What’s really wrong with our contact tracing app

A threatening trickle of new cases and the resurgence of the virus overseas has our Government urging people to use the NZ Covid Tracer App. It’s easy to see why. In the absence of an effective vaccine or widespread lockdown, contact tracing is central to Covid-19 management.

Viruses spread exponentially: a person with a virus infects (say) two people, each of whom infects two more people, and so on. The numbers get very large very quickly. The aim of contact tracing is to stop this spread by identifying and isolating those who have been exposed to the virus before they spread it to others.

The Covid-19 virus is such that contact tracing has to be fast to be effective: the virus is not terribly infectious (someone with the virus passes it to around 2.5 others) but is infectious for some time before symptoms emerge. Someone who has it is likely to be moving around infecting others for several days before they have any reason to believe they have the virus.

Most countries quickly abandoned ‘bare’ manual tracing – asking a person where they have been and who they’d had contact with while they were infectious. The person was unlikely to remember, to know who they’d met at a bus stop or party, and the process had to be repeated for each identified contact. Manual tracing just might work if outbreaks occur only in clearly defined clusters (probably everyone at the Bluff wedding was known to someone at the wedding), but it can’t cope with any significant level of genuine community transmission.

Appreciation of the limits of manual tracing led to the development of digital tracing options which introduced some level of automation to the tracing process.

Early on, the New Zealand Government seemed on board. In early March it announced that a locally developed contact tracing app was two weeks away. But by mid-April, perhaps because the Level 4 lockdown seemed to have the virus under control, high-tech tracing options appeared to have been put on the back burner. As we moved to Level 2, businesses were encouraged (the level of encouragement was always unclear) to keep records of those who visited. Names and addresses and times were kept by some but not all businesses, often on paper lists to be managed by the business in ways which were never very clear (and certainly without clarity about whether the businesses had the capacity or processes to manage the information they were perhaps required to collect).

The idea was that if someone was confirmed to have the virus, they could tell a tracer where they had been and that tracer could contact the business to see who had visited around the same time. Those contacts could then be tracked through the paper records held by businesses they had visited, and so on.

This was always pretty hopeless. The record keeping was haphazard: some businesses had them, and others didn’t; there was no check on the accuracy of the lists; and had there been a confirmed case, there’s no reason to think manual tracers would have had any hope of keeping up.

And when the NZ Covid Tracer App did appear, it turned out to be little more than a digital version of this inadequate paper process, offering little to address these failings. It requires people to scan a QR code when they visit a venue, creating a log of where they’ve been and when. The system has never been used by every business (let alone every customer); there is no way to check whether a customer who waves his smart phone at the QR Code (when there is one) has the app; the process does not record contacts at places like bus stops and social gatherings.

And, most importantly, it still relies on manual tracing. In the event of a confirmed case, the digital diaries the app generate are to be accessed by manual tracers. The ‘back end’ is essentially a person with a telephone and an address book.

There has been, from the outset, ambiguous talk that the app might evolve into a 'true' tracing tool, and there was talk of tweaks that would allow users to know whether they crossed the path of a confirmed case. And there is still talk of a more sophisticated Covid Card.

The Government has been offered more sophisticated apps and processes. They vary, but the key is that they automate the collection of information that allows those exposed to the virus to be contacted. Some, for instance, involved a Bluetooth app that exchanges encrypted contact information when they come within a specified distance of another device on which the app was installed and maintain that proximity for a specified time. The exchanged information remains on users’ phones for the period that someone with the virus might have transmitted it to others. At the end of that period the information is automatically deleted. If one of the app users is diagnosed with Covid-19, a health professional gives them a code which automatically sends a signal to all the apps for which it held contact information: i.e., it would tell everyone who had been proximate to someone confirmed to have the virus that they may have been exposed, without manual tracing.

The sophisticated tracing apps do not require users to do anything once they have downloaded the app and enabled Bluetooth, and they do away with manual tracing. They can keep up with exponential growth in a way no process that relies on manual tracing can manage.

All these more high tech approaches raise issues that need to be addressed. They require technical and institutional privacy protection. Information must be held and processed securely, and the apps must be used only for Covid-19 management. They require implementation in ways that respect the autonomy of users through adequate consent processes and which address inequity in access and potential stigmatisation.

And - just like the NZ Covid Tracing App - they require a minimum level of uptake; one typical smart phone version required about 60 percent of smartphone users to use the app.

Ironically, while the Government and its consultants mentioned some of these issues while explaining their preference for lower-tech options, many of them are raised at least as clearly by those options – without the countervailing potential effectiveness.

The pencil and paper lists kept on store counters and who knows how by business owners afterwards would pass no stringent privacy test; there is simply no guarantee that the information gathered under any of the processes will not be used for other purposes or retained indefinitely; and they all require (and appear to be failing to secure) minimum uptake.

Issues which appear to have led the Government to turn its back on potentially effective high-tech processes have been happily brushed over for less technical – and less effective – alternatives.

The Government has at times had an extraordinary level of public support for the management of Covid. There has been a sense that we have been engaged in an important community endeavour. “Jacinda and Ashley” could have brokered the introduction of safe, effective, sophisticated, contact tracing technology. As the gilt has worn a little, that will be harder: there is less trust, less sense the Government has a plan. Countries who have less commitment to autonomy and privacy have simply compelled data collection. For us, all the options from here on require buy-in. If people aren’t confident there is a clear and coherent plan, they’ll leave their Covid Cards at home.

But it may not be too late. It is not enough, however, to encourage people to use an inadequate system. To secure uptake, without compulsion, people need to be convinced that the system they are being asked to use will deliver genuine benefits. The real problem with the NZ Covid Tracing App is there is little reason to think it meets that standard. The Government should use its considerable credibility behind an option that really will do the job.