switch it on, then leave it on. But it's easy to inadvertently close it. And many phones switch off Bluetooth as a power-saving measure when the battery gets low, or on certain privacy settings.

And as Brewer noted, some people - including an out-size number in two at risk groups: the elderly and migrant workers - have cheaper "feature phones" that lack Bluetooth.

There's also the issue of mission-creep. QTEAM's tear-down indicates that COVIDSafe records more interactions than its reported threshold of 1.5m for 15 minutes.

And some will also have concerns over the fact its data is stored at US-based Amazon Web Services, which has server farms in Australia but not NZ - raising data sovereignty issues, or the ability for governments with different privacy laws to snoop.

On the plus side, the Australian Government says users' COVIDSafe data will be wiped every 21 days.

Apple and Google have been co-operating on a tracing solution that will be always-on, but we won't get final details of that until next week at the earliest.

NZ company suggests different tack

Fran Strajnar, CEO of NZ company Integrated Identity, says we should take a total change of tack and focus on places or events as much as people.

"One major consideration not resolved yet, is that a significant number of NZ's Covid-19 infected cases were linked to a place - so for any digital solution to be effective, it will have to trace your contact to venues and places where a case has been," Strajnar says.

He suggests that people use their phone to scan a QR code to "check in" to a business (Apple and Android phones' cameras can do double-duty as a QR code scanner if a business posts one on their door - as many are already for easier registration for online sales.

"Our view is that the benefits of Bluetooth-based app tracing should be combined with the benefits of a privacy-centric platform that allows QR 'check in' functionality to businesses across the country. This combination will create the 'gold standard' of protection that Prime Minister Ardern says we, as a country, are striving towards."

QR codes haven't featured in the national debate, but Strajnar is quick to point out that they got a look-in in the "Rapid Audit" of tracing options recently put together for the government by the University of Otago's Dr Ayesha Verrall (unlike the "Covid Card" popular with the tech set).

"The primary way in which smartphone technology could support contact tracing is through Bluetooth detection of close contact between people's smartphones and, if one is later found to be a case, instantaneously notifying contacts of their exposure and the need to self isolate. There is also the potential to use QR-codes to 'check in' to high traffic settings like public transport or cafes. This latter function has received less attention but seems particularly important as many clusters appear to arise from transmission in closed crowded environments," Verrall wrote in her April 10 report.

Strajnar says as well as combining QR codes and Bluetooth tracking, privacy and security need to be central to the design. He's worried about data being stolen, or falling into the wrong hands. And he says his company, which specialises in distributed ledger or blockchain technology, has a production-ready privacy centric tracing solution which it has tried on many occasions to discuss with the Ministry of Health but they "keep running into a brick wall".

The Ministry, it seems, is likely to use in-house resources to customise Singapore's TraceTogether app.

"There has been a lot of talk about Bluetooth tracing but very little discussion around privacy considerations. The Ministry of Health appears to be building a product based on TraceTogether but has not actively consulted with NZ technology experts around its development, deployment or the privacy aspects," Strajnar says.

Ex-Air NZ CEO and chief technology officer Rob Fyfe was recently shoulder-tapped by the PM to be the liaison between government and the business community. Scuttlebutt in the tech industry has been that Fyfe is one of those pushing for a so-called "Covid Card" or a card with an RFID (radio frequency ID) chip that could be used for entry into bars, cafes and the like - although critics say it would likely have to be managed via a smartphone, and that if that's the case, you might as well go smartphone-only.

Fyfe told the Herald, "There are a range of tracing options being considered and I wouldn't want to be ascribing undue weight to any one solution over another at this time."

The MoH did not immediately respond to a request for comment.