BRIEFING
CovidCard implementation design options
Date:
15 July 2020
Priority:
High
Security
In Confidence
Tracking
2021-0159
classification:
number:
Purpose
This paper explores the high level design options for implementation of a Bluetooth-enabled
CovidCard to support contact tracing.
Recommended action
The Ministry of Business, Innovation and Employment (
MBIE) recommends that you:
a
Note that high public uptake is critical in determining whether a CovidCard could improve
contact tracing methods in New Zealand.
Noted
b
Note the NZ COVID Tracer phone app and Bluetooth-enabled tracing systems overseas all
have low public uptake.
Noted
c
Note MBIE is not confident that the issue of public uptake can be resolved through the
implementation design for CovidCard.
Noted
d
Discuss the high level design options with MBIE officials and indicate whether further work
should be undertaken
Agree / Disagree
e
Forward a copy of this briefing to the Prime Minister’s Office.
Agree / Disagree
James Hartley
Hon Kris Faafoi
General Manager
Minister of Broadcasting, Communications
Commerce, Consumers and Communications,
and Digital Media
15 July 2020
..... / ...... / ......
2021-0159
In Confidence
1
Purpose
1.
This paper explores the high-level design options for implementation of a Bluetooth-enabled
CovidCard to support contact tracing.
Background
2.
The COVID-19 Response Public Private Partnership Group (PPP) has proposed a Bluetooth-
enabled CovidCard to support contact tracing. The CovidCard would record when it comes
into ‘close contact’ with another card (within 2 metres for 15 minutes) and, with consent,
would be given to contact tracers if a cardholder tests positive. Cards would be identified by
serial numbers and would not store personal details. Cardholder contact details would be
stored in a separate database.
3.
The Government Chief Digital Office (GCDO) has been leading the proof of concept work of
a CovidCard, working with the PPP [GDS202000160 refers]. This has involved a technical
independent review of the PPP’s proposal. The Department of Internal Affairs (DIA) is
currently preparing advice on options for an expanded trial of the CovidCard to confirm that
they work as intended at a level of scale. DIA is also examining the value of the information
collected for contact tracing and its epidemiological benefit [GDS202000205 refers].
4.
In parallel with this work, you have asked MBIE officials to lead the development of
implementation design options ahead of a decision on whether to proceed with CovidCard.
Noting that a significant amount of work has already gone into the proof of concept led by
GCDO, we do not address any outstanding questions on the technical feasibility and security
of the CovidCard (noting that these issues are still being worked through by other agencies).
5.
This paper outlines:
•
our understanding of the rationale for digital contract tracing systems and the
CovidCard in particular
•
current contact tracing methods and how a CovidCard could add value
•
factors Government should consider in making a decision on whether and how to
deploy CovidCard
•
high-level design options for deployment (attached as
Annex One).
6.
In preparing this paper, we have drawn on available documents including the PPP’s proposal
document; papers on system overview, security specifications, service delivery platforms and
distribution; papers drafted and commissioned by officials. We also consulted agencies that
have been involved in developing of the proof of concept.
7.
This paper does not examine how the role of contact tracing fits within the broader
Government strategy of COVID-19 elimination, nor what alternative public health measures
could be pursued to achieve Government objectives instead of a CovidCard. We also do not
address the specific business model and commercial arrangements involved with the PPP’s
CovidCard proposal. Any decision to proceed with CovidCard deployment still leaves room
for procurement decisions, including to address security matters, individual elements of the
business model and the details of implementation.
Rationale for digital contact tracing systems
8.
Contact tracing is one of the pillars in the Government’s COVID-19 response strategy
(alongside border controls, physical distancing and hygiene, testing and vaccine).
2021-0159
In Confidence
2
9.
New Zealand has a target of tracing 80 per cent of close contacts within 48 hours of a case
being notified to a local Public Health Unit (PHU).
10. A well-functioning manual contact tracing system is central, as trusted relationships with
cases and contacts is critical for the identification of close and casual contacts and
supporting effective quarantine and isolation. Digital systems are widely considered as
complementary to manual contact tracing, not a replacement for it.
