Lessons from the NHS Covid Contact Tracing App Programme (Part II)
Prof. Sir Anthony Finkelstein
President, City St George’s, University of London
Published on April 10th, 2026
The NHS Covid Contact Tracing App provides a salient example of science advice in challenging settings (as fully outlined in part 1). The lessons from the development of this programme and the science advice ecosystem around it are not primarily technical. The technical questions were difficult but tractable. The harder problems were institutional, political, and conceptual - and most of them were visible, in retrospect, before the emergency began. The experience developing the app (see part I) illustrates the practical reality of science advice in unstable settings. Advisers rarely choose the institutional circumstances in which they operate. They inherit them. The task is therefore not to design ideal advisory systems but to work within imperfect ones while maintaining analytical integrity.
Hindsight is a poor basis for judging decisions made under uncertainty and at pace. It is, however, the correct basis for institutional learning. Criticising individuals for decisions that looked reasonable at the time is mostly unproductive. Identifying the structural conditions that made those decisions harder than they needed to be is the point of the exercise.
The emergency planning frameworks that existed prior to the pandemic were built on models of crisis that were decades old. They assumed physical disruption, supply chain failure, and coordination challenges. They did not adequately model a crisis in which the critical interventions were digital and in which the information environment was itself a significant variable. Updating those frameworks is not optional.
The training I had received over years of SAGE participation and civil contingency exercises was invaluable. To the extent that the mechanisms failed, it is because they were designed for short-run emergencies rather than crises stretching across months and operating at global scale. We should have appreciated this earlier.
Emergencies are increasingly digital, and so too are the best responses. This is the central structural lesson. Critical infrastructure is no longer exclusively physical. It lives in software, in platforms, in APIs maintained by private companies operating under their own governance frameworks. A government that has not mapped its dependencies on that infrastructure, and has not established the technical capabilities, relationships, and legal authorities needed to act within it under emergency conditions, is not prepared. Most governments are not prepared.
Privacy is a genuine value and deserves serious institutional protection. The privacy debate as it was actually conducted around the contact tracing app was, in significant part, not about privacy. It was about architectural preferences, about distrust of government that was sometimes justified and sometimes reflexive, and about a public discourse that could not distinguish between what was being proposed and what critics feared might eventually be proposed. The effect was to constrain a public health programme in ways that had real epidemiological costs. Taking privacy seriously requires being precise about what the actual threat is, and this debate was frequently imprecise.
Questions of neutrality also arise in such circumstances. Scientific advisers are often described as 'honest brokers', presenting evidence without advocating particular political choices. In practice the boundary is less clear. Recommending one technological architecture over another, or emphasising particular epidemiological risks, inevitably shapes policy options. The obligation is therefore not neutrality in the sense of detachment, but clarity about where evidence ends and judgment begins.
Emergencies compress time and eliminate optionality. Decisions that would normally take months are made in days. Capabilities that would normally be built over years are assembled in weeks. The gap between what is needed and what exists has to be bridged by improvisation, which is expensive, unreliable, and often leaves institutional debris. The answer is not to get better at improvising. It is rather to have built more of what is needed before the emergency arrives.
People with relevant expertise have an obligation to make it available in a crisis. That obligation is not discharged by commenting from the outside. It sometimes requires accepting roles that are poorly defined, working in conditions that are far from ideal, and tolerating governance structures that would be unacceptable in normal times. I do not regret having done so.
The temptation to build something sophisticated is almost irresistible among technically capable people working on an important problem. It should be resisted. The question is not what the technology could do. The question is what can be built, tested, deployed, and trusted by the public within the time the emergency allows. Those are very different questions, and the answers tend to be simpler than some software developers would prefer.
When the Apple/Google API decision determined the architecture of a national public health programme, it became clear that critical infrastructure was being governed by entities over which the state had no meaningful authority. This is not a problem unique to contact tracing. It is a structural feature of the current relationship between governments and technology platforms. It requires a policy response that does not yet exist.
Coda
Science advisers do not control outcomes. They contribute analysis, judgement and occasionally warning. Decisions remain political. The responsibility of the adviser is to ensure that decisions are taken with the best possible understanding of the relevant evidence and constraints. The best estimates available indicate that the app saved over 9,000 lives and prevented over 44,000 hospitalisations. I am proud of my contribution, and of the remarkable teams and individuals I worked with.
Copyright: © 2026 [author(s)]. This is an open-access article distributed under the terms of the Creative Commons Attribution License (CC BY). The use, distribution or reproduction in other forums is permitted, provided the original author(s) or licensor are credited and that the original publication in Frontiers Policy Labs is cited, in accordance with accepted academic practice. No use, distribution or reproduction is permitted which does not comply with these terms.
