New Zealand is Covid-19 free, but the government still wants us tracking where we go and what we do on the NZ Covid Tracer app. In this two-part series we examine the digital tools designed to help us navigate this new threatened world we live in. In part one we investigated the effectiveness of contact tracing technology. In part two we ask if app-based contact tracing is putting our personal privacy at risk.

“I rang my doctor at 10.30am and at 12 o’clock I had an appointment at the Covid testing station.”

Policy director Kim Connolly-Stone from Internet NZ came down with flu-like symptoms so, following the government's advice, she got herself tested for Covid-19.

“You drive around the back of the emergency doctors and they’ve constructed a thing over the carport with heavy plastic. And then a doctor came out in full PPE and told me to wind down the window. You lean your head back and they wham this long cotton bud right into the back of your head.” 

She was told to expect a text message within two days if she was negative, or a call if she was positive. Kim was impressed with the process - for much of the Covid-19 epidemic she had felt like a bystander, but it hit her that she’s very much involved.

Kim’s job is to be skeptical about technology, ensuring it’s used to enhance the lives of New Zealanders. She says there is a big gap in people's awareness about online data privacy. 

“People are not conscious about the amount of data that is being gathered on them.”

Prior to the launch of the government’s Covid Tracer app her organisation organised an online town hall meeting for people to voice concerns, and published two papers for the government to consider.

They were surprised at the number of people who participated, and the breadth of their worries. “Will this thing work? Will there be oversight? How would personal data be used? Who has access to that personal information?” 

“Right now we are being told that only public health officials have access to that and it's just a question of whether we trust that to be the case.”

She is pleased the app that was launched was fairly basic. “What the government has done is create a solution that doesn’t raise a lot of alarm bells, but the idea is to build on this over time and add more features. That’s why it's important that they are really transparent about what they are considering next.”

We trust in contact tracing

While New Zealand enjoys our current zero cases status, the government is still building capacity to contact trace 1000 cases per day in readiness for another outbreak. The Ministry of Health’s NZ Covid Tracer app is intended as a vital tool for this. Trust from the New Zealand public is high - a poll found only 20 percent of respondents said they wouldn’t download the app, with reasons ranging from concerns about privacy, accuracy, data use or simply not having enough space on their phone.

Investigative journalist Nicky Hager believes we’re being too trusting. “Covid has shown that our rights are malleable.” He has concerns about what might happen if we continue handing over large amounts of data about ourselves. “When data starts to be collected by a state authority often it ends up being used by the wrong state or authority. It’s not what they say when they start, but then you get a change of government, you’ve got a different minister and you find that people who were never going to get access to that data do get access to that data.”

This isn’t an abstract concern for Nicky - he has been actively surveilled by police. In 2014 his property was raided by police, an act that the High Court later found to be unlawful. Police also admitted to inappropriately obtaining his bank records. Four years later they apologised and compensated him for the incident. 

One of the recent papers developed by Internet NZ expressed concern the contact tracing app could be used “to target minority groups or dissidents”. The paper sought more answers from the government around the scope and duration of contact tracing. It asked “how do we roll back the mechanisms being introduced during the crisis?” and went on to say “the government needs to articulate how long the measure will be in place.” 

Nicky agrees, “it sounds far fetched but then it happens”. But he also says that’s not the only possible outcome, pointing to the census as an example of a system where we voluntarily give up information about ourselves to the government out of a sense of trust and public good. “When you fill out your census form, even though you know that data is going to be raked over by researchers in all sorts of very minute ways, it's not going to affect our personal privacy because it's a good system, there’s good public policy there.” 

Digital surveillance is nothing new

Nicky’s concern is if we start to collaborate with other countries and let their aims shape how our app works - that’s what will lead us into dangerous territory. He describes how in the 1990s as cellphones were entering the market and America began to drive global legislation and systems around how they operate, they built in the ability to surveill our call history and location data into the system. They then set about lobbying other governments to adopt these laws to grant them international access to our phone records.

“I got all the documents about it and New Zealand Police were quite resistant to it,” says Nicky. “But in the end the pressure lead to them eventually standardising it here to the point where at any time that call data, all your text messages, where you were standing relative to the cellphone towers, all the calls you’d made four to six months back, is available to police - the companies were forced to build this into their mobile phone networks.”

He believes there is a risk this could play out with contact tracing apps. “If we start getting caught up with other countries, those countries are less likely to be thinking about privacy.”

As New Zealand readies itself to engage with a world still ravaged by the virus, our border is now our bubble. As we contemplate merging that bubble with other countries, New Zealand has to consider what technologies to adopt to prevent reintroducing the virus to our shores. From the outset the Government has said that functionality will be added and that this may include Bluetooth functionality similar to Australia’s CovidSafe app. 

If a Bluetooth enabled app is next, how would it work?

Privacy Commissioner John Edwards is satisfied that the government is cautiously considering these concerns by gradually implementing new features into their app. “What they are trying to do with their incremental release is meet the immediate needs of contact tracers and add functionality as the case is proven.”

“Singapore very quickly developed an app that used that technology and it became the model around the world for a lot of countries. A couple of weeks later we saw Google and Apple in an unprecedented joint venture standardise Bluetooth across Android and iOS. A lot of countries are looking to them to inform the basis of their system. So if the government is satisfied that it can make a useful contribution then I’m sure they will work on developing something.”

John says it remains to be seen how a Bluetooth app might function in New Zealand but describes two potential scenarios. One is the centralised system which could see all the information generated by a Bluetooth contact tracing app uploaded and kept on a government database. The other decentralised system could see that information kept just on the phone, and if you were diagnosed with Covid-19 the alert would go directly from your phone to the phones of anyone who you had come in contact with. To keep track of who is who, each system would likely use randomised codes rather than personal information or phone numbers. 

