What happened to Britain's track and trace app?

“Yes of course it’s perfectly true that it would be great to have an app, but no country in the world has a functioning track and trace app,” Boris Johnson claimed last Tuesday in the House of Commons. Keir Starmer calmly pointed out that Germany has precisely such an app. This prompts the question of who is advising the UK Government on technology and how our Prime Minister could be so misinformed.

Starmer pointed out Germany’s app launched on 15 June and has had over 12 million downloads in a week. The app has been all over the internet since the German press launch on 16 June, which was attended by five German Ministers.

The German app is open source and all of its information is freely available on GitHub, the widely used code repository. This allows public (and indeed UK Government) access both to the app software (code) and to the information and documentation. Adding insult to injury, all of the GitHub information for the German app is written in English.

Currently, only people with a German Google or Apple account can register for the Corona Warning app, but the app is being rolled out in a number of countries across Europe over the next few days: the Netherlands, Belgium, Luxembourg, France, Austria, the Czech Republic, Poland, Denmark, Romania and Bulgaria. Notably, the UK is not on that list.

Starmer didn’t mention that Singapore launched its working “Trace Together” open source app in March, before UK lockdown even began. This app’s code has been freely available for use by developers around the world ever since. At this point, Singapore is extending the functionality of its app beyond phones — it is being useable on wearable devices.

Italy, Denmark and France also have apps rolled out across their populations, although their level of success remains to be seen. Danish citizens in particular are already used to a high degree of digitisation in their lives. The Danish “NemID” digital identity scheme has 85 per cent take-up rate.

Why has Germany succeeded and Britain been left so far behind in developing an app?

Firstly, both countries’ Governments were initially heavily criticised by Civil Rights Groups for their decisions to go down the “Centralised” rather than the “De-Centralised” app database route. This means that the structuring of the app allowed for data to be captured in a central database where it could be analysed.

Automated analysis would then be used to sift captured data using AI-based systems, to allow a level of risk assessment in the advice sent (or not sent) to users. Depending on the calculated risk at that point, the recommendations to users, e.g. the instruction to self-isolate or not, could vary based on this analysis of strength of signal, length of exposure and proximity.

Importantly, the use of a centralised database allows data to be captured for scientific analysis.  Germany however withdrew from its centralised “PEPP-PT” app on 27 April, following pressure from civil society groups, due to its lack of transparency.

Not only did the German Government “fail fast”, but it also listened and perhaps even more importantly, was seen to listen and react to privacy concerns — 49 days later, it launched a de-centralised app.

I regularly speak to tech folk all over the globe. This week, talking to a prominent German software developer, Isabel Drost-Fromm, she told me that the German Government has done “just enough right to leave [data privacy] organisations in the interesting position where they had nothing left to criticise.”

The UK Government had meanwhile deflected criticism of the centralised model and driven the NHSX app to be the first publicly tested at scale. Perhaps one of the many learning points for the UK Government is that testing is done to identify problems. A public testing process, under the scrutiny of the population and press, was a gamble — it failed in a very public and humiliating manner, thanks to the inevitable media attention created by the expectations set by the Secretary of State.

NHSX committed the “front end” user facing code to GitHub, for developer scrutiny on 8 May, with a promise that the remaining “back end” infrastructure would be available shortly. An update of the code from the Isle of White testing, where the App was trialled, was shared on June 26. Still no sign of the “back end”.

Developers watching this have criticised the policy decision to open source but not develop in the open. The question here is not one of developer skills. It is one of Government-driven approach.

Both Germany and the UK involved commercial companies in the production of their apps. Whereas the UK allowed the NHSX team to follow their policy of open sourcing, but slowly, Germany released information “surprisingly early and continuously”. This allowed 7,000 bugs to be identified and fixed.

This approach — making code public and accepting the contributions of coders rather than making testing public  — has paid off big time for the German Government.

Germany’s Government is showing tech leadership not only in the development of its track and trace app, but in areas including digital Sovereignty and Cloud Computing. They are both leading this and building collaboration with other nations including France. The UK Government is still notable by its absence.