Incident: NHS Covid-19 App Update Blocked for Violating Apple and Google's Rules

Published Date: 2021-04-12

Postmortem Analysis
Timeline 1. The software failure incident happened in April 2021.
System The system that failed in the software failure incident reported in Article 113158 is: 1. NHS Covid-19 app update system - The update to the NHS Covid-19 app failed due to a breach of the terms agreed upon with Apple and Google, specifically related to the collection of location data [113158].
Responsible Organization 1. The makers of the NHS Covid-19 app were responsible for causing the software failure incident by planning an update that violated the terms of the agreement with Apple and Google [113158].
Impacted Organization 1. NHS Covid-19 app makers [113158] 2. Department of Health in England and Wales [113158]
Software Causes 1. The software failure incident occurred because the update to the NHS Covid-19 contact tracing app in England and Wales was blocked for breaking the terms of the agreement made with Apple and Google, specifically related to collecting location data [113158].
Non-software Causes 1. Misalignment with Apple and Google's terms of agreement [113158]
Impacts 1. The update to the NHS Covid-19 contact tracing app in England and Wales was blocked by Apple and Google for breaking their terms of agreement, impacting the planned functionality of asking infected users to share their check-in histories [113158]. 2. The failure to release the update resulted in a delay in implementing the automated process of notifying app users who may have been exposed to infected individuals, affecting the intended privacy-protecting approach [113158]. 3. The incident highlighted the importance of adhering to the rules set by tech giants like Apple and Google, emphasizing that governments have had to adjust their responses to the pandemic based on these rules [113158].
Preventions 1. Ensuring thorough understanding and compliance with the terms and conditions set by Apple and Google when using their contact tracing API [113158]. 2. Conducting a comprehensive review of the proposed app update to identify any potential violations of the agreed-upon terms with Apple and Google [113158]. 3. Implementing a robust internal review process to catch any missteps or deviations from the agreed guidelines before attempting to release updates [113158]. 4. Seeking clarification or guidance from Apple and Google if there are uncertainties regarding the interpretation of the rules to avoid unintentional breaches [113158].
Fixes 1. Ensuring compliance with the terms of agreement with Apple and Google regarding the use of their contact-tracing technology to avoid future blocks on updates [113158].
References 1. Apple 2. Google 3. Department of Health 4. NHS Scotland 5. NHS Covid-19 app team

