Responses to Covid-19 have largely been led by local, national, and international public health agencies, who have activated their pandemic plans and opened the epidemiological toolkit of modeling, testing, isolation and movement restrictions, surveillance, and contact tracing. When it comes to contact tracing, it's natural for people to see the tech-heavy world around them, then hear about the common manual process of human investigators and phone calls, and ask, "Why can't technology help make this better?" But it's not as simple as "add more technology." The complex way in which users and societies interact with the technology has significant impacts on its effectiveness. When efforts are not well coordinated, leading to fragmentation in system design and user experience, the public health response can be negatively impacted. This article briefly covers the journey of how contact-tracing registers and digital diaries evolved in New Zealand, how the lack of central coordination led to poor outcomes, and ultimately how this was improved.
Dr. Ayesha Verrall notes that "rapid case detection and contact tracing, combined with other basic public health measures, has over 90 percent efficacy against Covid-19 at the population level, making it as effective as many vaccines" . Contact tracing involves identifying people who have been in contact with an infected person, and therefore who may have been unknowingly exposed to the infectious disease. By identifying the contacts and rapidly isolating and testing those individuals, the chains of transmission in the community are cut off, limiting the spread of the disease. Contact tracers must find potential contacts who are unknown to the infected person and can do this only by tracing the movement of the person to find others who may have overlapped in time and place.
With the pervasive nature of digital technologies, there has been a lot of discussion globally around digital contact-tracing solutions, particularly Bluetooth-enabled smartphone apps, including the Apple/Google protocol, and wearable devices [2,3,4]. Proponents of the technology offer the promise that these solutions can achieve better completeness (finding more contacts of cases, especially where the identities are unknown to the case) and speed (finding contacts and testing/isolating them faster). However, in the absence of a validated, effective digital contact-tracing solution initially, a number of governments opted for simpler, lower-tech methods of collecting data about people's movements.
The contact-tracing register (or visitor/customer check-in log) has been deployed around the world (Figure 1). Individuals are asked to provide their personal details at businesses and other places of interest, so that if a venue is identified as potential exposure site, then the register can be provided to contact tracers to quickly find people who were there at the relevant time. Digital diaries have also been introduced to help people keep track of their own movements to support their recollection if they are interviewed by a contact tracer—the distinction being that instead of the venue or the government holding the records, the individual themselves maintains and controls their logs.
|Figure 1. A pen-and-paper contact-tracing book along with two QR codes for digital diaries in Wellington, New Zealand.|
In New Zealand, a strict Level 4 lockdown was implemented across the country on March 25. Most people, with the exception of essential workers, stayed at home. Given the high level of compliance, the number of active cases began to fall within two weeks. After four weeks, on April 27, some restrictions, particularly around schools and takeaway food services, were eased at Level 3, and then most restrictions were lifted at Level 2 on May 13—with the exception of physical distancing and gathering limits. As the country moved into Level 3, the government introduced a requirement under the Public Health Response Order for all businesses to maintain contact-tracing registers. These registers required visitors and customers to provide their entry and exit times, name, address, and contact details to the business in case they were needed for contact-tracing purposes. The government provided a template for businesses to print and use.
A number of criticisms were leveled at the pen-and-paper contact-tracing registers that most businesses used initially. Customers had to provide their personal information on a piece of paper that was visible to all customers, creating a privacy risk. This led to real privacy breaches: In one instance, a male restaurant worker took the contact information of a female customer from a contact-tracing register and harassed her . There were also some concerns about dirty pens (if everyone is using the same pen, could that become a vector for virus transmission?), usability (can people be bothered to provide their details at every business they visit?), validity (what if people provided false details?), and enforcement (can a business deny entry to someone who refuses to share their information?).
Private software developers took the initiative to come up with better solutions. They reasoned that most people have smartphones (NZ has 80 to 85 percent smartphone penetration), and that using digital tools would mitigate or resolve some of the risks associated with pen-and-paper approaches. Within a week, more than 30 tools were available, almost all using QR codes, with a variety of system architectures and user flows. Some QR codes directed the user to a URL (thus requiring a mobile Internet connection); others required a specific standalone app to interpret the code. Some stored the data on a central server owned and controlled by the developer; others stored the data on the phone for the user's reference, but only in a decentralized way (i.e., the "digital diary" approach). Some collected only a name and contact email address; others also asked for phone numbers and residential addresses—it was unclear what would be genuinely necessary for contact tracers to find people. Some tools were offered for free; others required businesses to pay a monthly fee; and two of the largest city councils bulk-purchased licenses of one product for businesses in their cities. Some providers had developed full privacy policies, and others said speed-to-deployment was more important. Unfortunately, there was duplication of effort, and many developers found themselves reinventing the wheel and then struggling under the burden of providing tech support for their products.
