China is fighting the coronavirus with a digital QR code. Here's how it works

Hong Kong(CNN Business) Imagine your daily routine being entirely dependent on a smart phone app. Leaving your home, taking the subway, going to work, entering cafes, restaurants and shopping malls — each move, dictated by the color shown on your screen. Green: you're free to proceed. Amber or Red: you're barred from entry.

This has been the reality for hundreds of millions of people in China since midway through the coronavirus crisis — and it could yet stay that way for the foreseeable future, as the country battles to recover from it.

Relying on mobile technology and big data, the Chinese government has used a color-based "health code" system to control people's movements and curb the spread of the coronavirus. The automatically generated quick response codes, commonly abbreviated to QR codes, are assigned to citizens as an indicator of their health status.

Although authorities have yet to make the health codes compulsory, in many cities, citizens without the app wouldn't be able to leave their residential compounds or enter most public places.

Three months on, with the virus largely contained and lockdown measures gradually lifted across most of China, the small square barcodes have remained in place and are still ruling people's lives.

Following China's lead, other governments have also turned to similar technology to battle the virus. Singapore last month launched a contact-tracing smartphone app, which would allow authorities to identify people who have been exposed to Covid-19 patients. The Japanese government is considering the adoption of a similar app. Moscow has also introduced a QR code system to track movements and enforce its coronavirus lockdown.

"Technology now plays a critical rule in containing the pandemic," Xian-Sheng Hua, a health AI expert at China's e-commerce giant Alibaba, told CNN Business.

"To stop the spread of the virus, contact tracing is an essential step and this is why similar initiatives are being adopted in places around the world," added Xian-Sheng.

How does it work?

The Chinese government has enlisted the help of the country's two internet giants — Alibaba (BABA) and Tencent (TCEHY) — to host the health code systems on their popular smartphone apps.

Alibaba's mobile payment app Alipay and Tencent's messaging app Wechat are both ubiquitous in China, each used by hundreds of millions of people. Placing the health codes on these platforms means easy access for many.

Hangzhou, a coastal city in eastern Zhejiang province where Alibaba is based, was among the first cities to use the health codes to decide which citizens should go into quarantine. The system was launched on February 11 by Alipay.

To obtain a health code, citizens have to fill in their personal information including their name, national identity number or passport number, and phone number on a sign-up page. They're then asked to report their travel history and whether they have come into contact with any confirmed or suspected Covid-19 patients in the past 14 days. They also need to tick the boxes for any symptoms they might have: fever, fatigue, dry cough, stuffy nose, running nose, throat ache or diarrhea.

After the information is verified by authorities, each user will be assigned a QR code in red, amber or green.

Users with a red code have to go into government quarantine or self-quarantine for 14-days, users with an amber code will be quarantined for seven days, while users with a green code can move around the city freely, according to a statement issued by Hangzhou authorities.

The health codes can also serve as a tracker for people's moves in public areas, as residents have their QR codes scanned as they enter public places. Once a confirmed case is diagnosed, authorities are able to quickly backtrack where the patient has been and identify people who have been in contact with that individual.

A person familiar with the development of the health codes on Alipay told CNN Business that the system was developed and operated by government agencies, and Alipay only provides the platform and tech assistance.

Meanwhile, Tencent also developed a similar health QR code system on Wechat, first introduced in early February in the southern city of Shenzhen, where Tencent is based.

How widely is it used?

Within a week of its launch, the Alipay health codes were rolled out in more than 100 cities across the country, the state-run Xinhua news agency reported.

On February 15, the e-government office under the State Council instructed Alipay to speed up the development of a health QR code to be rolled out nationwide, Xinhua said.

"A digital epidemic prevention 'sky net' is rolling out on a full-scale with the Chinese speed," the Xinhua report said.

By late February, more than 200 cities had adopted these QR codes, according to Alipay.

Tencent's health code system had also expanded to more than 300 cities as of last month, according to the state-run Science and Technology Daily.

On March 1, Beijing launched its version of the three-colored QR code, accessible via both Alipay and Wechat. In addition to providing their name and ID number, users also need to register with facial recognition to obtain their colored code.

