To use this site, please disable the ad blocking feature and reload the page.
This website uses cookies to collect information about your visit for purposes such as showing you personalized ads and content, and analyzing our website traffic. By clicking “Accept all,” you will allow the use of these cookies.
Users accessing this site from EEA countries and UK are unable to view this site without your consent. We apologize for any inconvenience caused.
The Yomiuri Shimbun A smartphone using the government’s COCOA coronavirus contact-tracing app.
The Yomiuri Shimbun
17:48 JST, February 11, 2021
A major flaw that went unnoticed in the government’s novel coronavirus contact-tracing app for about four months and corner-cutting tests of the app have exposed clear shortcomings in the health ministry’s handling of this software.
The Health, Labor and Welfare Ministry said they pressed the company contracted to develop the COVID-19 Contact-Confirming Application – or COCOA, for short – to use actual smartphones in tests of the app, but in fact it simply accepted tests done on a computer. Furthermore, the ministry failed to take action last year despite external sources mentioning that the app was not working on smartphones with the Android operating system. The ministry plans to establish a special team to examine the case and strengthen its checking process.
When a person who has tested positive for the coronavirus registers a number issued by a public health center into the app, a notification is sent to each app user who came within one meter or closer of this person for at least 15 minutes during the previous 14 days. A Tokyo-based tech company received the about ¥100 million order to develop COCOA, and then subcontracted three other firms to build the app. COCOA was rolled out in June, and the tech company also was contracted to maintain and update the app, but entrusted this task to a subcontractor.
According to the ministry, the flaw affected devices using Google’s Android software. The problem emerged in September in an update made by a Tokyo-based app development company subcontracted to do this task. Due to this glitch, COCOA users who had been in close contact with a person who tested positive for coronavirus did not receive notifications.
Smartphones are equipped with a function that keeps a record of other smartphones that came in close proximity. COCOA draws on these records to determine whether a person is a close contact. A programming error resulted in the app being unable to correctly collect this information. The app development company conducted limited mock tests to confirm the app was functioning – on a computer. The flaw went unnoticed because these tests did not use smartphones to confirm whether the app could glean the correct information.
The ministry agreed with the originally contracted IT company that actual devices would be used for tests conducted during app development and updates. However, the ministry decided there was no problem with the mock tests conducted for the update in question. “We needed to quickly get the update out there,” a health ministry official involved in this matter said.
■ Lack of experts on hand
External warnings that the app was not working properly went unheeded.
The program was publicly uploaded online and technical experts were asked to uncover any flaws and submit this information on a dedicated website. When the health ministry released the updated version, multiple anonymous messages pinpointing this flaw and analyzing it were posted online in November and December. The ministry entrusted checking of these posts to the originally contracted company, but it was unaware even of which business – including the subcontractors – was doing this work.
At the end of 2020, messages claiming that people had not received notifications despite being in close contact with an infected person started appearing on social media. The app developer conducted tests with smartphones in January and detected the flaw. It was at this point that the health ministry finally became aware that problems with the app had been pointed out.
As of Feb. 3, the Android version of COCOA had been downloaded about 7.7 million times – about 30% of the app’s total downloads including for Apple’s iPhones.
“We’d bolstered the number of online system experts, but we didn’t have any app specialists,” a senior official of the ministry said. “We have no comeback to criticism that we left this project to outside operators.”
A technical adviser at tech company h2works Inc. and an expert on app development, said such a fault had been likely to happen.
“Flaws are inherent in apps. It’s common sense that the app orderer and the developers work together to examine the cause of any flaw, and then perfect the app,” the adviser said. “I hope the health ministry will take responsibility for what happened, sort out the problem, and provide a useful app.”
