The second app we know because there was a work-order modification posted publicly a while ago instructing their app developers to develop a second app as well.

The second app we know because there was a work-order modification posted publicly a while ago instructing their app developers to develop a second app as well. You're right that ministers have never formally acknowledged that they are doing it. I do not understand this but then I am from the: people will accept 100x as much incompetence as deceit school of communication and they are not. The other information comes from Lord Bethel's house of lords testimony and also from this blog: https://www.ncsc.gov.uk/blog-post/nhs-covid-19-app-security-two-weeks-on https://www.ncsc.gov.uk/blog-post/nhs-covid-19-app-security-... and things linked to from it.