Small business Q&A
in our battle to beat pandemic
Tania Schrey, general manager of e-commerce business Pet Depot, talks to Aimee
Shaw about how the Covid-19 pandemic has affected consumer spending and the positive impact the deadly virus has had on the business, which is expected to be profitable in the next six months.
What does your business do?
Pet Depot is an online business that delivers pet food and flea treatments straight to our customers’ front door for their cats and dogs. The business started in June last year so we’re nearly one year old and we’re based in Takapuna, Auckland. Our warehouse is located in Hobsonville Point.
What was the motivation for starting it?
In my previous role I was marketing director for the Pet Doctors group of vet clinics. With the really high, and growing, rate of companion animal ownership in New Zealand, we felt it was a really good opportunity to provide a convenience of having pet food and flea treatments delivered. This is a category that can within reason weather economic fluctuations because pets are so important to people that they would quite often give up something for themselves [for their] pets.
How big is the team?
It’s a very lean team; me and another full-time equivalent split over two different roles, then we have our third party logistics partners that pick, pack and dispatch our orders and an IT partner who manages our system requirements.
How has the Covid-19 crisis impacted the business?
We’ve noticed an increase in our sales. We were really fortunate that the Ministry of Business, Innovation and Employment granted us essential service status during level 4 lockdown, so we’ve used this time to really connect with our customers and we’ve been doing free delivery on all of our orders until the end of May to help people out. We’ve also introduced laybuy for those who require a bit of extra time to pay for their products. This has been a really good opportunity for us to service people while they are in their bubbles and get people who haven’t previously shopped online for these products to give it a go. We’re finding that some of the new people to use online shopping are quite enjoying the experience. Looking at some of the delivery addresses coming through, we’re now delivering to retirement villages and are getting calls from people who aren’t familiar with shopping online. We’re getting to communicate with our customers regularly which is really nice for an online business. We’re certainly picking up new customers and we are seeing growth. We’re seeing growth for a few reasons, obviously people have restrictions on their lives and having to stick in their bubbles, but also because we sell products that aren’t available in supermarkets, as we do food for prescription diets and specialty premium food.
How have consumers’ spending habits changed during lockdown?
We’re getting good volumes of orders coming through and the average orders are certainly up around the level we had before lockdown. What we’re seeing now is people are buying multiple products per order; that’s what has changed during lockdown.
What are your long-term plans?
We want to continue to grow really quickly, but we only distribute within New Zealand at this point. We’ve just partnered with SPCA so what we’re doing there is we are their retail partner, so once we make a profit — which we anticipate will be in six months — then 30 per cent of our total profits will go to SPCA. It means that every item we sell on Pet Depot will help animals with SPCA, which we’re really pleased to be doing. From a business perspective, the SPCA is incredibly well trusted so we want to make this partnership mutually beneficial and build our business at the same time. The ultimate goal is to be able to move funds to SPCA.
What advice do you give to other people who want to start their own business?
outside their permitted area.
China is not alone in employing these technical measures. Countries such as Singapore, South Korea and Israel use a combination of location data, CCTV footage, voice data and credit card information to achieve similar objectives.
When satellite navigation (such as GPS) signals are unavailable, geolocation applications can use information from cell towers to accurately triangulate the approximate position of a device.
Wi-Fi signals can also be used by location-based apps. Recently, the South Korean Government went a step further, announcing they had developed an enhancement which allows patients to be tracked in real time in order to identify exactly how the disease is moving.
India is another country embracing mass state surveillance, both at a governmental and private enterprise level, but with limited attention to privacy. There has been a veritable explosion of contact tracing apps since the country went into lockdown on March 25. An app — Aarogya Setu — requires users to provide access to their location data. People are also required to provide their name, gender and profession, along with details of all the countries visited in the last 30 days. Users are also required to identify whether they are a smoker and enter their current medical condition.
Aarogya Setu warns users if they are in the same proximity as someone infected with Covid-19. The app uses a range of technologies including GPS location data, Bluetooth and the user’s phone number, along with the Indian Council of Medical Research’s database.
Another app, Sahyog, complements Aarogya Setu for purposes of contact tracing. It collates data and employs geo-tagging to improve the analysis of the data.
No less than 19 Covid-19 tracing apps have been released to the Indian market. India currently has around 10 million local users of these apps. Indian companies are developing lucrative export markets for this technology. It is currently being sold to the US, UK, UAE, Bahrain, Kenya, Nigeria and Turkey, to name a few.
Innefu Labs is a Delhi-based software and app developer. The Delhi Police used Innefu’s facial recognition software to monitor the recent protests against the Citizenship Amendment Act. The police in Kerala have purchased Innefu’s Unmaze app. Using location data, the app tracks about 20,000 people who have been infected by Covid-19 and are in quarantine. Using this technology, 3000 people have been caught violating the quarantine and about 200 have been arrested.