The health codes have also played a central role in the gradual lifting of travel restrictions in Hubei province, where around 60 million people had their movement restricted following lockdowns in late January.

On March 10, the province issued its health codes for residents who want to travel within the province.

The colors are assigned according to the provincial epidemic control database: people who have been diagnosed as confirmed, suspected or asymptomatic cases, or people with a fever will receive the red color code; their close contacts will receive the yellow code; and people without any record in the database will get the green code — meaning they're healthy and safe to travel.

The colors of the QR codes decide people's freedom of movement: green code holders are allowed to travel within the province, amber code holders are not allowed to travel, and red code holders will be treated and quarantined.

All residents and visitors leaving Hubei and Wuhan need to have a green QR code on their phones.

What are the problems?

As with all products of technology, the health app are not perfect — it can make mistakes and assign users the wrong color code, and force the wrong people into quarantine.

In Hangzhou, the city where the Alipay health codes were first introduced, some residents have complained on social media that they were given the red code for the wrong reason — such as ticking "stuffy nose" or "fatigue" on the sign-up page, despite they are also symptoms for the common cold and flu.

A few days after its launch, the Hangzhou authorities said in a statement that the mayor's hotline had received too many calls from people who have questions over their codes, and had thus set up an online application for people demanding a review of their assigned codes.

As Chinese people resume traveling under the lifting of lockdown measures, another problem has arisen: not all cities and provinces recognize each other's health codes.

Although the QR codes all come in the same three colors and are developed by the same companies, they are based on different Covid-19 databases set up by local authorities.

Because the databases are not shared among local governments, and because different governments might have different standards for assigning the colors, some have been reluctant to recognize health codes from other places, according to the state-run Legal Daily.

A Hubei resident surnamed Yuan, who returned to Guizhou province to work in late March after the lifting of the lockdown, told the Legal Daily that he had to undergo another 14 days of quarantine in Guizhou, even though he had a green health code from Hubei following a 14-day quarantine there. Guizhou does not recognize Hubei's health codes, the newspaper said.

To address the issue, the central government has launched a national "epidemic prevention code." It also uploaded a nationwide database of confirmed and suspected Covid-19 cases and their close contacts on a centralized platform, hoping that local governments can recognize each other's health codes through data sharing, according to Mao Qunan, an official with the National Health Commission.

"We've realized the mutual recognition and sharing of basic data," Mao told a presser on March 21.

There are also concerns about privacy. The health codes rely on troves of data the authorities have collected from individuals — including their personal information, location, travel history, recent contacts and health status.

"All I care about is whether our personal information will be leaked, and whether our information security can be ensured," said Weibo user Han Dongyan of the health codes.

Zhu Wei, a legal expert at the Chinese University of Political Science and Law, defended the health codes in an interview with the state-run Guangming Daily. He said the health codes confirmed to China's internet security law because users are aware of their data being collected, and because the government was involved in the process.

Jason Lau, a privacy expert and professor at Hong Kong Baptist University, said Chinese authorities need to make sure the health codes meet the typical data privacy principals. For instance, the data collected should be "proportionate with the purpose to be achieved."

He also raised the question of whether the codes — and all the personal information collected — will be here to stay even after the pandemic has passed.

"How do we determine when the actual pandemic ends? So for example the government and the companies that are collecting this data — who's the person that's going to be the one that says, 'OK the pandemic is over let's delete the data, let's not store personal data anymore,'" Lau said.

Liu Yuewen, a big data expert working for the police in southern Yunnan province, said at a press conference in February that the health code data would be destroyed when efforts to control the epidemic end.

"No one will be able to see any data without the permission of the epidemic prevention and control headquarters," he said, the state-backed Beijing News reported at the time.

Some cities have already started to remove the health codes from some parts of residents' lives.

In Hangzhou, where the QR codes were first rolled out, the government announced on March 21 that residents are no longer required to show their health codes at public places, such as subway stations, malls and hotels.

But in many other places, such as Beijing and Shanghai, the small square bar codes still decide where people can and can't go in their daily lives.