NHS COVID-19 launch: Risk-scoring algorithm criticised, the downloads, plus public told to 'upgrade their phones'

Better late than never. Earlier today, the UK government released its long-awaited open-source contact-tracing app to the general populace, called NHS COVID-19.

Intended for users in England and Wales*, version two-point-oh addresses the problems that scuppered the original version, and uses a privacy-centric decentralised model built upon the contact-tracing Exposure Notification API, a joint Apple and Google project incorporated into both iOS and Android.

You can find the source code for the iOS app here, Android here, and the server backend here.

This is a landmark moment for Britain's fight against coronavirus. In the absence of a viable vaccine, epidemiologists argue that the only way for life to return to something resembling normality is an aggressive programme of testing and tracing.

First, testing: identify who has COVID-19 and isolate them so they can't spread it to anyone else. Secondly, tracing: figure out who they've been in close proximity with, and warn them to get tested and isolate until it's confirmed they aren't carrying the virus.

Smartphone apps are the best way to provide that tracing need. Their ubiquity means healthcare providers can cover more of the population, while simultaneously scaling tracing beyond what would otherwise be possible manually.

Separately, it addresses problems caused by the fallible human mind. People can forget interactions, or they might simply not know whom they interacted with. An app handles that by automatically creating a record of any device within a certain proximity.

How low can you algo?

While the app uses Apple and Google's contact-monitoring APIs, at its heart is a custom risk-scoring algorithm designed to rank the risk of exposure. Alerts are sent based on the amount of time spent in close proximity with a confirmed COVID-19 coronavirus carrier.

Being within two metres (about 6.5ft) of a sufferer for five minutes is ranked at 300 points. If you're in medium proximity, defined as between two and four metres (6.5-13ft), the amount of points accumulated is halved to 150. In order for the app to issue an alert, the user needs to cross the threshold of 900 points.

In practice, that means that you only need to be in close proximity with an infected person for 15 minutes to receive a warning. For those slightly further away, that's 30 minutes.

It's not hard to imagine how you might cross that 900-point threshold, even at a medium distance. You could be on the same bus for half an hour. You could share a workplace – even one with social distancing in place, and desks carefully spaced out. While you can understand why the app's algorithm would conceivably take a more aggressive approach in isolating those potentially infected, it's inevitable that false positives will be an ongoing element of this app.

In just the first few hours of its launch, the NHS COVID-19 app has accumulated a steady flow of downloads. At the time of writing, the Android version had been downloaded more than half a million times, according to its page on the Google Play Store.

Although Apple doesn't offer any public figures, Boston-based analytics firm Apptopia estimated it has received over 170,000 downloads since its launch. It currently ranks supreme on the list of free apps.

Not all users who downloaded the app have a UK-registered phone. Although over 99 per cent of iOS downloads came from UK users, it's an entirely different story on the Google Play Store, where nearly 40 per cent of all downloads came from devices using international versions of the app store.

Around 6.4 per cent of all Android downloads are attributed to devices from New Zealand. Why? The UK was estimated to have nearly 60,000 New Zealand-born residents in 2015. It's plausible that many of those are recent arrivals – perhaps doing their "big OE" – who brought their phones with them, or Brits who lived in New Zealand for some time and have since returned home.

Other nations that appear in the "top 10" include close neighbours, such as Ireland, Norway, the Czech Republic, and Hungary.

App doesn't work with iPhone 6 models or older

Another criticism raised against the app is its incompatibility with older yet still fairly common devices such as the iPhone 6. NHS COVID-19 also refuses to run on devices using Android 5.1 Lollipop and earlier. These accounted for nearly 15 per cent of all Android devices in April of this year.

When confronted with this problem on BBC Breakfast, UK Health Secretary Matt Hancock artfully evaded the question, instead celebrating the public's interest in the app. "I'm delighted to hear so many people are trying to download it – that's excellent," he said.

He later admitted that some may have to upgrade their devices in order to use it.

"Only a small proportion of devices don't have the latest iOS software that was released in April. The reason for that is it needs an accurate version of Bluetooth," he said. "Of course, there are technical requirements – in the same way that if you don't have a phone you can't download it. The best thing that they can do if they want to get the app is to upgrade."

A critic that we have not named said of the app: "It's also utterly useless for contact tracing, hardly ties in with the manual T&T service. It's certainly the flagship of gov.uk's response to covid-19 in that it's too late, too little and generally bollocks."

You can take a gander at the source code here:

1. https://github.com/nhsx/covid19-app-system-public
2. https://github.com/nhsx/covid-19-app-android-ag-public
3. https://github.com/nhsx/covid-19-app-ios-ag-public

And bug-hunters can report vulnerabilities here. ®

* Scotland and Northern Ireland both have their own homegrown apps.