Thread by @Psythor

As I've been talking about nothing else, a quick thread on where we're at in the "will the NHS contact tracing app actually work?" mystery.

First, doubts were raised by nerds like me who, knowing how mobile operating systems work, couldn't work out how the app was supposed to work indefinitely in the background, exchanging bluetooth keys with other phones. It just... didn't make sense.

spectator.co.uk/article/why-th…

The NHS told me for that story that it "will" work, but offered no further details. Yesterday - almost 24 hours later, they told Guido the same thing, again offering no details.

order-order.com/2020/05/06/exp…

(Sorry that should have been the Department of Health, not the NHS, told me that, to be ultra-pedantic.)

Then iOS developer like @venderbase started to wade in, seemingly explaining on a technical level how it doesn't work.

passonapp.net/nhsx-covid.html

The gist is that when running in the background, iPhone bluetooth connections behave rather differently. Two locked iPhones, even if the app is running in the background, can seemingly not exchange the right keys for the tracing to work.

One hypothesis was that the plan is to rely on there being other active devices around - or Android devices - which will effectively keep alive the app on iPhones where the app is not in the foreground.

Then yesterday evening, it all got very confusing. The Sun reported a claim that - absolutely astonishingly - Apple had relaxed its app store rules and allowed NHSX to use a "private API" to solve the bluetooth / background problem.

https://twitter.com/thejonnyreilly/status/1258077307635458054

Such a change in Apple policy would have been absolutely huge - with enormous implications for Apple as a company that prides itself on privacy, as well as for other developers and raise tonnes of other questions - would they do the same for Russia or China, say?

But then Apple knocked the story down. They told me that "the Sun story is wrong" and "There is no special API, no arrangement or special treatment".

The NHS app "100%" has to follow the same rules as other apps.

The Sun has since updated its story to remove the claims about the private API.

So would the app work? To confuse things further, around the same time, developers like @jasonkneen who had been pulling the app apart began to report that - amazingly - the bluetooth / background thing was working, and persisting.

As I understand it, Jason hasn't been looking at the source - though NHSX has said it will publish it (though so far hasn't), but his reporting is based on real-ish world experimenting with the app on different devices and so on.

https://twitter.com/jasonkneen/status/1258114934065545216

A company called Reincubate also claims that the app works as described - through "a series of clever workarounds", though doesn't go into too much detail on exactly how.

reincubate.com/blog/staying-a…

If this is true, and NHSX has developed a workaround that solves all of the problems while remaining compliant with Apple's rules then this is a truly remarkable achievement. Not only have we not seen an app work exactly like this before.

In fact, other countries have run into exactly this problem and given up. Australia did something similar - and gave up after it emerged the app was only working properly in the foreground. It's now switching to Google/Apple's own, better system.

theguardian.com/world/2020/may…

And then... one final twist! Just after 8pm last night as my brain was starting to melt, @tim broke the story in the FT that NHSX is "investigating" switching to Apple/Google's alternative decentralised system.

https://twitter.com/tim/status/1258114036685844481

The fact this is being considered is super interesting: It could be a hedge just in case something goes wrong with the NHSX system (a wise move in a pandemic when speed is important!).

Or it could be that they want the contact-tracing system to work across borders, not least because we have yet another massive Irish border problem as Ireland is using the decentralised Apple/Google system.

Or it could be that there is a fundamental flaw in the app, as originally speculated about by me and many other nerds, and they were forced to adopt this crazy centralised approach as a result of path dependency stemming from earlier decisions around testing.

So... after three days of obsessive wondering, will the app work as described? Here's the answer we've all been waiting for: ¯\_(ツ)_/¯

Here's hoping the Department of Health offer some clarity and publish the source before I go completely mad.

Apologies for this thread being much longer than intended. The walls of my house are covered in newspaper clippings and red string.

One last thing as this thread is getting a little traction: I'm a freelance journalist and writer covering tech and/or politics, so would love to write about this and other things for you! DMs are open, email is my Twitter name @ Gmail.

One extra thing I just wanted to share: Apple's response to me last night appears to close out the possibility that NHSX has come up with some slightly hacky workaround like tricking the iPhone into thinking it is a music player.

Here's my query and their response:

Obviously Apple didn't take my question fully head-on there so there could conceivably be some wiggle-room.

I've also read speculation there could be something in iOS 13.5, which is due for release imminently, which somehow squares the circle. But if so, that would signal a major policy change by Apple on background running / bluetooth privacy.

Just to neatly end this thread, here’s a follow-up thread with the answer to the mystery!

https://twitter.com/Psythor/status/1258467515329634304