It took the health ministry two months to uncover the problems plaguing its COVID-19 contact-tracing smartphone app, which made it useless to Android users, after the bugs and their causes were first publicly pointed out in November.

The free contact-tracing app, called COCOA, was introduced to alert people if they came into close contact with someone who had tested positive for COVID-19. It is designed to notify users if they have been within a radius of 1 meter for longer than 15 minutes of other app users infected with the novel coronavirus.

The app had been downloaded about 25 million times, and Android users account for about 7.7 million of the downloads. But Android users were not getting notifications, even if they came into contact with other users who had tested positive, since the end of last September. Those kinds of bugs were not reported among iPhone users.

According to the announcement, the health ministry learned of the bugs on Jan. 25 from a company it had outsourced to develop the app.

But the issue was discovered much earlier than that. On Nov. 25, a poster named “zaruudon” publicly identified the program bugs by looking at the developers’ code for the app, which was posted on the website GitHub.

“I believe that contact with infected users will not be detected by the current Android version,” the user said in a post and pointed to the source of the problem.

The COCOA app was initially being developed by Microsoft Japan Co. volunteers, free of charge. They had started work on the project around March last year.

But at the beginning of May, Alphabet Inc.’s Google and Apple Inc. suggested to countries around the world that apps should be controlled by public health authorities and each country should adopt only one app. After that, the health ministry assumed the development responsibilities.

On May 25, Shinzo Abe, the prime minister at the time, announced at a news conference that the app would be “available around the middle of June.” Based on that timeline, the health ministry needed to complete development just a month and half after it took over the project.

The ministry did not have enough time to publicly solicit developers, according to sources. The ministry chose Persol Process and Technology Co., which was also the company it had outsourced development of a software management system for infected patients, called HER-SYS. The company then subcontracted maintenance work on the app to the information technology company MTI Ltd.

According to the health ministry, the app bugs are attributable to a version upgrade on Sept. 28. When apps are revised, it is necessary to check if they work properly in advance. But instead of reviewing how it worked across two different smartphones, one for an infected user and another for a user who came into close contact with them, only the latter was checked.

The Tuberculosis and Infectious Diseases Control Division admitted that the buck stops with the health ministry, but it noted it was not the only actor that bears responsibility.

“The outsourcing company has a responsibility to check comments like the one posted on the GitHub website,” an official said.

The COCOA app did not have a function to collect bug information output from mobile phones, which makes it more difficult to determine the causes of problems. It lacked that functionality because the ministry was concerned about user privacy, sources said. But aside from that issue, other kinds of bugs emerged once the app became publicly available.

The government’s expert panel that deals with the app gave the nod in September that information on the app’s glitches could be collected. The collection started on Dec. 3. 

The health ministry finally came to grasp the bugs behind the problem in January--four months after they surfaced in September.

“It is difficult for outsourcing companies to respond to everything within their contract when deluged by comments,” said Masanori Kusunoki, an aide to the government’s chief information officer and a member of the expert panel on the COCOA app.

“The ministry should reflect on the fact that it did not decide how it would respond to serious comments in advance.”