Almost every business soon adopted a QR code from one of these private providers. But with very little coordination or information around which systems were trustworthy or superior, chaos ensued. A lack of familiarity with how QR codes work among the public also led to significant confusion, with people getting frustrated when some QR codes worked and others didn't. Further complicating matters, a number of the QR code posters used similar branding, such as the yellow diagonal stripes in government messaging about Covid-19 (Figure 2)—some posters even used government logos to make their posters look more official. Most of the systems had centralized approaches, which also led to concerns about security and the potential for unauthorized reuse of data held by private corporations. Some businesses simply created Web forms and added clauses in their privacy policies that allowed them to reuse the collected data for marketing purposes, earning them a stern rebuke from the privacy commissioner. However, an interesting counterargument was that since there were so many different tools, the data was fragmented between different providers, and therefore no single company held too much data.
|Figure 2. Photos of various QR codes from different providers in New Zealand (crowdsourced by the author from Twitter).|
The undirected approach also translated to insufficient consideration for the needs of marginalized people. Posters were sometimes placed in positions that were inaccessible for disabled populations. Some businesses removed pen-and-paper registers entirely, making it impossible for participation by the digitally excluded—people without smartphones, or without the skills to effectively use the smartphone, or without expensive mobile Internet data. There was also some confusion about whether or not digital-diary approaches (with the data staying on the device) complied with the regulatory requirement for businesses to maintain registers.
On May 20, a week into Level 2, the Ministry of Health launched the NZ COVID Tracer app (https://tracing.covid19.govt.nz/). This is also a QR-code-based system with a digital-diary approach. The app is accompanied by its own QR code standard, which contains a unique global location number for each business, and therefore can be scanned without an Internet connection. Data about check-ins (where people had been at what time) stays on the device, and the user can choose to release that information to a human contact tracer if identified as a close contact of a known case. The app also allows individuals to provide up-to-date contact details to the Ministry of Health, which would help contact tracers find them more quickly if necessary.
Unfortunately, QR codes were everywhere by this stage. Some businesses tried to provide multiple options (as shown in Figure 3) with clearer instructions. But this didn't eliminate confusion about the proliferation of QR codes. The two loudest complaints about the government app were that 1) it wasn't compatible with older devices (requiring at least Android 7.0 or iOS 12 at launch) and 2) the app didn't recognize most of the QR codes that were available (Figure 4). The government app wasn't designed to work with the other QR codes (which, from a technical perspective, might seem obvious, but for nontechnical folks was bewildering). Displaying the government QR code was not mandatory, so many businesses didn't even have it as an option.
|Figure 3. Businesses attempting to provide clearer instructions on which QR codes to use (crowdsourced by the author from Twitter).|
|Figure 4. Screenshots from users complaining that the NZ COVID Tracer app wasn't recognizing the QR code, when they were in fact scanning QR codes from other providers (crowdsourced by the author from Twitter).|
This fragmentation created a sense of redundancy, harming the uptake of the government app. People felt existing tools served the same purpose. Within a week of the launch, about 380,000 users were registered, equivalent to approximately 10 percent of the adult population of 4 million people. Registrations plateaued, hovering a month later at around 570,000. Meanwhile, the number of QR codes scanned each day was counted through Web analytics events, slowly ramping up initially as businesses started printing and displaying government QR codes, settling at around 50,000 scans per day in early June. Given the size of the population, this was clearly not enough activity to inspire confidence that app-generated data would prove useful in the event of a further outbreak. However, the government app was the only one that reported statistics about usage; we don't have data about how widely other tools might have been used.
It turned out the government app had actually been in development with a private-sector partner for at least a month. The specific reasons for why the app was released late remain unclear. We do know the government is bound by higher standards and needed to prepare a full privacy-impact assessment, undergo an independent security audit, submit the app to the government cybersecurity bureau for review, and complete other steps that weren't required for private developers.
By July, it appeared that we had the pandemic under control. New Zealand experienced 102 days in a row without any community cases of Covid-19 detected. The prime minister moved the country to Level 1, lifting almost all restrictions except for border controls. Most people became complacent around the risks of Covid-19, with daily scan counts dropping to 10,000 in early July. There were even reports that some businesses were taking their posters down because they felt the QR codes were no longer necessary.
An improvement to the app in June introduced exposure-notification functionality. Contact tracers could identify and securely broadcast a place and time where an active case had been, and then the app would check that against the check-in logs on the device and notify the user if an overlap was found. In late July, a further improvement was made to allow users to add manual entries, mostly to account for venues that did not have a government QR code. However, while there were minor upticks in registration and usage after these releases, the activity level still remained very low.
On August 11, the prime minister announced that four cases of community transmission had been found in Auckland (the largest city in New Zealand). There were no links to overseas travel, so it was highly likely that there were other undetected cases in the community. Given the recent experiences of places like Victoria, Australia, where second waves grew quickly, the government implemented a second lockdown , with stricter movement restrictions in Auckland. The next day, they also announced that displaying an NZ COVID Tracer QR code in a prominent place would become mandatory for all businesses by the following week. It would still be optional for individuals to scan, but the codes had to be available. This decision wasn't without precedent—Singapore required its SafeEntry QR codes to be displayed at all businesses in May .
