Coronavirus: NHS reveals source code behind contact-tracing app

The NHS has released the source code behind its coronavirus contact-tracing app.

More than 40,000 people have installed the smartphone software so far.

The health service is targeting the Isle of Wight only, at this stage, but it says this is the first stage of the app's rollout - not a test.

Tests carried out on behalf of BBC News confirm the developers have found a way to work round restrictions Apple places on the use of Bluetooth in iPhones.

In a related development, Health Secretary Matt Hancock has announced that Baroness Dido Harding will head up the wider test, track and trace programme.

The appointment has surprised some given that when she was chief executive of TalkTalk, the internet provider suffered a major data breach and failed to properly notify affected customers.

Centralised system
The NHS Covid-19 app is designed to use people's smartphones to keep track of when they come close to each other and for how long, by sending wireless Bluetooth signals.

If one of them falls ill, they can anonymously trigger an upload of the records so alerts can be cascaded to others they might have infected, asking them to self-isolate, if deemed necessary, potentially before they have any symptoms but are still highly contagious.

Along with other measures, including manual contact tracing, this may allow lockdown measures to be eased without causing another spike in cases.

NHSX, the health service's digital innovation unit, has opted for a centralised system to power the app, so the contact-matching process happens on a UK-based computer server rather than individuals' smartphones.

And there has been a lot of speculation this decision would mean the app was doomed to work badly on iPhones.

Apple limits the extent to which third-party apps can use Bluetooth when they are off-screen and running in the background, although it has promised to relax this rule for contact-tracing apps that use a decentralised system it is co-developing with Google.

And Singapore and Australia have signalled they will switch from centralised to decentralised apps, for that reason.

But NHSX had said it had come up with its own solution.

And preliminary tests by a cyber-security company suggest it has succeeded.

Pen Test Partners installed the app on a handful of "jailbroken" iPhones - altered to allow them to monitor activity normally hidden from users.