The Health Ministry has been consulting with the state spy agency, the GCSB, over tracing people as it works to get its COVID-19 systems up to speed.
This comes amid growing concern globally that contact tracing could lead to mass surveillance, and local concern the government is not being transparent enough.
Because of the scrutiny around this work, the ministry said it had "engaged with colleagues to provide advice on and review of third-party services/code (including but not limited to Bluetooth tracing) from other countries to ensure they meet New Zealand security and privacy requirements".
Those advising it included the Government Communications Security Bureau (GCSB), it said in a statement.
An industry group, Digital Identity, which is part of the New Zealand Tech Alliance, said it must be made clearer just what areas of technology - simple apps, or more invasive GPS smartphone tracking, for instance - were the subject of the advice.
The ministry told RNZ any data held about individuals would be used only to help the public health response and "not be used for other purposes".
"We expect the majority of the information held will also regularly and automatically be deleted."
With Cabinet due to decide today whether to drop the alert level, the contact tracing system remains several days away from being at the promised "gold standard" - being able to find within three days, 80 percent of people who've had contact with an infected person.
"One of the factors that I've got to be assured about is both our capacity and the timeliness of our contact tracing," Director-General of Health Dr Ashley Bloomfield told yesterday's briefing.
Last-minute analysis was done at the weekend of what capacity District Health Boards have to help with rapid mass contact tracing if the virus flares up.
Information had been slow to get together because the system pre-COVID was localised and not built to cope with a mass outbreak, Bloomfield said.
This analysis of DHB tracing capacity would go to the Cabinet today, he said.
Bloomfield said New Zealand "was on a pathway" to a "gold-standard".
The Prime Minister made clear a digital app will be used to help speed tracing up - to get to "surge capacity" as she put it - but only as a supplement to phone-and-interview tracing, only voluntarily, and that its rollout was not critical to the alert lowering decision.
The government said on Friday that smartphone and Bluetooth options, and COVID-cards were all still on the table.
"We have to assess all of these as to whether or not they are the best way in order for us to get the maximum of contact tracing done ... and what are some of the other consequences, for instance around privacy," Finance Minister Grant Robertson said.
"The Ministry of Health is working very closely with a number of different people.
"We'll have more to say about that as we come to make a decision on how we use it."
This was similar to statements at briefings from two and three weeks ago.
RNZ has been asking for more than a fortnight for the ministry to specify where its advice on tracing is coming from.
It has now listed various government agencies, including the communications spy agency, and "specific" industry partners it is getting advice from.
"This is good practice," it said.
Global concerns over mass surveillance
Globally, Amnesty International, civil liberty groups and some technology groups have expressed concern Covid-19 tracing could be misused for mass surveillance, using for example smartphone GPS tracking technology.
Digital Identity NZ executive director Andrew Weaver said the ministry asking the GCSB about cyber security was "absolutely appropriate", but that the ministry's short statement to RNZ was not clear enough.
"We're speculating that they are talking about the cyber security of things like an app-based tool, but we don't know because we don't know if those were the questions they were asking the GCSB."
The ministry said its work was being "independently tested" by a regular partner that was a commercial vendor from the All of Government panel.
It has not named them.
Weaver said best practice would be to use more than a single company to do this, to get a range of views.
Questions remain too about who is building the local app the government has referred to.
The ministry has declined to identify to RNZ who any contract has been given to; last week Australia's federal government disclosed details of its tracing contract.
"There will be more information in the public domain about the Ministry's approach to using technological solutions as these are progressed in coming weeks," the ministry told RNZ.
Its list of where it got advice on contact tracing included the Government Chief Digital Officer - who told RNZ the ministry was leading the work; the Privacy Commissioner and the NZ Health IT group. The ministry said the new government-appointed Digital Council was involved too; however, the council told RNZ it was asked to look, not into tracing, but into the medium and long-term impacts of COVID-19 on the digital sector.
Weaver said it was not clear who the ministry was getting advice from on about the bigger societal questions around just what it should do, as opposed to how to do it.
Contact tracing system audit to be released
An audit of the ministry's existing contact tracing system, done by epidemiologist Ayesha Verrall 11 days ago, would be released later today, along with the government's response and tools for measuring performance, Bloomfield said.
Privacy Foundation New Zealand called for the audit to be released immediately.