In the state of Karnataka in the southwest of the country, the Government has launched “Quarantine Watch”. Everyone in self isolation at home must send in a selfie every hour during the day, to verify they are playing by the rules.
Privacy advocates in India, such as the Internet Freedom Foundation, are concerned about the erosion of fundamental rights, asserting that these apps have a lot in common and amount to the “institutionalisation of mass surveillance”. The foundation warns that there is a real risk that they will devolve into systems of movement control and lockdown enforcement.
Israel is another case in point. Its internal security agency, Shin Bet, is under scrutiny for using individuals’ cell phone location data to track their movements. It has recently emerged that Shin Bet has been collecting this data for some years now for counterterrorism purposes.
This is something we need to avoid in New Zealand. The public must have full trust in the process and the Government must be transparent about its intentions.
The US is also going down this road. Senior White House adviser Jared Kushner has set up a task force. Details remain sketchy. However, apparently the goal is to create a national coronavirus surveillance system. How far state-sanctioned mass surveillance goes remains unclear.
What is however clear is that overt surveillance is becoming a fact of life in many places in the US. For example, the town of Elizabeth in New Jersey has launched a squadron of drones to enforce social distancing. The drones patrol public areas and prevent people gathering. The Police Department has defended its decision to deploy these drones, saying that no recordings are made and no pictures are taken.
Privacy advocates acknowledge that with Covid-19 the US is experiencing a genuine crisis and that people’s health is paramount. But Jessica Rich, a former director of the Federal Trade Commission Consumer Protection Bureau, questions what is happening. She reminds us that surveillance “doesn’t mean we have to destroy privacy”. I agree. The thought of flying robots enforcing crowd control in the US should raise alarm bells.
The National Health Service (NHS) in the United Kingdom is developing its own contact tracing app using Bluetooth. The app picks up chatter between nearby devices. This is regarded as the best way to measure person-to-person contacts. The app identifies those in proximity and automatically notifies people if a user in the group tests positive. The service will also tell people to go home if they are outdoors for too long, thereby ensuring acceptable behaviour and, if necessary, encouraging them to modify it.
Do we need to redefine privacy?
Supporters of this new surveillancedriven approach to pandemic control say that society is facing very significant challenges and that the whole idea of privacy must be urgently reassessed. Their argument is that we already employ surveillance technology to fight terrorism and illegal immigration. They say we simply need to extend it to healthcare — the technology exists, it needs to be used to its full potential to fight this hidden enemy.
Bruno Macaes, a senior fellow at the right-wing Hudson Institute argues that mass surveillance can be used to achieve better health, all we need to do is change our definition of privacy. He says that big data and predictive algorithms are widely used today, and the time has come to expand their use to include
biosecurity, particularly for something as devastating as the Coronavirus pandemic.
The New Zealand Government is under pressure to relax its Covid-19 restrictions. When it does, can the Ministry of Health effectively contact trace those with the virus? What are the options for New Zealand? Do we need to follow the hard-line approaches being followed in China and India?
The answer: no. There is a much bigger issue at play here.
Around the world, the Covid-19 pandemic has become a battleground over whether state surveillance or privacy should take precedence. Some suggest that a workable balance between surveillance and privacy is no longer feasible, nor desirable. The Chinese/Indian approach is plainly an option. But in the long term what is the cost to civil society?
There are other, far more palatable, options. In Europe, a group of countries are developing an app which is privacy-sensitive, called Decentralised Privacy-Preserving Proximity Tracing. However, even though in its infancy, two opposing camps have formed. One is led by Germany, with French support. Its protocol has been criticised as being overly centralised. A rival protocol from Switzerland, supported by other countries such as Spain, is more closely aligned with the Apple/ Google decentralised model.
The Swiss protocol offers a decentralised contact tracing model where all tracing is processed locally. Effectively, all of the relevant data remains on the user’s device at all times. The data is not shared with any central authority. A server pushes data out to devices when an infected person is diagnosed, so that messages can be sent to other devices associated with the infected person.
There is no need for pseudonymised IDs because the system is not centralised. This reduces the privacy risk. Further, the developers believe it will be easier to convince people to trust the system which in turn will lead to larger uptake by the public. It also allows the tracking system to be deactivated once there is no need for it.
The Massachusetts Institute of Technology (MIT) has developed something similar, an app called “Private Kit: Safe Paths”. It operates on the basis that users update the app and declare if they have Covid-19 or not. The smartphone records their movements closely but encrypts this information, which can only be shared with the user’s permission. If a person contracts Covid-19 other people in the vicinity receive a signal, but they do not obtain the person’s name or other personal details. Being a voluntary (opt in) system, Private Kit: Safe Paths needs widespread buyin and support to be effective.
