Matt Hancock was clear: it was all Apple’s fault.
Standing at the same Downing Street podium where he had promised the government’s contact-tracing app would “save lives”, Mr Hancock now admitted it would not be ready for the lifting of lockdown.
For months, the health secretary had insisted a homemade app was better than one based on the technology developed by Google and Apple.
Yet even as he announced that the government would now use the American firms’ system, Mr Hancock rounded on Apple.
“As it stands, our app won’t work because Apple won’t change their system,” he said, citing a statistic some believe was inaccurate: that the app’s Bluetooth system, which was supposed to detect nearby phones as a way of tracking potentially risky contacts, only detected 4% of iPhones, rendering it effectively useless.
According to several sources familiar with the research, that number only applied to iPhones left until they fall asleep, a subset of a larger figure.
To some onlookers, it was an exercise in deflection. “Like when you’re playing paintball and you throw up a smoke grenade,” as one tech industry source put it.
To others, it was a rare occasion when a senior politician had told the truth about one of the world’s most powerful companies.
Either way, the statement was quickly retracted. According to two sources with knowledge of the matter, a Downing Street official called Apple after the briefing to apologise for the health secretary’s comments.
Like when you’re playing paintball and you throw up a smoke grenade.
Apple says it has worked extensively with all branches of the UK government, and in recent weeks, according to a Whitehall insider, Mr Hancock has told officials the firm is “wounded” and is “making nice”.
Such is the turnaround that a source close to the health secretary sung the company’s praises, saying: “We’ve been working incredibly well with Apple.”
Any talk of disagreement was “surface noise”, the source said, adding: “We’ve got a really good collaborative process going on.”
Yet whether the mood is warm or cold, the importance placed on the relationship reaffirms the lesson of England’s attempt to build a contact-tracing app.
Even in the midst of a crisis, the world of technology belongs to Apple and Google. The rest of us – from prime ministers and health secretaries down – are merely living in it.
More than a dozen people who witnessed the development of the contact-tracing app, from inside Downing Street, Whitehall, the NHS and the tech world, agreed that the project had two fundamental flaws. The first was the expectations placed upon it.
Even as the project struggled to take shape, the stakes were repeatedly raised, with Mr Hancock making commitments it was not clear he was able to meet.
When the health secretary claimed in mid-May that the app would be “rolled out nationwide by end of next week”, one industry source says, the news of the deadline came as a surprise to the engineers building it.
There is no evidence to suggest this undermined the English response to coronavirus. It did not, for instance, lead to the cessation of manual contact tracing, a move planned from the start of the pandemic.
But people involved with the project, speaking mostly on condition of anonymity, feel as if they were set up for highly public failure, and regret the loss of time and public trust.
To explain why a highly experimental project was given this prominence, Whitehall sources talk about Mr Hancock’s “fanboy” attitude towards technology and what one insider called his “tendency to overpromise and only sometimes deliver”.
They also point back to a time before anyone had ever heard of COVID-19, when Mr Hancock launched a new innovation unit for the NHS, NHSX, and appointed former diplomat Matthew Gould as its CEO.
The pair planned to bring a “tech revolution” to the rickety health service. When coronavirus hit, they felt they needed to hasten this transformation.
A tendency to overpromise and only sometimes deliver.
“The product idea was that this app would be the beginning of something very significant in how the NHS uses data,” recalls one Whitehall source.
“That’s one of the reasons, I believe, why the decision went towards centralised data. The NHS would have the data and would be able to use it.”
The ambition may have led to the second fundamental flaw identified by numerous people involved with the project. Despite all the energy invested in it, there was never complete clarity about exactly what the app was for.
This dynamic was evident from the outset. At a decisive Department of Health meeting on Friday 6 March, sceptics such as Downing Street adviser Ben Warner argued that the app would not bring enough clear benefits.
A source who attended the meeting said that no single person or piece of evidence undermined this view – including Mr Hancock, who, the source argued, did not drive the creation of the project. The most persuasive argument in the “genuinely scary” situation was simply: “Something is better than nothing.”