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the NHS Covid-19 app update being blocked for breaking Apple and Google's rules highlights a situation where a similar incident happened within the same organization. The article mentions that the NHS Covid-19 app team had previously switched to using Apple and Google's contact tracing API in June 2020 after their original effort was found to miss potential cases of contagion. Despite knowing the rules set by Apple and Google against collecting any location data, the team attempted to introduce a feature that violated these terms, leading to the update being blocked [113158]. (b) The incident also sheds light on how other organizations have managed similar situations differently. For example, Scotland avoided the pitfall faced by England and Wales by releasing a separate app called Check In Scotland to share venue histories instead of trying to integrate the functionality into their contact-tracing app. This shows that different organizations may approach software updates and compliance with tech giants' rules in varying ways to avoid similar failures [113158].
Phase (Design/Operation) design (a) The software failure incident in the article was related to the design phase. The update to the NHS Covid-19 app was blocked because it included a function that violated the terms agreed upon with Apple and Google from the start. The plan to ask users to upload logs of venue check-ins, which involved collecting location data, was not allowed under the terms of the agreement [113158]. (b) The software failure incident was not related to the operation phase or misuse of the system.
Boundary (Internal/External) within_system, outside_system (a) The software failure incident in this case can be categorized as within_system. The failure occurred due to a misstep by the developers of the NHS Covid-19 app in attempting to introduce a new feature that violated the terms agreed upon with Apple and Google. The update to the app, which aimed to ask infected users to share their check-in histories, was blocked by Apple and Google because it involved collecting location data via the software, which was explicitly prohibited under the terms of the agreement [113158].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the NHS Covid-19 app update was primarily due to non-human actions. The update was blocked by Apple and Google because it violated the terms of the agreement made with them regarding the use of their contact-tracing technology. Specifically, the app's plan to collect location data from infected users' check-in histories was in direct violation of the agreement, which prohibited the collection of any location data via the software [113158]. (b) However, human actions also played a role in the failure. The decision to include the functionality to upload venue check-in histories in the update was made by the developers of the NHS Covid-19 app. Despite knowing the rules set by Apple and Google against collecting location data, the app team proceeded with implementing this feature, leading to the failure of the update being blocked by the tech giants [113158].
Dimension (Hardware/Software) software (a) The software failure incident in the article was not related to hardware issues. It was primarily due to a misstep in the software update that violated the terms of the agreement with Apple and Google, leading to the blocking of the update [113158]. (b) The software failure incident in the article was directly related to software issues. The update to the NHS Covid-19 app was blocked because it included a function that violated the terms agreed upon with Apple and Google regarding the collection of location data via the software [113158].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident reported in the articles is non-malicious. The failure occurred because an update to the NHS Covid-19 contact tracing app in England and Wales was blocked by Apple and Google for breaking the terms of their agreement. The app developers had planned to introduce a feature that would ask infected users to share their check-in histories, which involved collecting location data via poster barcode scans. However, this functionality was explicitly banned by Apple and Google, as health authorities using their contact-tracing tech were not allowed to collect any location data via the software. This misstep led to the failure of the update and the app not being able to implement the intended feature [113158].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident related to the NHS Covid-19 app update being blocked for breaking Apple and Google's rules can be attributed to poor decisions made by the app developers and health authorities. The update planned to ask infected users to share their check-in histories, which involved collecting location data via the software, despite the explicit ban on such function by Apple and Google [113158]. This misstep occurred despite the clear rules set by the tech firms regarding the use of their contact tracing API, which explicitly stated that apps must not share location data from the user's device [113158]. The Department of Health described the approach as "privacy-protecting," but it was still a breach of the terms agreed upon when adopting Apple and Google's technology [113158]. The failure to comply with the rules set by Apple and Google ultimately led to the update being blocked, highlighting the consequences of poor decisions made in implementing the functionality of the app.
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident in Article 113158 can be attributed to development incompetence. The update to the NHS Covid-19 app was blocked because it violated the terms agreed upon with Apple and Google. The app developers planned to introduce a function that collected location data from infected users, which directly contradicted the agreement not to collect any location data via the software. This misstep occurred despite clear rules set by the tech firms, indicating a lack of professional competence in adhering to the terms of the agreement [113158]. (b) The software failure incident in Article 113158 does not seem to be accidental. The violation of the terms with Apple and Google, leading to the blocking of the app update, was a result of a planned function to collect location data from infected users. This indicates a deliberate decision made by the developers, rather than an accidental introduction of contributing factors [113158].
Duration temporary The software failure incident described in the article is temporary. The update to the NHS Covid-19 app was blocked by Apple and Google due to breaking the terms of the agreement related to collecting location data, which was not allowed under the terms of using their contact-tracing tech. This led to the failure of the update being available for download from the app stores, keeping the old version live [113158]. The incident was a result of specific circumstances related to the breach of the agreement with Apple and Google, rather than a permanent failure affecting the entire functionality of the app.
Behaviour crash, omission, timing, value, other (a) crash: The software failure incident in the article can be categorized as a crash. The update to the NHS Covid-19 app was blocked by Apple and Google, resulting in the system not being able to perform its intended function of asking infected users to share their check-in histories [113158]. (b) omission: The failure can also be categorized as an omission. The system omitted to perform its intended function of asking users to upload logs of venue check-ins if they tested positive for the virus, as this functionality was blocked by Apple and Google [113158]. (c) timing: The timing of the failure is also relevant. The update was timed to coincide with the relaxation of lockdown rules, but it was blocked by Apple and Google, resulting in the system not being able to perform its intended function at the expected time [113158]. (d) value: The failure can be categorized as a value failure. The system was performing its intended function incorrectly by attempting to collect location data from users, which was explicitly banned by the terms agreed upon with Apple and Google [113158]. (e) byzantine: There is no indication of a byzantine behavior in this software failure incident. (f) other: The other behavior exhibited by the system in this failure incident is attempting to implement a functionality that was explicitly prohibited by the terms agreed upon with Apple and Google, leading to the failure of the update to be released as planned [113158].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence delay, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) unknown (e) delay: The software failure incident resulted in a delay in the deployment of the functionality of the NHS Covid-19 app to enable users to upload their venue history, impacting the intended automation process for alerting users who may have been exposed to the virus [113158]. (f) unknown (g) no_consequence: The article mentions that the deployment delay did not impact the functionality of the app, and discussions were ongoing with partners to provide beneficial updates to the app [113158]. (h) theoretical_consequence: There were potential consequences discussed, such as the impact on the intended automation process for alerting users and the delay in beneficial updates to the app [113158]. (i) unknown
Domain health (a) The failed system was intended to support the health industry. The NHS Covid-19 app update, which was blocked for breaking Apple and Google's rules, was designed for contact tracing and notifying users about potential exposure to the virus [Article 113158].

Sources

Back to List