For many, New Zealand is the best model of how to tackle the Covid-19 pandemic, with less than 1,300 cases and 22 deaths, it seemed free of infection so long. It may come as a surprise, but this world leader doesn’t use smartphone contact tracing in the same way that other countries are trying to do. It relies on scanning of QR codes, not Bluetooth LE to measure ‘exposure’.

The New Zealand smartphone app relies on its users scanning the QR code displayed (by law) at the entrance to all premises and locations where you might be exposed to someone shedding coronavirus. These are used to build a diary of locations. Should the user test positive for Covid-19, a human contact tracer will ask them to use that diary to provide an account of their potential contacts, who are in turn alerted by the app. This is explained here.

My interest in the use of QR codes in contact tracing has been driven by the fact that I’m now one of those trialling a second attempt (actually version 3.0) at a smartphone contact tracing app for England. One of its new features is a not dissimilar system of QR code scanning, as well as Bluetooth-based exposure measurement using the Apple-Google frameworks.

The concept at the heart of all contact tracing systems is the viral dose: this is the idea that, in order to become infected, each person needs a certain total amount of virus to be brought into the body, typically inhaled into the airways. This can be achieved by a brief exposure to virus-rich droplets, or by a longer exposure to a lower density of virus in an aerosol, perhaps.

Tracing those who may have become infected by someone shedding coronavirus is therefore a matter of establishing how close a susceptible individual has been to the carrier, and for how long they were there. In the most popular systems, including that provided by Apple and Google, Bluetooth LE signal strength is used to estimate the distance between two suitably-equipped phones, and the duration by measuring the period during which the phones were in close proximity. The current best guess as to what constitutes a hazardous exposure is a distance of less than 2 metres (6 feet) for a period longer than 15 minutes. No modifications are made whether that exposure occurred in a small room or outdoors, or whether either or both contacts were wearing any face covering.

There are several problems with using Bluetooth LE to estimate both distance and duration of exposure. The most important is that it requires both sides of the contact to have suitable smartphones running the same app close to their body. If adoption of the app is anything less than high (typically over 60%), or the contact tracing app doesn’t work reliably when a phone is locked and asleep, then the app will miss many contacts. There are also known problems in using Bluetooth LE signal strength (actually signal attenuation) to measure distances of around 2 metres. Those will inevitably result in both false positives – in which the app mistakenly decides that an exposure was hazardous when it wasn’t – and false negatives, where the app misses hazardous exposures.

Using additional methods which can act as surrogates for distance and duration is therefore very attractive, and could make smartphone apps more valuable for contact tracing, particularly for exposures to anonymous contacts, which can’t be addressed using conventional contact tracing methods: the person sat opposite you on a train, for example.

The English use of QR codes is actually very different from that in New Zealand’s app, although on the surface they might appear to work the same. The user is given the same instructions: each time that they enter premises or a location, including restaurants, pubs, and other locations where contact can occur, they should scan the QR code at the entrance.

Their smartphone stores those QR codes for 21 days. Over that period, if someone else tests positive for Covid-19, locations they have visited in the period during which they’re likely to have been infectious are identified. Others who visited those locations on that same day are automatically sent a notification; because this uses a decentralised model, checking against a list of hazardous locations is performed on the user’s phone.

Those who are notified that they visited the same location (matching QR code) as someone who may have been shedding coronavirus aren’t told of the individual who has tested positive, nor are they informed of the location where they may have come into contact with them, simply that on a particular day they may have been exposed to the risk of infection.

Even before trialling, this approach has obvious problems. It relies entirely on those visiting locations scanning the QR code; visitors who don’t scan will escape the system entirely, as they do in the New Zealand model too. Among those diligent enough to scan all the QR codes which they should, poor spatial and temporal resolution results in high numbers of false positives.

A QR code at a busy medium-sized restaurant with a mixture of indoor and outdoor tables could easily be scanned by several hundred phones each day (if adoption becomes widespread). There’s no recognition of how long each potential exposure might have lasted, or even whether both contacts were present in the location at the same time. The carrier could have sat indoors at a table putting those around them at serious risk, or outdoors well away from others, and similarly for those who might have been exposed to the risk of infection there.

This scales up badly too. We have several local ‘country parks’ which are popular tourist attractions, some achieving thousands of visitors on busy days. If just one of those visitors were to test positive a couple of days later, the resulting number of contacts to be traced would overwhelm local resources completely.

Using QR codes as a surrogate for more accurate location or contact data appears to amplify problems inherent in the Bluetooth LE system provided by Apple and Google. If few users scan QR codes, they won’t contribute significantly to contact tracing; if scanning becomes popular, the risk of overwhelming the contact tracing system is very real.

The New Zealand app uses QR codes to improve the quality of information available to human contact tracers, who can then decide how best to use it. The compulsory requirement for premises to display QR codes should encourage their use too.

The potential benefit of scanning QR codes in the English app appears low, and its risks high. It’s now four days since the app was launched in this new trial, and I’ve not found any premises displaying a code. As they have to be applied for and printed by each business, and aren’t required by law, that’s perhaps unsurprising. More disturbingly, because the English app has adopted the decentralised model to protect user privacy, it seems difficult if not impossible for any objective assessment to be made of the effectiveness of its QR code system.

Finally, I wonder if anyone tests such systems when taking small children out. Fumbling for your iPhone in a pocket or bag, unlocking it, opening the app and scanning a QR code isn’t easy when you’re also trying to cleanse your hands, carry bags, find a table, and keep control of the kids.

I will look more broadly at what the new version of the English app does later this week.