11. New Zealand currently only has a low number of cases and all within the border
management system (managed isolation and quarantine facilities). However, as has been
seen overseas, there is a risk of further waves of COVID-19 in the community.
12. The contribution that digital devices such as a Bluetooth-enabled card have been stated to
make are:
•
Corroboration of the close contacts identified through interviewing cases, increasing
confidence that all close contacts are identified. The issue is that people may not
record or remember contacts or duration of time spent. 6(b)(i)
•
Speed of access to contact details for close contacts where the case does not have
those details or the close contacts are unknown to them. Relatedly, enabling targeted
identification and reducing blanket testing and isolation of anyone in a location within a
window of time.
The Ministry of Health found that during level 4 lockdown only 60 percent of contacts
could be easily reached by phone, either because of incorrect contact details in the
National Health database or because the calls went unanswered. However, this issue
was largely addressed when the National Contact Tracing Solution (NCTS) gained
access to additional data sets and with the launch of the NZ COVID Tracer app.
•
Potential to identify and notify close contacts of close contacts at the same time the
close contacts of the case are notified (‘recursive tracing’). This could enable isolation
of potentially infected people before they reach the infectious stage of the disease.
However, this is still largely theoretical as there is currently no evidence to indicate that
recursive tracing improves contact tracing for COVID-19.
•
Automatic recording of close contacts, reducing the compliance fatigue from manual
diary keeping and QR code scanning, potentially contributing to higher levels of
recording of close contacts than might otherwise be the case.
13. We note also that the PPP proposal draws links between deploying a CovidCard and
avoiding level 4 lockdown while also opening the border. We have found no analysis to
support this.
Current contact tracing process and how CovidCard could add value
14. We understand that contact tracing currently operates as follows:
•
Person takes a test and self isolates while awaiting the result (up to 2 days – often
same day). Close contacts of that person are
not advised to self-isolate (with the
exception of household members, who may be asked to self-quarantine if there is a
high likelihood that the person who took a test has COVID-19). If the test is positive,
then:
•
Local PHU (or National Investigation and Tracing Centre (NITC) for high numbers of
cases) contacts the person (case) to:
2021-0159
In Confidence
3
i.
advise of a positive test result (via automated process)
ii.
instruct to self-isolate for 14 days (if not already in managed isolation) and if in
managed isolation, arranges transfer to quarantine facility
iii.
understand the symptoms of the person, identify any health interventions that
may be required, and seek information on close contacts using an interview
process. The case may draw on recall, electronic calendars or diaries and
communications (including the New Zealand COVID Tracer app) and other
sources (such as workplace security records, bank records, public and private
transport records, etc).
•
Depending on the outcome of the case interview, the PHU/NITC may choose to contact
localities where the case has visited for which there may be close contacts unknown to
the case. Public notifications are made about those localities (eg. using the evening
news) or using the alert function on the New Zealand COVID Tracer app.
•
The PHU/NITC contacts suspected close contacts by phone or other means, asks
them to take a test (at a specific time after exposure) and to self-isolate. This may
involve multiple calls if unsuccessful in making contact.
15. New Zealand has a target of tracing 80 percent of close contacts within 48 hours of a case
being notified to a PHU (this is currently at 98% within 48 hours, though with admittedly low
case numbers and cases confined to managed isolation).
16. In the event of a return to community transmission and high case numbers, what could
frustrate achieving the contact tracing target is:
•
case has incomplete/inaccurate memory of close contacts
•
potential close contacts not returning call/not answering
•
backlogs in a PHU due to high case volumes relative to personnel resulting in delays in
engaging with cases and following up contacts
•
too much information or identifying too many false positives increasing the number of
calls required, without improving the self-isolation rate of those that are cases.
17. We note that the end-to-end success of case management also involves testing and
monitoring and enforcement. There are a range of potential issues that could frustrate
success but these are beyond what CovidCard could potentially address.
Environments and situations where CovidCard could add value
18. The potential contribution a CovidCard could make to improving the accuracy, speed and
overall efficiency of contact tracing will vary by environment and situation. The environments
and situations where CovidCard could have the most impact are:
•
Mass gatherings – a CovidCard could enable the identification of individual contacts
(not everyone at a venue) and timely contacting of those individuals. The benefit would
be a reducing the risk of second order transmission and a reduction in the number of
people asked to isolate and get tested (enabling health resources to be focused on
highest risks).
