Coronavirus: 'Fat finger error' gives contact-tracing app users wrong alert levels
A tech expert tells Sky News the error risks "losing the reputation which is all important for this app".
Saturday 17 October 2020 07:30, UK
Users of the contact-tracing app for England and Wales have reported receiving updates incorrectly telling them the risk level in their area had changed, after what Sky News understands was a mistake by the app's developers.
The Department of Health and Social Care confirmed the error, but did not say how many people it had affected.
One expert told Sky News he believed that as many as four million people could have been sent incorrect updates by what he described as "a fat finger error".
The problem was noticed by some of the app's 16 million users on Friday evening, who complained on Twitter that the risk level for their area had been changed in ways that contradicted the official government guidance.
Several users in Liverpool, the first city in the country to be put into the toughest Tier 3 category of restrictions for very high risk areas, said their apps had sent them an alert incorrectly telling them they were being downgraded from very high risk to high.
App users in Sheffield, Nottingham and parts of the Midlands said they had been sent notifications incorrectly telling them their risk alert level had been downgraded to medium.
"We live in Walsall and it is classed as HIGH risk," one wrote. "Why have we all received an alert saying our risk level has changed due to 'rising risk levels' yet it is now MEDIUM? This is very confusing."
An expert who was monitoring the app at the moment the error occurred said the problem was almost certainly caused when a blank file was accidentally sent to phones instead of an alert level update.
"I was monitoring for changes to the app to see whether they were addressing any of the issues that had been raised about confusing risk level messages," said Jeremy Place, an information security specialist.
"I noticed that the file was empty from 18.21 for about an hour."
A recent update to the app changed the postcode alert system to bring it into line with the government's new Tier classifications.
Previously, it had three alert levels: low, medium and high. The update changed these to medium, high and very high.
Any phone receiving the empty file would have reverted to the old system, Mr Place said, generating an incorrect alert level and triggering a message which said: "The risk level in your area has changed."
Several users reported the issue on social media by placing two phones with different alert levels next to each other.
The phone with the incorrect alert level displayed the old alert level format, confirming Mr Place's analysis.
Mr Place, who operates his own QR check-in app, said that the postcode alert level was refreshed on phones every four hours, but he believed that not every app downloaded the new files at the same time.
Normal practice, he said, would be to spread the downloads out to reduce the strain on the system, so a quarter of apps were refreshed every hour.
As the empty file was available for around an hour, around a quarter of phones could have been affected by the error.
"We are advised that 16 million phones have downloaded the contact-tracing app. If those phones are still running the app, then it could affect four million people," said Mr Place.
However, he added that only people who had updated their apps to incorporate the latest change would be affected.
Asked how bad the mistake was, Mr Place, an experienced systems architect, described it as "a fat finger error" with "no technical risk".
But, he said: "What has been lost is the reputational aspect. You are losing the reputation which is all important for this app."
In order to correct the error, the team behind the app sent another file at 19.31. As a result of this update, many more phones would be sent a message saying their alert level had changed, although the results of this second alert would be correct.
The news is the latest challenge for the contact-tracing app, which has been criticised for sending out false alarms telling people they have been near someone who has tested positive.
These messages, which are automatically sent by the Google and Apple system on which the app has been built, have caused widespread anxiety among users.
The Department for Health and Social Care has said that any false alarms should be ignored and that instructions to isolate will be made clear within the app.
Asked about the incorrect risk level alerts, a DHSC spokesperson said: "We are aware of an issue which impacted updates to postcode alerts for some app users.
"This was identified and resolved within an hour and users' phones will automatically update to show the correct local alert level for their area along with new guidance."