A code error in the NHS Covid-19 app meant users had to be next to a highly infectious patient for five times as long as the NHS had decided was risky before being instructed to self-isolate, the Guardian has learned. The oversight in the app meant thousands of people were told they did not need to quarantine when they were in fact at risk of spreading coronavirus. The problem was only discovered last week, when software engineers rewrote how the app decides who needs to isolate and discovered it had been relying on faulty maths since its launch in September. According to the Sunday Times, which reported on the flaw, a source said the fault meant that a “shockingly low” number of warnings were issued. Despite claiming more than 19m downloads of the app, which is for use in England and Wales, the UK government has continually declined to reveal how many users have been advised to isolate. In Scotland and Northern Ireland, where similar apps have fewer users, more than 25,000 people have been warned of their possible exposure to the virus. A Department for Health and Social Care (DHSC) spokesperson said the England and Wales version was “the only app in the world using the latest Google-Apple technology to better gauge distance to identify those most at risk, and is deemed ‘excellent’ by international standards. “We anticipate more app users who are at high risk of having caught the virus will receive a notification to self-isolate, and that will be to everyone’s long term benefit by reducing the chances of those with the virus passing it on to others. We are very clear, everyone who is contacted will have been in close contact with someone who has a confirmed case of COVID-19.” The root of the error, the Guardian has learned, was a decision to incorporate a measure of “infectiousness” into the app’s code. While the app was undergoing testing in the Isle of Wight, it used a simple metric that recommended isolation for anyone who had been in contact – closer than 2 metres – with a potentially infectious person for 15 minutes or more in a single day. But shortly before the app was launched nationally, it was updated to account for the fact that people are most infectious shortly after their symptoms show. The maths was changed so that people outside that period of peak infectiousness counted for just two-fifths of the risk. Since that meant the overall score was likely to be lower, the intention was to reduce the risk threshold correspondingly to ensure that someone of maximum infectiousness would need just three minutes of contact before they triggered an alert. But that change never happened, and as a result, users were only told to isolate if they had spent 15 minutes close to a very infectious person, or nearly 40 minutes near someone who was pre-symptomatic but still thought to be shedding the virus. The error was only discovered when a new version of the contact-tracing app, which can better account for exposures at mid-range (over a metre away) was created. The unfeasibly high risk score also explained another problem plaguing the app: “ghost notifications” warning users that they may have been exposed to someone with Covid, but which never resulted in advice to isolate. The app’s initial advice to users was that these notifications could be safely ignored, since they reflected a contact below the risk threshold; now that the NHS risk threshold is known to have been artificially low, one insider said, it is likely that the vast majority of those ghost notifications should in fact have been advice to self-isolate. The new version of the app does away with them altogether: users will now only receive a notification if they are supposed to self-isolate. “By removing these notifications, users can have the confidence that if they have a contact notification, they know it is from the app itself and based on the most accurate information available,” say Randeep Sidhu head of product for the test and trace app, and Gaby Appleton, the director.