An additional 500 defence force personnel will be deployed to patrol New Zealand’s quarantine hotels, as the investigation continues to track down the source of Auckland’s outbreak more than a week after the first cases emerged.

The military will also be deployed to monitor New Zealand’s maritime borders – the ports – as testing of thousands of staff at the Ports and Auckland and Tauranga continues.

Last week New Zealand recorded its first case of locally transmitted Covid-19 in 102 days, and prime minister Jacinda Ardern has placed Auckland into a two-week level 3 lockdown to control the cluster, which has now infected 75 people and is tracking to be the largest cluster the country has seen.

Five people are being treated in hospital and 125 people from the community related to the Auckland cluster are being held in quarantine facilities – a new measure introduced by the government to stop the spread of Covid-19 in homes particularly.

Nearly 90% of cases are Māori or Pasifika people.

On Wednesday, Ardern said just five new cases were connected to the Auckland outbreak and that the news was “positive”, showing the disease wasn’t “surging” in the community.

However, amid stringent criticism of quarantine operations from the opposition parties and epidemiologists, the government said security at the borders was being bolstered because the “index case” or source of the outbreak remained unknown.

It comes as the high court ruled that parts of the strict first lockdown were illegal – though justified in the circumstances.

“Those announcements had the effect of limiting certain rights and freedoms affirmed by the New Zealand Bill of Rights Act 1990 including, in particular, the rights to freedom of movement, peaceful assembly and association,” the judges said.

“While there is no question that the requirement was a necessary, reasonable and proportionate response to the Covid-19 crisis at the time, the requirement was not prescribed by law and was therefore contrary to s 5 of the New Zealand Bill of Rights Act.”

The dates in question were 26 March to 3 April. A new order on 3 April remedied the breach.

The additional 500 personnel en route to the government’s quarantine hotels would make the military’s response to the disease the largest such operation since Timor-Leste, with a total of 1,200 soldiers on the ground.

Ardern said despite the boost, ramped up testing and use of personal protective equipment, border control would never be “perfect”.

The move comes after a private security guard leaked information about quarantine guests; a situation Ardern said would not be repeated as defence force staff would soon take their place.

“Our intention is to stop using private security contractors particularly in the riskiest places, such as entry and exit points in public areas and replace them with defence force staff,” Ardern said.

New Zealand has 32 managed isolation and quarantine facilities, and since they began operating four months ago more than 40,000 people have spent their two weeks there.

Megan Woods, the minister overseeing quarantine facilities, said: “While the current community cluster has not been sourced to a managed isolation and quarantine facility, nothing is fail-safe and strengthening security is a step we believe is useful.”

Epidemiologists have expressed disappointment with government’s management of its high-risk borders, saying it showed “complacency”. The opposition National party leader Judith Collins has also slammed management as “shambolic” and a “massive failure”.

On Monday a hotel worker at Rydges in Auckland tested positive for a strain of Covid-19 separate to the Auckland cluster. So far no more cases related to the hotel worker have been discovered.

Meanwhile, a tourist who visited Hobbiton in the North Island – made famous by Peter Jackson’s Lord of the Rings films – has tested positive for Covid-19.

The visitor – who has since returned overseas – visited Hobbiton on 7 August, and tested positive once arriving back in their home country.

Hobbiton deputy chief executive Shayne Forrest said the risk of anyone being infected was very low, but all staff who worked on the day had made aware of the case.