From this point the project rapidly picked up pace. The next day, scientists from the University of Oxford’s Big Data Institute presented a paper showing the epidemiological advantages of “digital contact tracing”.
By Monday, an internal team had been assembled. After Sarah Wilkinson, CEO of NHS Digital, refused to let her organisation take part – “she’s smart,” an NHSX source noted ruefully – outside companies were brought on board.
Two people who worked on the app during this period recall a febrile atmosphere, as a “hodge-podge of suppliers and contractors” tried to move at rapid pace without being entirely sure where they were going.
“There was no one person who was responsible for delivery,” says one source. “There was a big move to put together an app without any clear idea of what this app was trying to do.”
There was a big move to put together an app without any clear idea of what this app was trying to do.
In this environment, privacy was not the first consideration. According to two independent sources, plans were developed to use mobile phone location data for tracking – although the government denies this, and the final version of the app did not track users’ locations.
Defenders of NHSX argue that any confusion was an inevitable consequence of working at breakneck speed during a period when the strategy in Downing Street was changing rapidly, and that it settled down after it was taken over by Pivotal, a subsidiary of US tech conglomerate VMWare.
To imagine how it might have turned out if it had come together, it is only necessary to look at the other initiative launched by NHSX at that moment: a vast data store designed to pull in data from across health and social care.
Run by secretive Silicon Valley firm Palantir, the project has been controversial, but officials praise its ability to bring information to the right place at the right time – exactly the kind of result NHSX was designed to deliver.
Mr Hancock and Mr Gould hoped the app would have an even bigger impact.
Instead, they ran into Apple.
When Apple and Google announced a joint contact-tracing project on 10 April, they presented the UK government with a dilemma.
NHSX was firmly committed to an app which used low energy Bluetooth to create a record of nearby phones. Such was its centrality that when Public Health England drew up a draft operating model for contact tracing on 23 April, it listed the app alongside swab testing as one of six “pillars”.
Yet already problems were emerging with the strict rules Apple placed on how apps could use Bluetooth.
Restrictions intended to prevent apps from tracking users without consent meant that if the app was taken off the screen or the iPhone fell asleep, then the connection to Bluetooth was cut off, making contact tracing impossible.
Apple was so adamant it barred at least one country’s contact-tracing app from the App Store. A senior foreign government official involved in appeals to the firm said it could be flexible – but only to itself.
The official recalled: “They said, ‘I’m sorry we aren’t able to do anything. In order for us to unlock some of these constraints, we would need to release a major OS update. This is the kind of thing that we only do once a year’.
“And then a couple of weeks later they say, ‘Oh we are going to release a major OS change,’ and the rest is history.”
Working with Google, Apple agreed to loosen its controls to allow public health authorities to do contact tracing (something it says needed to be done universally, rather than piecemeal, to reflect the nature of its global system, and to reduce the risk of the system being used maliciously).
But to get this access, apps had to play by the tech companies’ rules on how the data should be stored.
No central records were allowed, even though they would have made it easier to gather data on the spread of the virus. Instead, apps had to store data in a decentralised way, on individual phones.
National governments raged at this restriction. (“We will remember this when the time comes,” the French digital minister threatened.) But for technical teams, the choice was simple.
“It was obvious immediately,” says Luca Ferrari, founder of Bending Spoons, the company which built the Italian contact-tracing app. “An absolute no-brainer. You should switch.”
Faced with the possibility of an app that Mr Ferrari believed would be “plagued by a number of technical limitations”, the Italian government quickly approved a move to Apple and Google’s framework.
Other countries, including Germany, Japan, Denmark and the Republic of Ireland did the same – partly out of pragmatism, but also because the system was undoubtedly more private.
We will remember this when the time comes.
Yet although NHSX was warned internally and externally about the difficulty – Mr Ferrari says: “We compared notes. We had the same issues” – the UK was committed to a different path, following one fateful decision.
Unlike almost any country in the world, the NHSX app wouldn’t send out alerts based on a positive test, but on reports of symptoms made by users.
Part of the reason was a desire for epidemiological data. But just as important, according to three NHSX advisers, was the fact that the English testing system couldn’t deliver results or data fast enough to make the app work effectively.
