NHS COVID-19 app failed to ask users to self-isolate due to 'software glitch'
The bug is the latest in a long line of errors and glitches to plague the government's contact-tracing app


The UK government’s COVID-19 contact-tracing app was patched last week to fix a bug that meant the system failed to send notifications to thousands of users who should have been warned to self-isolate.
The Test and Trace app, which is supposed to be a core part of the government’s national coronavirus response, hasn’t been working properly since its late September launch because it was set to the wrong sensitivity.
Users whose “risk score” should have triggered an alert, due to possible exposure among their contacts, were not alerted to either get a test or self-isolate due to the error, according to the Times.
As a result, “shockingly low” numbers of users had been sent warnings since the app was released, according to a government source, with Android users among those more likely not to have been sent a notification when they were supposed to.
An update to the app, released last week, fixed both this error, as well as another bug in which users were notified about a “potential exposure” only for the message to disappear without a trace, and without any further details.
The risk threshold is calculated for each user and for each possible COVID-19 exposure using various factors including distance, as well as the infectiousness of the person who has tested positive. The system then works out the overall risk to each applicable individual, and sends out a notification if it exceeds the threshold.
This threshold was due to be lowered when the app launched from 900 to 180, although this didn’t happen until the patch was launched last week. This is according to a blog written by the head of product for the NHS COVID-19 app Randeep Sidhu and the director of product for Test and Trace, Gaby Appleton. Due to a new statistical algorithm in use by the app, the risk threshold is being lowered to 120.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Although 19 million people now use the app, officials have refused to reveal how many people have been told to self-isolate, the Times report added.
The NHS app has suffered a disastrous and long-drawn-out launch, having first been promised in April 2020 and delayed several times due to various concerns, including potential security risks as well as compatibility issues.
The original idea was to pursue the decentralised Google and Apple API, which the majority of national COVID-19 contact tracing apps are powered by. The government then ditched this in favour of developing its own centralised app, although ran into issues when it was trialled on the Isle of Wight and was eventually abandoned in favour of a manual national contact tracing scheme.
RELATED RESOURCE
2021 state of IT asset management report
The role of IT asset management for maximising technology investments
The government then pivoted back to using the Google and Apple API to power its contact-tracing smartphone app, which eventually launched on 24 September. Its release was far from the smoothest, however, with fears initially that it would not be compatible with a large swathe of iOS devices.
A fix was also needed two days after launch when it was revealed that tens of thousands of NHS tests were not compatible with the app’s current build version,

Keumars Afifi-Sabet is a writer and editor that specialises in public sector, cyber security, and cloud computing. He first joined ITPro as a staff writer in April 2018 and eventually became its Features Editor. Although a regular contributor to other tech sites in the past, these days you will find Keumars on LiveScience, where he runs its Technology section.
-
Bigger salaries, more burnout: Is the CISO role in crisis?
In-depth CISOs are more stressed than ever before – but why is this and what can be done?
By Kate O'Flaherty Published
-
Cheap cyber crime kits can be bought on the dark web for less than $25
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott Published
-
Should your business start a bug bounty program?
In-depth Big tech firms including Google, Apple and Microsoft offer bug bounty programs, but can they benefit smaller businesses too?
By Kate O'Flaherty Published
-
OpenAI to pay up to $20k in rewards through new bug bounty program
News The move follows a period of unrest over data security concerns
By Ross Kelly Published
-
Windows 11 System Restore bug preventing users from accessing apps
News Microsoft has issued a series of workarounds for the issue which is affecting a range of apps including Office and Terminal
By Ross Kelly Published
-
Windows 10 users encounter ‘blue screen of death’ after latest Patch Tuesday update
News Microsoft said it is working on a fix for the issue and has offered users a temporary workaround
By Ross Kelly Published
-
SpaceX bug bounty offers up to $25,000 per Starlink exploit
News The spacecraft manufacturer has offered white hats immunity to exploit a wide range of Starlink systems, with a dedicated report page
By Rory Bathgate Published
-
Microsoft announces lucrative new bug bounty awards for M365 products and services
News The new awards will focus on scenario-based weaknesses and offer bonuses of up to 30% for the most severe bugs
By Connor Jones Published
-
Adobe forced to patch its own failed security update
News Company issues new fix for e-commerce vulnerability after researchers bypass the original update
By Danny Bradbury Published
-
Google doubles bug bounty rewards for Linux, Kubernetes exploits
News The increased rewards are said to align better with the community's expectations of a bug bounty programme of this kind
By Connor Jones Published