Apple and Google have gone into partnership to develop their own solution. It will use Bluetooth technology, but not track physical locations or otherwise reveal a person’s identity by using anonymous ID keys. It will initially be released with a specialist app but will eventually be offered with the Apple and Android operating systems. It is unclear whether the Google/Apple system will be opt-in based.
Australia and New Zealand are considering using a modified version of Singapore’s TraceTogether app. As with the Google/Apple system, it estimates the distance between other smartphone-enabled apps and the duration of any interactions. Data is encrypted and stored for 21 days.
Privacy concerns have been raised in Australia. The Australian Minister for Government Services, Stuart Robert, has dismissed these concerns saying Australia’s app does not employ surveillance and it is simply digitising existing tracing capacity. In effect, it is replicating manual tracing processes in digital form.
Australian Prime Minister Scott Morrison has also downplayed privacy concerns, stressing that the app will operate on an opt-in basis. Morrison accepts that for an opt-in system the public needs to buy in for it to be effective. That is right. If only a few smartphones are enabled, it is not going to work. Recognising this, Morrison has called on all Australians to treat it as a “matter of national service” evoking memories of the country at war.
The nature of the concerns
Computer scientists and academics in Europe have voiced privacy concerns about using contact tracing apps to monitor Covid-19. Over 300 experts raised concerns in an open letter. They voiced alarm about potential “mission creep” and warned about the potential to unleash “unprecedented surveillance of society at large”. They argue that the best way to avoid this is to prevent decentralised collection of data, particularly technology utilising shared geolocation.
What can we make of Morrison’s assurances that Bluetooth-based solutions such as TraceTogether do not raise legitimate privacy concerns? It needs to be emphasised that these types of systems can still enable surveillance. Indeed, any technology that allows large scale data collection creates this risk. The risk is that individual users’ “social graphs” information i.e. who they meet and when, might be accessed. This would allow hackers to intrude into people’s lives.
South Korea has successfully tackled Covid-19, but in doing so it has aggressively used digital surveillance technology to monitor infected patients. It has also posted location histories of people with the virus identifying their exact movements. This is highly invasive.
We need to decide whether, at a fundamental level, we are prepared to live in a surveillance state. To answer that we also need to know whether the state needs such extensive crisis powers and whether there are better ways of doing this. In my view, it is critical that we find the right balance between naked state power and the maintenance of basic levels of personal freedom and privacy. Before rushing into any hasty and ill-conceived measures we need to consider the following issues:
Purpose identification
Technology should be used for the specific purpose of dealing with the Covid-19 crisis and no more. Access to information should be strictly limited to health department officials and for the purpose of dealing with Covid-19. The legislation needs to be carefully drafted to ensure that data can only be used for controlling Covid-19 and not to enforce lockdowns or quarantines, as is happening in India and China.
The public needs to be assured that their information will be safe and used for the right reason only. Without this, there will be limited buy-in to the scheme and it will fail. Finally, any legislation must be purpose specific and tightly drafted to avoid potential “mission creep” or more properly, in this context “surveillance creep”, where states use a public health crisis as an opportunity to either set up or retain citizen-level tracking infrastructure.
Finite and Limited Duration
The legislation should have a short and finite lifespan and express this commitment in plain and unambiguous terms.
The South Korean Government has given assurances that under its Covid-19 legislation, no more data will be collected as soon as the outbreak is over, and that all personal data collected before that point will be immediately deleted. New Zealand needs a similar provision.
Proportionality
The technology must be designed to ensure that it achieves its technical/ medical objectives, but without invading individual privacy.
Proportionality also demands that if the state is able to collect personal data that this data must be deleted after a set period, along with robust mechanisms allowing individuals to check that the data has been deleted.
Transparency
The system must be transparent, so that the Government and the public are able to understand how the technology works. The public must also be able to ensure that there are no hidden features or back doors, allowing commercial interests or other government departments to access personal data. Whatever system is employed, full technical specifications and preferably the source code should be released to the public. If this cannot be done, third parties acting for bona fide reasons should be entitled to reverse engineer the software to encourage independent scrutiny, but also to assist in fixing bugs.
I understand that the TraceTogether app’s source code has not been made available to allow an independent assessment of its reliability or privacy impacts. This is a concern. New Zealand should not develop its own version of this app without complete transparency.
Accountability
The app developer and the Government should be accountable for the system and the public should have the right to hold the developer and the Government accountable for any privacy breaches.
Macron was entirely justified in describing the battle against Covid-19 as “a war against an invisible enemy”. Even so, we need to be careful that we do not win the war but embrace another enemy, intrusive and pervasive state surveillance. Once extensive state surveillance starts it is difficult, and will one day be impossible, to eradicate.
We need to decide whether, at a fundamental level, we are prepared to live in a surveillance state.