With all due respect to Rowland, I think this tweet is an inaccurate representation of what the app is doing and I don’t think it’s a bug or that they “accidentally left test code” in the app. (Thread) https://twitter.com/rowlsmanthorpe/status/1311588369055580160

The exposure notification framework has its own built in scoring system and prior to iOS 13.7 I believe there was very little way to customise that algorithm. However the NHSX app uses its own scoring system to minimise false alarms. 2/

In order to do this, the app needs to get extra information about a possible exposure. To do this it needs to call the following (now deprecated) API method: https://developer.apple.com/documentation/exposurenotification/enmanager/3586332-getexposureinfo

As the docs explain, this method will trigger a user notification (because as far as it is concerned there has been an exposure). The API provides a parameter to customise some of the alert message. The app will call this for all possible exposures.

As a result, the system will alert the user but the apps own scoring system may determine that the exposure is a false alarm and doesn’t warrant further action. Unfortunately the scary notification has already been displayed.

This isn’t a “bug”, it’s just how the original API was designed. It was a trade off between the questionable UX and using a custom scoring system.

Of course, I would argue it was a poorly designed API. It has now been deprecated in favour of a newer API that doesn’t appear to trigger these notifications and may make it easier for the app to implement its own scoring logic. This was added in iOS 13.7, early September.

It’s unrealistic to have expected the developers to have switched to this new API so quickly, right in the middle of the test phase, without causing further delays to the initial release. The final release candidate was probably already tested and signed off.

IMO this is largely a result of a poor API and UX on Apple and Google’s part. So what could the app developers have done better?

They could have triggered a second notification after scoring the exposure to inform the user that the alert can be ignored.

They could have displayed some information in the app if the user tapped the system generated notification.

They could present some more transparent information about detected exposures and scores within the app (maybe info overload though).

The way forward is to stop using the deprecated API however it will require either dropping support for iOS 13.5-13.6 or maintaining backwards compatibility which means users on those OS versions will still see the alert. /fin