•
Communities with low density of mobile device use, where other digital tools to aid
record keeping are limited - a CovidCard could aid in filling in gaps in memory reducing
likelihood of a close contact not being identified.
2021-0159
In Confidence
4
•
Highly mobile patient histories – a CovidCard could aid in filling in gaps in memory
reducing likelihood of a close contact not being identified (the recall risk has been
noted to increase with reduction in alert level).
•
Busy stations or public transport hubs where people may not be traceable by electronic
ticketing records.
19. We note that the PPP proposal includes provision for “recursive” contact tracing. If this
feature were enabled, a further situation where CovidCard could have impact is where there
is significant community transmission and social distancing compliance has reduced.
20. We note that CovidCard would not add value in situations where there has been intimate
contact (eg an embrace) for a short duration, as this would require a change in the card
algorithm that would vastly increase the number of contacts. Manual methods are more
efficient in this context. Additionally, CovidCard would not add value where a contact is not
also wearing a CovidCard.
Factors Government should consider in making a decision on
whether and how to deploy
21. Previous advice from officials has set out several considerations in a decision to deploy –
some are about the technical design, security and privacy, integration into manual contract
tracing systems, manufacture, governance and operation (that apply regardless of high level
deployment option) – while others are option-specific.
22. In assessing the high level design options for a CovidCard we have considered the following
factors:
•
effectiveness – specifically, the impact each option could have on the accuracy
(corroboration and identification of close contacts) and speed of contact tracing
•
what public administration would be required and the degree to which that varies
between options – specifically, logistics and distribution, governance, central
administration of database, and regulatory requirements
•
matters the detailed design would need address for the option to be successful
•
challenges or issues that cannot be addressed through detailed design (eg public
acceptance, even if adequate privacy protections are in place).
23. We have not addressed cost at this stage. We note the estimated costs for full deployment
by the PPP ($100 million for a national rollout, plus $64 million each subsequent year), but
we have not yet verified those estimates nor estimated the costs of the alternative high-level
options. However, we expect the costs associated with the targeted options to be less than
those that involve Government procurement of cards for all residents.
High level design options for deployment
24. We have identified five high level design options for deployment of a CovidCard. While there
are multiple permutations of options, the five we have chosen are distinctly different and
provide a full spectrum for deployment.
25. We note that the PPP report states that only a national rollout with mandatory use is viable.
The objective in exploring different high level options is to draw out the design considerations
– and particularly the degree to which challenges with a mandatory regime could be
addressed through alternative option design.
26. The table in Annex One explores the following five options for CovidCard deployment:
2021-0159
In Confidence
5
9(2)(f)(ii)
Design implications
28. Setting aside questions about whether CovidCard is a sound technological solution for
contact tracing, there are many details that would need to be worked through should
Government decide to proceed with implementation, including security.
29. All options presented in Annex One would involve substantial policy and operational work to
set up the systems and legislative tools required to deploy CovidCard. This work would need
to be undertaken in partnership with Māori to ensure the Crown meets its obligations under
Te Tiriti o Waitangi, and to build trust needed to support the tracing system. We also note
that, in MBIE’s experience, it is difficult to fully assess feasibility and associated risks of
different high-level options before carrying out a detailed system design.
30. We have not provided recommendations on relative preferences between the high-level
design options. High uptake of CovidCards is critical to the potential success of every design
option. We note that there has been low public uptake of the NZ COVID Tracer app and of
other Bluetooth-enabled contact tracing solutions overseas in Singapore and Australia. We
are not confident that achieving sufficient uptake can be resolved through the detailed
implementation design.
31. We note the options do not address what broader public health alternative options could be
considered instead of a CovidCard.
Annexes
Annex One: Assessment of high-level design options for deployment
2021-0159
In Confidence
6
Annex One: Assessment of high-level design options for deployment
Appendix withheld under 9(2)(f)(iv)
2021-0159
In Confidence
7