M’sia’s state govts made their own contact tracing apps, so we downloaded them to try

As you probably already know, Covid-19’s a virus that can spread really easily and rapidly. And a lot of Covid-19 cases can be linked to certain clusters, so it’s important to track down these clusters as to avoid further spread of the disease. Before this, we wrote an article on how our government tracked down possible Covid-19 patients through special units called the Rapid Assessment Team and Rapid Response Team.

However, since then, Malaysia’s become one of the many countries to have developed our own contact tracing apps to make things more effective and efficient, which are:

• MySejahtera
• Gerak Malaysia
• MyTrace

But, apart from the federal government, state governments like Selangor, Penang, Sarawak, and Sabah have decided to take things into their own hands, coming up with their own contact tracing apps that are independent from the three mentioned above. And because we’re all so kepoh here at Cilisos, we decided to bloat install and try some of these apps ourselves, starting with…

1. SELangkah by Selangor, a QR-code based customer tracking system

SELangkah’s an initiative introduced by the Selangor state government in early May this year, with the motto of Langkah Masuk dengan Selamat, or Step in Safely. The main objective of the app is to partner up business premises in Selangor with the state health department to perform contact tracing.

According to Selangor Chief Minister Amiruddin Shari, business owners in Selangor can register with the system and be provided with unique QR codes. After that, these QR codes can be put at the entrances of their premises, so that visitors can scan the code and log their entry.

“Premise visitors are asked to scan the QR code posters, by using the camera function on their mobile phones, either before entering the premises or when making a payment, depending on the arrangement of the owner of the respective premises.” – Amiruddin, as quoted by Malaymail

Business owners can head on to the SELangkah website to register for their own QR code. The system’s already prepared a list of existing businesses within the area, but if you can’t find your business in the list, there’s also an option for you to self-register.

All you need to do is fill out the details of your business, such as address, sector, and phone number – then a QR code will be generated for you almost instantly. After that, just print out the QR code and put it somewhere obvious at the entrance of your business, and you’re good to go! It would look something like this:

Meanwhile, for visitors, things are much simpler. If your phone camera’s capable of reading QR codes, then you only have to snap a photo of the QR code provided. If not, worry not, because SELangkah itself has developed a QR code reading app specifically for this purpose. And it’s honestly the simplest app interface the writer’s ever encountered, since all it does is open up your camera and let you scan the code.

And once you’ve scanned the code – either with your camera or the app – it’ll automatically bring you to a page as below:

As you can already tell, SELangkah will log a visitor’s name, phone number, date, and time of visit, and that might bring up some security concerns, as is common with contact tracing apps nowadays. However, these details are considered only the most basic of info. And not just that, the Selangor state government’s reassured the public that the basic data provided can only be accessed by the government and the Health Ministry, if the worst case scenario happens.

Once you’ve logged your name and number, you’ll get a receipt of acknowledgement and you’re pretty much done.

All in all, it’s not that difficult to use, and seems pretty secure in and of itself, especially for visitors. After all, it’s just scanning and stuff.

Next up, we have…

2. PGCare from Penang, contact tracing with… Google Lens? :O

Much like SELangkah, Penang Contact Tracer, or PGCare in short, is a contact tracing initiative launched by the Penang state government in mid-May. With the MCO having been made a conditional MCO (CMCO), Penang’s launched this app to ensure compliance with the conditional MCO’s standard operating procedures, where businesses are allowed to open but also encouraged to keep track of visitors coming in.

“This system not only saves time but also avoids any form of human touch.” – Penang Chief Minister Chow Kon Yeow, as quoted from The Sun Daily

It’s the result of a collaboration between the state government, a private contractor called Madison Technologies, and Maxis. And it works similarly to SELangkah, where business owners only need to register their businesses in the system to generate QR code and the like, which seems pretty run of the mill.

The difference is in the visitor side of things, where PGCare doesn’t have a standalone app of its own. It means you’ll have to rely on your phone camera or an independent QR Code reader. However, on the PGCare website, it does encourage Android users to download Google Lens as your reader #iphone5eva (Ed note: Android > iOS).

So what is it like for visitors then? Well, since we don’t live in Penang, this was a good time to also test if it was possible to enter a random made-up business in Penang, just to see how secure it can be. And as it turns out, it’s actually pretty hard to fool the system, so we just got a friend in Penang to help us out lol.

To start with, once the QR code is scanned, it’ll ask you to provide your name and phone number, pretty routine so far. Then it’ll send you an OTP code – you know, those six-digit codes to verify that you’re human or something (a feature that SELangkah doesn’t have btw).

But it doesn’t stop there. Oh no, once you’ve verified yourself, it starts to dip into your personal life, like…

We don’t know what happens if you do pick one symptom or two or all of them – seriously, are you okay? But yeah, it was pretty nice to learn that Penang’s taken more precautions with its contact tracing initiative and straight up ask if a visitor’s sick upon a visit. But in our experience, if you’re not sick at all, you’ll be fine and PGCare will let you waltz right in. And you’ll be shown a success page like so…

When it comes to app usage, it’s pretty run-of-the-mill. The only slight complication comes if your camera itself doesn’t already come with a QR code scanning feature, but then again, you can just download Google Lens if this does happen to be the case.