This constraint shaped the entire project, because it was impossible to keep an app based on self-reporting secure without collecting data on how it was used.
Simply put, people might not tell the truth – and to protect against this possibility, a centralised app was needed.
To make the app work, the developers would have to achieve the extraordinarily difficult task of circumventing Apple’s restrictions. And the politicians would have to decide how far they were willing to go to challenge the tech companies’ control of the platforms they owned and operated.
For many people involved with the app, the mystery is not why the UK developed a centralised option, but why it took so long to switch away from it.
“That’s the key question,” says Professor Lillian Edwards, a member of the app’s Ethics Advisory Board, who watched with bemusement as the project lost momentum.
As soon as Google and Apple released their technology in mid-May, NHSX awarded a £4m contract to Swiss company Zulke to look into it. But for more than a month, there was no change.
The delay continued even after NHSX had decided to stop relying on self-reporting to trigger the app’s alerts.
On Thursday 4 June, the Ethics Advisory Board was told that “alerts will be based on contacts with cases confirmed by testing, rather than based on self-reported symptoms”. (A government spokesperson said the change was to align the app with the manual tracing programme.)
The chief rationale for a centralised system had been removed – and still no switch was forthcoming.
While the project drifted, other governments were moving forward. Northern Ireland’s health minister rejected the English app, citing “difficulties” and “uncertainties” in its development, and opted instead for Google and Apple’s system.
Currently being developed by local firm Kainos, the region’s app is expected to be released by the end of July.
To Professor Edwards, one of the problems was the information coming back from the pilot on the Isle of Wight.
Launched with some ceremony on 5 May – Mr Hancock declared: “Where the Isle of Wight leads, Britain follows” – it did not seem designed to answer specific questions about its functionality.
“My impression was that it was primarily intended to be able to say what percent of the population there had downloaded the app,” says Professor Edwards. “That was the number one PR policy goal.”
Even the number of downloads was hard to fix. On 14 May, Transport Secretary Grant Shapps declared that 72,300 people, “over half the residents of the Isle of Wight”, had installed the app. A few days later, Downing Street put the total at “roughly 60,000”.
The difficulty, according to a Whitehall source, was that there was no way to verify whether people using Isle of Wight postcodes to get access to the app were actually there in person, so anyone downloading it for research was accidentally added to the total. (The final number was recently confirmed as 56,000, a figure the government says it tracked accurately.)
Other kinds of information also proved hard to acquire. According to an adviser to the project, an attempt to assess the impact of the app on different ethnic groups was delayed after a survey showed the island wasn’t diverse enough to provide useful responses.
A Department of Health spokesperson said: “The NHS COVID-19 app has undergone some of the most rigorous testing in the world”.
But the final test which showed that the app was only detecting 4% of iPhones had to be conducted away from the island, an NHSX source said, because it wasn’t set up to answer the most basic question of all: whether it actually worked.
“How would you know if two phones were meant to ping [on the Isle of Wight]?” the source said. “How would you know they had been close? Or not?”
It was the results of this test which killed the project, once they reached the new head of NHS Test and Trace, former TalkTalk CEO Baroness Dido Harding.
Since arriving in May, she had downgraded the app to the status of “cherry on the cake” and brought in a former Apple executive to run it, establishing a reputation as “someone everyone is scared of”, as one NHSX source put it.
Now, on 18 July, she made a decisive intervention, seizing on the information as evidence that the app wasn’t working. Mr Hancock made the announcement at the daily press briefing, but NHSX sources say the key move came from Baroness Harding.
The attempt to build a homegrown app was over. From now on, the NHS was committed to Google and Apple.
We have agreed to share our own innovative work on estimating distance between app users with Google and Apple… while using their solution to address some of the specific technical challenges identified through our rigorous testing.
Such was the speed of the intervention that staff at NHSX were only told on the morning of the announcement. A senior official in a foreign government said they had been assured “not 24 hours” earlier that the existing app would continue to be used.
Yet while the decision brought expectations down to a more manageable level, more than one senior adviser to the project questioned whether it had corrected the app’s other fundamental flaw. To them, it still didn’t seem clear what it was for.
