Tech developers whose ideas are behind the government's contact tracing app, NZ COVID Tracer, had to wait weeks to see action.
The NZ COVID Tracer app. Photo: MoH
One of the developers, Alan Chew, said the app that had been put out was "insufficient" for businesses' needs.
Industry sources say an app this basic could be built in two days.
But it took five-and-a-half weeks, between when the tech developers went to the Health Ministry and yesterday's launch.
In this period, the daily official briefings and ministry statements indicated the work was urgent, and epidemiologists were saying an app should be ready for the transition from level 4 to 3 in late April.
Instead, it took another three weeks to release.
The app's copyright page acknowledges the contributions of two ministry teams, the Privacy Commissioner and two individuals - Daniel Britten and Alan Chew.
Britten, a 24-year-old PhD student, had developed a prototype tracing app using QR codes by 6 April. He outlined his idea to the ministry a couple of days later.
Chew's app was built by 29 March, after a rush-job the Malaysian migrant did to "pay back a little of the debt that I thought I owe New Zealanders".
The ministry contacted him after he suggested giving his app for free.
Weeks went by, and in early May, neither Chew nor Britten had much idea what was going on with the ministry's app.
Chew, who runs a tech firm in Hamilton, said he could not understand the ministry's secretiveness about what the app would look like, be released and rules for using it.
It had been "extremely non-transparent".
"To be frank I could not understand why throughout the whole process, but I gave them the benefit of the doubt," Chew said.
"Now that I have seen the product, it baffles me even more.
"There were a lot of people who wanted to contribute productively but could not because of that."
The app as released was robust and easy to use, but it left big gaps for businesses trying to meet their safety and Covid-19 obligations.
"I am of the view that the app is entirely insufficient for businesses to meet their contact tracing obligations, much less all the other responsibilities under the Health and Safety at Work Act such as maintaining a register of people in the building."
The secretiveness had prevented the development of a single app that could meet all requirements, Chew said.
Consequently, businesses faced running two or more tracing apps which "would be a damn nuisance".
The ministry said it would release the specifications of the app to the industry at a later date. It first said a month ago that it was working on standards for commercial developers to meet.
Many apps had already been built without those specs, and Chew expected many developers would later find for the first time their apps did not comply.
"They will probably find that they have to start all over again."
App's privacy and data security in question
AUT Centre for Social Data Analytics director Dr Rhema Vaithianathan said the technology was simple. What was complicated was figuring out what New Zealanders were prepared to go along with regards to privacy, she added.
Dr Rhema Vaithianathan. Photo: supplied
The app, as it was, "did not do anything" to speed up contact tracing and help people protect themselves from the virus, and this should have been made much clearer, she said.
The ministry said it would be adding features later to notify users if they had been exposed.
The app's privacy and security settings around people's data appeared standard and adequate, according to several industry sources.
Computer science professor Dave Parry is questioning why the app's source code is not being released to the industry.
Dave Parry. Photo: supplied
The ministry is refusing to release the source code, or to identify the "independent data security experts" it says vetted the app.
More than 90,000 people downloaded the app and 1000 businesses registered to get a QR code to use it, within hours of its launch yesterday.
However, Parry said an app of such importance had to be rigorously tested beyond the ministry.
"I would strongly support releasing the source code for this app so that the security community can test it and examine it," he said.
The ministry last night said that "at this stage" it was not releasing the code. It did not say why not.
"We will also not be identifying the experts who reviewed the app as this is commercially sensitive information," it said in a statement.
Privacy Commissioner John Edwards. Photo: Supplied / Office of the Privacy Commissioner
Privacy Commissioner John Edwards had seen various iterations of the app's privacy impact assessment, his office said.
It was not aware that any ethics committee has been convened "to assist with the development of the app, or any other contact tracing technology".
The government said more Covid-19 technology was being worked on. A CovidCard that would log interactions between people was among the options it had looked at.
The UK has set up a Covid-19 App Data Ethics Advisory Board to vet its tracing technology. It is mired in controversy over whether it is being kept in the dark.