3. Sabahtrace from Sabah, where you don’t actually have to scan a QR code

This initiative came later in the game than others in mid-May, and just like the others it focuses on business premises and government buildings, using QR codes to track visitors, so while the name is different, it works much the same. The main purpose is to reduce the use of manual logbooks and unnecessary manual contact.

“Sabahtrace is used by government departments/agencies and all sectors of industry and business in Sabah.” – Sabah state secretary Safar Untong, as quoted from Daily Express

Similarly to SELangkah and PGCare, Sabahtrace requires you to register your business premise with the system for a unique QR code to be generated, and the registration page looks like this…

If you look closely while you’re on the site, you’ll notice a brief note to premise owners at the top that “advised” us to enter accurate data, because authorities could carry out random inspections to make sure the data’s real. So, this time we didn’t try to see if it’s possible to fill in any random business la.

As such, we couldn’t really scan a QR code to see how the interface looks like, but the Sabahtrace website tells us that all you have to do is scan the code and enter your name, IC, phone number, and temperature reading and you’re good to go! Unfortunately, Sabahtrace doesn’t have a standalone app as well, so you may have to download a third party app like Google Lens to do the job.

But if you’re too lazy to download an extra app, the part that makes Sabahtrace stand out is that it has the option for you to check in manually. That means that each QR code will have a randomized QR ID – consisting of either alphabets or numbers – and you only have to enter the ID on the Sabahtrace manual check-in page to log your visit.

So yeah, that’s about the long and short of Sabahtrace. It does seem more secure in the terms of business registration, since it asks for your trading license number, compared to SELangkah, which doesn’t ask for much.

4. Sarawak with COVIDTrace, a personal close contact app using Bluetooth technology

This contact tracing app’s quite different from the rest that we’ve talked about above. To start with, instead of focusing on business owners and logging visitors, COVIDTrace takes on a personalized form of digital contact tracing, meaning it tracks someone’s movement no matter where they go, rather than logging their visit at a certain business premise. For example, you can go to a restaurant and it doesn’t really have a logbook to record your visit, you can use COVIDTrace to log your entry at that place.

COVIDTrace’s built by the Sarawak Information Systems (SAINS) and Sarawak Multimedia Authority as an effort to help the Sarawakian state government perform contact tracing swiftly. And instead of using the framework that the above three are using, COVIDTrace uses bluetooth technology as a way to detect those around you and log your location at the time.

“COVIDTrace is highly secure with encryption and data stored locally. The data can only be accessed via a valid personal identification number (PIN) verification with a person’s consent and by an authorized health officer.” – Minister for Local Government and Housing Sarawak Sim Kui Hian, as quoted by Dayak Daily

So once you’ve downloaded the app and signed yourself up, you’ll be brought to a page like this…

[UPDATE: 03/06/2020] We’ve updated the article after SAINS got in touch with us to clarify the functions of the app, and you can find them in blue. 

The app works in such a way where it collects your encounter history in the past 21 days, do note that you must keep your Bluetooth on for the app to work, otherwise you’re just wasting precious storage on your phone. Let’s say you’re going to a supermarket and you’re in close contact with someone else with the app, the Bluetooth feature of the app will automatically detect that you’ve been in close contact with them. 

However, SAINS has reassured us that the app does not collect your location or personal data via GPS or whatnot. Your encounter records will also be encrypted. 

And if things go well, then there won’t be any trouble. But in the worst case scenario, someone who was around you suddenly detected Covid-19 positive, then only will you be alerted. 

We tried to upload our data just to see how things go, but we hit a snag because the code’s actually a mixture of alphabets and numbers and we were only allowed to enter numbers in the input page. But when we trawl through social media, it doesn’t seem like anyone else has had trouble with it, so perhaps it’s just the writer. We’ve also reported this problem with the developer, but we haven’t gotten a response yet. 

As for the pin, well, we were told that it only comes into play when there’s a request for you to upload your encounter record once you’re alerted. The authorities will send you a personalized pin code separately with the request to upload your data. When you upload the data, it means that you’ve given consent to share your record with the authorities so they can trace other close contacts as well. 

The original article is continued below.

In case you’re still confused about how it works, this diagram probably puts it best…

But other than COVIDTrace, Sarawak also has Qmunity, which, much like the apps above, is for business owners to track their customers via QR code, so we’re not gonna say much about it.

So now that we’ve talked about the contact tracing initiatives launched by the state government, you’re probably wondering…

What about the apps developed by the federal government?

Well, you can still use them, of course. Given that three of the four apps mentioned above are more concentrated on business owners, it probably won’t hurt to use MySejahtera, Gerak Malaysia, or MyTrace as well. For example, if you’re in Selangor, you can have both SELangkah and MyTrace, one for when you’re entering a business premise with the feature and the other for when SELangkah isn’t available.

But other than the ones we’ve mentioned above, there are also other states with their own contact tracing apps, like Kuala Lumpur with the browser-based KLSTEP and Johor with Jejak Johor, but since they’re all use QR codes and aren’t that different from the ones we’ve mentioned before, it seemed a lil redundant to go thru those as well.

It’s pretty admirable that our federal government and state governments have actually made an effort to successfully develop these apps for more efficient contact tracing and curb the spread of Covid-19. It’s always good to have options, you know, since it’s important to keep yourself informed and be extra cautious, so that one doesn’t get triggered and go…