The issue was the temperamental technology at the heart of the app, Bluetooth.
Experiments on the Isle of Wight and in the anechoic chamber inside the National Cyber Security Centre produced eyebrow-raising results.
Some Android phones reported a constant signal strength or spat out numbers at random. Signals changed because of how a phone sat in the hand.
The problem was how to use this chronically unreliable data to decide whether a contact was risky. Inside NHSX, a team worked with the Alan Turing Institute on the issue. A senior official described the work as “spectacular”, saying it went some way to allowing NHSX to tell who should be warned when a case was identified.
But there was a catch. NHSX was only able to do this work because it wasn’t using Apple and Google’s system.
Their technology gave public health authorities the ability to use smartphones’ systems, but it did not provide access to raw Bluetooth data. Rather, information was presented as crude estimates, which could not be interrogated or fine-tuned.
“Google and Apple have given governments an abacus in an era of machine learning,” wrote Tom Loosemore, one of the founders of the Government Digital Service, in an article shared within Downing Street and the Department of Health.
Google and Apple have given governments an abacus in an era of machine learning.
Not only was Google and Apple’s system frustratingly opaque, it didn’t take in data at regular intervals to compensate for Bluetooth’s quirks. Senior advisers to NHSX weren’t convinced it worked.
Two pointed to research by Trinity College Dublin, which concluded that the reflection of radio waves from metal made getting reliable information on a bus “hard or perhaps even impossible”.
Similar tests in supermarkets showed that two people walking at the opposite ends of aisles would appear to be almost next to each other. (Google and Apple did not respond to a request for comment on this specific problem, but engineers at both companies stressed that while Bluetooth was not ideal for measuring distance, it could be a useful tool, and was improving rapidly.)
The choice came down to priorities. As one adviser put it, Apple and Google’s app would detect everyone, but it wouldn’t detect the most risky people very well. With the NHSX app, the reverse was true.
The question for the government was who they wanted to identify. With its answer, it seemed determined to have its cake and eat it.
In response to the claims in this article, a Department of Health spokesperson told Sky News that “our response to this virus has always been that we are willing to back innovation, to be ambitious and to make the most of new and emerging technology”.
The spokesperson added: “Our aim is that it will help users engage with every aspect of the existing NHS Test and Trace service, which is successfully up and running and has already helped stop more than 100,000 people from unknowingly spreading the virus.”
Yet, with no timeline set for its arrival, it is still unclear whether England will ever have a contact-tracing app.
The government’s hope, according to a senior official, is that Google and Apple will integrate NHSX’s work on Bluetooth into their framework. But the official had to admit they didn’t know if this would happen, or even the timeline for a decision.
On this, and many other questions, control now rests with Google and Apple.
The two firms maintain that they are only working to stop the spread of COVID-19 and protect privacy, but they have shown where power truly lies in the world of technology. Did they outmanoeuvre governments around the world?
“I wouldn’t say they outmanoeuvred them during this crisis,” says Michael Veale, a lecturer in digital rights and regulation at University College London. “In practice the outmanoeuvring happened years ago, when the platforms created and consolidated their walled gardens without effective regulation or oversight.”
“There has been so little long-term thinking on platform power that any engagement with the firms is on their terms, short-term and ad hoc.”
To see that dynamic in action, it is worth thinking back to early April, when Google and Apple announced that they were getting into contact tracing, beginning a long-term rollout of the technology. The UK government had already started its work. This could have been a moment for it to take the lead.
But in Westminster, other considerations came to the fore. On 10 April, Boris Johnson had just been moved from intensive care, after a case of coronavirus had brought him close to death. The health secretary and the cabinet secretary had also been ill. The government was, one Whitehall source recalls, “desperate” for good news – and the app seemed to be just that.
“These were very dark moments,” the source recalled. “The prime minister was ill. Matt Hancock had been ill himself. Thousands of people were dying every day. You had a government, a machine, that was terribly eager for good news.”
“It was a lot like 1940, the first few months,” the source reflected. “It was a bit like the Norway campaign. Go off and do something that’ll be a big success – and it turns out to be a debacle.”