This announcement caused three things to happen over the following week. First, the private developers with the most prevalent QR codes agreed that consolidation was necessary and advised their customers to switch to the government QR code. Second, businesses largely complied, with the number of government QR codes increasing fourfold over the subsequent two weeks (from approximately 87,000 to 324,000). Third, the presence of the disease in the community in New Zealand and the accompanying lockdown elevated the seriousness of the situation, and more people began to scan the NZ COVID Tracer Qr codes.
The number of daily scans shot up, from approximately 30,000 per day before the second wave to more than 2 million per day (Figure 5). The number of registered users also increased, from 640,000 before the second wave to just over 2 million users (approximately 50 percent of the adult population, although duplicate registrations are not accounted for) as of September 4. While the change in context was a significant driver for shifting user behaviors, moving away from the fragmented system clearly helped increase participation in the system too.
|Figure 5. Daily scan counts from the NZ COVID Tracer app, overlaid with significant events. Data sourced from the NZ Ministry of Health.|
Unfortunately, this increase in participation came too late to be of significant help for the second wave. In the event of an outbreak, contact tracers need at least 14 days of movement logs for infected cases in order to help find close contacts. While the government did use the app to publish six exposure notifications, and some close contacts were found faster because they had updated their contact details, it seems that ultimately the app is yet to find significant numbers of close contacts or new cases. As New Zealand now comes out of its second lockdown at the time of this writing , we can only hope that the current level of participation continues to grow for NZ COVID Tracer and is sustained long enough to help defend against a potential third wave of cases in New Zealand.
When a global pandemic catches the world by surprise, a strong response is needed to contain, mitigate, and recover from its impacts. The public expects government to play a leading role in coordinating this response, but many individuals also want to do something to contribute. While people are to be lauded for utilizing their skills to support the broader community, undirected efforts can lead to confusion and duplication of effort, and ultimately harm the overall response. This is not the fault of the individuals—the responsibility lies with the public health agencies to make good use of the available resources and to clearly communicate with people about what is and isn't needed. Normally, competition between private entities in the open market might be desirable to drive innovation, but in a pandemic, we really need something that just works and supports progress on public health outcomes.
In a country that has had strong communication with the public overall, the confusion around contact-tracing registers has been an unfortunate blemish for New Zealand. This case study shows that fragmentation can lead to disparate and negative user experiences, which can harm trust in the system and lead to low participation. In the context of a global pandemic, trust is one of the things we need the most for an effective response.
The author thanks the local Twitter community for contributing their images of QR codes to the dataset, and for engaging on digital contact tracing during the Covid-19 pandemic. The author also acknowledges members of Koi Tū: the Centre for Informed Futures for discussions around the use of technology for contact tracing.
1. Verrall, A. Rapid audit of contact tracing for Covid-19 in New Zealand. New Zealand Ministry of Health. Apr. 20, 2020; https://www.health.govt.nz/publication/rapid-audit-contact-tracing-covid-19-new-zealand
2. Wilson, A.M. et al. Quantifying SARS-CoV-2 infection risk within the Apple/Google exposure notification framework to inform quarantine recommendations. medRxiv. Jul. 19, 2020; https://www.medrxiv.org/content/10.1101/2020.07.17.20156539v1
3. Asher, S. Coronavirus: Why Singapore turned to wearable contact-tracing tech. Jul. 4, 2020; https://www.bbc.com/news/technology-53146360
4. Alkhatib, A. We need to talk about digital contact tracing. Interactions 27, 4 (Jul.–Aug 2020), 84; http://interactions.acm.org/archive/view/july-august-2020/we-need-to-talk-about-digital-contact-tracing
5. McRoberts, M. Auckland woman 'creeped out' after restaurant worker uses her contact tracing details to hit on her. Newshub. Nov. 5, 2020; https://www.newshub.co.nz/home/new-zealand/2020/05/auckland-woman-creeped-out-after-restaurant-worker-uses-her-contact-tracing-details-to-hit-on-her.html
6. Coronavirus: New Zealand locks down Auckland after cases end 102-day run. BBC News. Aug. 12, 2020; https://www.bbc.com/news/world-asia-53741091
7. Sharwood, S. Singapore to require smartphone check-ins at all businesses and will log visitors' national identity numbers. The Register. May 4, 2020; https://www.theregister.com/2020/05/04/safe_entry_singapore_visitor_logging/
8. Brockett, M. New Zealand's largest city exits lockdown after bringing mystery COVID-19 surge under control. Time. Aug. 30, 2020; https://time.com/5884996/new-zealand-auckland-coronavirus-lockdown/
Andrew Tzer-Yeu Chen is a research fellow with Koi Tū: the Centre for Informed Futures, a transdisciplinary think tank at the University of Auckland, New Zealand. His background is in computer engineering, investigating computer vision surveillance and privacy. His research interests now sit at the intersection of digital technologies and society. email@example.com
©2021 ACM 1072-5520/21/03 $15.00
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee.
The Digital Library is published by the Association for Computing Machinery. Copyright © 2021 ACM, Inc.