Bluetooth Covid tracing: Big Brother’s not looking
As NZ app update built by tech giants goes live, watchdog offers reassurance
The Government’s NZ Covid Tracer app has finally gained Bluetooth tracking (as first revealed by the Herald on November 15). Should you be worried about Big Brother recording your every move? The short answer is no. Firstly, the new feature is opt-in, so if you’re paranoid, you can simply leave it switched off, as it will be by default.
But you should not be suspicious. The first thing you need to know is that Bluetooth tracing does not record everywhere you go — just your close contacts with other people who also have Bluetooth enabled. In the event of someone getting a positive Covid diagnosis, their close contacts can be alerted, without the identity of the infected person being revealed.
Privacy Commissioner John Edwards — who has been no slouch at giving Big Tech the bash when warranted — says the tracing solution the Ministry of Health has chosen, which was co-developed by Apple and Google, is not snoopy or invasive.
“No personal information is shared with Apple or Google,” Edwards says.
The privacy safeguards in the app’s Bluetooth tracing function mean a phone keeps a coded record of other phones with the app which come near it, but it does not collect any identifying information. This information remains on a user’s phone for 14 days and is not disclosed to the Ministry of Health unless a user gives their permission.
Edwards notes that this week’s update follows an earlier privacyfriendly adjustment — the removal of the requirement for people to register their details when downloading the app on to their phones.
A squad of academics say the Privacy Commissioner is right. AUT computer science professor Dave Parry, for example, says: “Apple and Google have developed a robust, secure and privacy-preserving system and it’s good to see the NZ Government adopting this. There is no real risk to privacy, at each stage you have to choose to release your data and all the tracing centre knows is the original person who tests positive — which they know anyway.”
Dr Andrew Chen, a research fellow with Auckland University’s Koi Tu¯: The Centre for Informed Futures, The University of Auckland, reinforces that the Bluetooth system we’ve adopted makes users totally anonymous to each other (as well as Apple and Google).
He notes the system will give each phone an ID number for each day.
If someone gets infected, then their phone’s ID number will be placed on a Ministry of Health online register, which every NZ Covid Tracer users’ phone will check several times a day.
If the app discovers you’ve been in contact with an infected person, you’ll get an alert — which could differ depending on circumstances. A glancing contact could generate a message saying you should call health authorities, for example, while an hours-long contact would result in an alert to seek a test immediately.
Parry also praises the fact the Bluetooth tracing upgrade is open source: meaning experts can analyse it en-masse to warn about any potential security holes.
But although they reassure on privacy, most experts also warn that Bluetooth tracing is by no means perfect on other levels.
AUT business information systems lecturer Dr Farkhondeh Hassandoust warns: “Despite the benefits of Bluetooth technology in the NZ Covid Tracer app, there are some potential issues with this functionality.
“For example, environmental factors may affect the accuracy of Bluetooth. Bluetooth signals may collide with walls and be absorbed by our clothes. These factors could potentially confuse the contact tracing capabilities, making a Bluetooth device that is two metres away appear to another device as if it is 10 metres away and vice versa. Therefore, there are risks of the upgraded app showing false positives and false negatives.”
Otago University public health professor Nick Wilson says because of those kinds of practical drawbacks with smartphone-based Bluetooth tracking, it is important the Government pursues other measures too, including data from phone networks, plus token or card-based Bluetooth tracking — such as the Covid Card pilot in Rotorua.
The upgrade is live for phones running Google’s Android software now (that is, Samsung, Oppo, Sony, LG and almost everything outside of Apple. The Ministry of Health warns phones made by Huawei could be an exception. US sanctions mean the Chinese phone maker no longer has full access to Google services.)
A Ministry of Health spokesman says the Bluetooth update should be available for iPhone users “very soon”.
Once it is available, you’ll get a message the next time you open NZ Covid Tracer.
Upgrading is a one-click process, but if you have any problems, the Ministry of Health has a troubleshooting guide.
The rationale for embracing Bluetooth tracking has been welltrodden by this point.
Most people have downloaded NZ Covid Tracer, but even during lockdown scares, there have never been more than 1 million active devices per day. The daily average so far this month is 388,000. Only 8 per cent of app users bothered to scan any codes on Monday this week.
Bluetooth tracing won’t be perfect, given the number of different makes and models of phones involved, and the fact some are buried in bags or pockets — which is why the MoH wants people to keep scanning QR code posters. But it will fill in a lot of the gaps in the fallible human memory.
The two systems are complementary, regardless: QR code posters record where you’ve been, while Bluetooth tracing record who you’ve been in contact with.