There are both publicly-run and privately-run possibilities

Even if the government chooses not to integrate a Bluetooth option, that won’t prevent a private company-run app from doing it. When asked whether we can trust phone manufacturers with this responsibility John points out that we’re handing over vast amounts of information about ourselves already. “Every time you enter an address into a maps app on your phone and let it guide you there, you are being tracked by that company. We have accepted into our lives a certain degree of surveillance as a tradeoff for access to many potential tools.”

John warns that any exploitation of that data could seriously threaten our ability to contain the virus. “If businesses or the government start using that information for unrelated purposes that can break that trust and really undermine our ability to manage the pandemic.”

But Nicky sees this as a frightening end-game. “If we give data like that to companies based on US soil, I can’t think of anything worse. The more data we put on US soil, the more easily it will be spied on.” Under US law, Apple or Google are compelled to hand over information to American government agencies if there is a national security concern. “Our GCSB uses that. If they want to track someone they just send a memo to the National Security Agency [in the USA].”

Whether a future Bluetooth tracing app is government-run, or run by a private company, Nicky would like to see more constraints put around it. “The important part is that they turn it off at the end of the epidemic. If it was left on for next time, that’s a road that leads to all sorts of bad things; an extension, then another extension, then an expansion, then an amalgamation with other countries and then there’s arguments for other uses for it and they decide to keep it.”

In a statement to Re: the Ministry of Health said “Any personal information [users] choose to provide to the Ministry will be held for the duration of the pandemic response only, except where this is added to their Health Record. For example, if they test positive for COVID-19.”

Nicky has questions about whether this is necessary at all at this point. “It’s totally justified if it’s going to save lives and it's done in a really scrupulous way but we’re not in level three or four anymore, so why exactly are we doing this? Is this going to make enough difference? Is it justified?”

Is the app the right solution for Māori?

Andrew Sporle is a Māori health researcher at the University of Auckland and a founding member of Te Mana Rauranga, the Māori data sovereignty network. He is concerned that a digital solution to Covid-19 is the wrong one for Māori.

He points to the most recent census as an example of the Government deciding to replace an effective door-to-door system with an online system. The ‘digital first’ strategy led to the lowest census result rate in 50 years. An independent inquiry found numerous flaws in the process, which lead the government's Chief Statistician to resign.

He says barriers to access were the main hurdle in that instance and thinks the same fate could easily befall the government's contract-tracing app. Creating an app assumes that all people have smartphones, have credit on that phone and the cellphone coverage to use it. Many low-income and isolated Māori communities do not. Andrew says within his whānau he would be the only person able to effectively download and use the government’s app.

“What you end up with is the ones who need it the least get it the most.” He jokes that those most likely to use the app are “worried, white, wealthy and well” yet it’s rural Māori communities who are likely to suffer if the virus returns in force. Modelling by researchers at Te Pūnaha Matatini has found isolated Māori communities in New Zealand are particularly at risk from a second wave. Their research found that Māori would be twice as likely to die from Covid-19 than non-Māori.

Singapore was on the verge of beating Covid-19 when a deadly second wave swept through their migrant worker community. The country had adopted one of the most far-reaching digital contact tracing apps but migrant workers, often living in cramped quarters without smartphones were a blindspot who were badly impacted by the virus, leading the country back into lockdown. Andrew is concerned a similar situation could play out here, especially if we lean on the app as the ultimate solution.

“There’s no way that a contact tracing app would work for Māori communities. We actually need boots on the ground with local knowledge. Technical solutions disempower local communities to contribute.”

He’s also worried that increasing state surveillance will unfairly impact Māori and that if you view data as a taonga then it goes against the Treaty of Waitangi. “Data is like land, once it's gone it's hard to get back. It needs to be protected, and we also need access to the data that is collected about us.”

The Covid-19 response bill that was rushed through parliament granted police sweeping powers to enforce lockdown rules. Andrew is concerned police will have had access to information collected by the Ministry of Health, and will retain that personal information after the pandemic has ended. “There is a lack of clarity around sharing it between agencies. If it needs to be shared how long will that last? Will it be deleted?” He’d like the government to ensure that any personal information gathered by the Ministry of Health stays with the Ministry of Health.

Transparency and consultation are key to any next steps

Within 24 hours of getting her test, Kim Connolly-Stone from Internet NZ received the text message to let her know she was in the clear and didn’t have Covid-19.

Now as we move into Level 1, she says contact tracing has come into its own but it's still unclear what the government's intentions are for the app. Director-General of Health Ashley Bloomfield indicated that the Ministry of Health is currently developing functionality to allow the app to push out to other phones when someone has been diagnosed positive, but hasn’t determined how exactly it will do this.

Kim doesn’t believe that Bluetooth functionality has proved itself worthwhile for us to add. “What we’re seeing in Australia and Singapore is that Bluetooth contact tracing is not really helping with the public health response.”

When the government released the first iteration of the Covid-19 contact tracing app, they bypassed public consultation and released the privacy assessment on the same day. Internet NZ has encouraged the government to change their approach going forward to allow New Zealanders to feedback on what’s being suggested before it’s implemented, and ensure there is a legal framework for people to challenge how their information is being used. 

“It’s easy to think, well, we’ve got a good government here and nothing like this will ever happen, but you just never know what will happen here in the future. If we have that transparency and that oversight then there’s just no risk of that.”

This is the second in a two-part series on Covid-19 contact tracing and privacy. To read part one, head here. 

Graphics by Timothy Armstrong, @tfarmstrong on Instagram.

This project is made with support from the Aotearoa NZ Science Journalism Fund