"It is important for our members and for the public to understand the current contact tracing process and begin the discussions on the recommendations," it said in a statement.
Weaver said the information vacuum around tracing technology was filling up with speculation instead of facts.
"Rather than having a wide-ranging debate about what might be the best for New Zealand, if there are some very specific options that the government has been assessing over the last few weeks, make them available for scrutiny, rather than theoretical discussions about what might be or could be," he said.
Tech players have hurriedly set up forums hoping to spark public debate and government engagement.
Short window to influence decision on contact tracing
InternetNZ said there was only a short time to influence government decision-making on contact tracing.
The group went to the government 10 days ago, offering to not just kickstart public debate, but gather the feedback, which it is today presenting to officials.
Policy director Kim Connolly-Stone sums up the online discussion among 70 tech industry people last Friday.
"One is, please ensure that you've addressed these important issues around privacy and security and human rights," she said.
"Point two, is to bring the community along with you. Be transparent about what you're proposing, because we're more likely to have buy-in for any technical solution to actually be successful."
The convenor of the Auckland District Law Society's technology committee and a tech consultant himself, Lloyd Gallagher, said InternetNZ's intervention was brilliant, but the ministry could be forgiven for feeling its way.
"We've got to be cautious on the top-end of the technology," Gallagher said.
"The potential for abuse and risk is far greater ... we've already seen a whole pile of scammers come out of the woodwork with false websites, and the last thing we need is an app that is not properly thought about to create even greater problems for people to lose their financial security."
He advocates that the ministry's mostly manual tracing was good enough for now, given that new infections were at low levels, which bought it time to proceed carefully.
The government faces a welter of choice of advanced tracing technology being rolled out in more than 20 countries; also, local tech firms have inundated the ministry with offers of help.
One finding favour with those wanting tight limits on tracing has a cartoon pushing it.
Other technologists say the industry must back whatever the government chooses or risk having multiple incompatible tracing technologies introduced that weaken the system for combating the virus.
Among the industry speculation RNZ is aware of, is that when Finance Minister Grant Robertson told business leaders last week a crucial question was "Can you build in contact tracing tools or mechanisms to keep track of your supply chain and customers?", that this indicated contact tracing might be left up to individual businesses.
For this, some tech firms have been developing an app that scans a QR code pasted to a shop door, to record who was there and when.
NZIER principal economist Sarah Hogan said businesses needed a clearer steer on what was required of them.
"I don't think businesses should be given the responsibility of contact tracing, for the most part - who would be overseeing the quality of that?" she said.
"It's not clear at this point whether these are unresolved issues or whether these are issues that are resolved that the government just isn't being entirely transparent with us about them."
The core problem was a lack of transparency about decision making and responses, that could undermine business confidence that the government can handle the risks inherent in a lower alert level, Hogan said.
Other firms are marketing smartphone proximity alert apps for personal use.
Prime Minister Jacinda Ardern yesterday advocated people keeping a record of who they meet when, to aid with contact tracing should they or someone they've been in contact with get the virus.
The ministry said it was "looking at how technology can help individuals track their own movements more accurately to help when needed with subsequent contact tracing".
In Singapore, which uses Bluetooth tracing technology that Ardern has talked with the Singaporean leadership about, New Zealand expat Jon Brewer said he ran the TraceTogether app "for my own protection".
"Running the app is voluntary, and you have to manually start it every time you restart your phone," Brewer said.
"I care a lot more about being notified of exposure than I do trading away my privacy for a couple of months. I trust Singapore's government to keep my location data safe - as I think most Singaporeans do - because they're extremely competent, transparent, communicative, and fair.
"From a technical standpoint I know there are more accurate ways of contact tracing. That doesn't bug me. And I know uptake isn't great... Still doing it because it helps the community and doesn't cost me a thing."
The Health Ministry said in a statement that timely contact tracing would become more important to limit virus spread.
It had been working since early March to find and use technological solutions guided by its new internal Digital Investment Board, other agencies, and "along with specific advice from the sector".
It was first focused on building quickly on existing infrastructure and using established technology, including the National Health Index and national screening programmes.
"Up to date contact details for around two-thirds of New Zealanders are already held by health agencies.
"Therefore the additional technology solutions ... start by assisting with those one-third of New Zealanders where the information held by health agencies may be out of date."
