Aarogya Setu: A bridge too far?

Trust Deficit: Govt must open up the source code to the Aarogya Setu app to gain people’s trust

Amid concerns over privacy and surveillance, citizens are demanding that the source code of the Aarogya Setu app be made public. The #OpenSourceAarogyaSetu chorus is growing. Important as they are, privacy and transparency are not the only concerns about the government’s latest technological fix for a problem – in this case, the problem of tracing who has the coronavirus and who they have been in contact with. The privacy advocates were the first to raise the challenges posed by the app and by the government making it mandatory for people in the Covid-19 ‘containment zones’ and for all public and private sector employees. If there were no privacy issues, would it be alright to make the app mandatory?

I will install the Aarogya Setu app. I am even happy to ask a friend to install it. But then, I am afraid what to answer when he asks, what if it doesn’t work? This is the most important question that one needs to ask: What if this experiment fails? For, it is nothing more than an experiment that governments around the world are trying out, no matter what the assurances from the Indian government are. Which is why, the governments of established democracies – Britain, Germany, France, even Singapore, etc – have not made it mandatory. Only in India has an experiment been made mandatory.

For latest updates on coronavirus outbreak, click here

Does it work? Clearly, Aarogya Setu already fails you if you don’t have a smartphone, then it fails you even if you have a smartphone but one with FirefoxOS, Blackberry or SailFish, and most of all if you have a rooted phone. Worse, the hundreds of millions of poor and those employed in the informal sectors do not have smartphones. Is the government going to force them all to buy smartphones and download the app, when they don’t even have enough money to buy food? And will it work if they are not included in the contact tracing? Singapore found out the hard way that its contact tracing app was not effective because the government had ignored the city-state’s small immigrant population – construction workers, and the like. We have hundreds of millions of such people.

Someday, the source code of Aarogya Setu will be made public, and the government’s claims can be verified. The government will even pass an ordinance for the app if someone approaches the court against it. The security issues will be fixed over time, data protection law will be passed in some form. Will the app magically start to work then? And who can certify whether it works? Will the judiciary asking us to trust the app be enough? Will the doctors, epidemiologists, biologists, privacy lawyers, security engineers, social scientists, columnists, politicians saying it works help? Clearly techno-solutionism is the problem at hand and no one person explaining to us the magic of the code without showing us proof will help.

But right now, we are not even at that stage. Instead, everybody is making claims – government officials and ministers say one thing, hackers say something else, legal activists say yet another thing. The Ministry of Home Affairs puts out one order, the Noida police does its own thing, and the Telangana government says the state won’t use Aarogya Setu, it will make its own app. This is the state of affairs because there is no law backing the app and the mandating of its usage, there are no rules governing the app itself. The terms and conditions of the app says it is illegal to re-engineer the app. Under what law?

There are several issues with Aarogya Setu, but the most worrying is this idea that technology will solve the problem at hand and one must trust it blindly. The thing about trust is, people don’t trust anything that is forced on them and anything that they don’t understand. A luddite will not trust technology, the anti-vaxxers won’t trust a COVID-19 vaccine tomorrow even if one is invented. Will the government go on forcing its solutions on everyone?

It is also clear that even if Aarogya Setu can do its job and identify all COVID-positive people, there is a lack of medical capacity to react to the problem. Amid all of these concerns, forcing people to blindly install the app is wrong at many levels. We have seen what this kind of forceful push of technology can lead to during the Aadhaar implementation -- the denial of essential services to those who most need it. We are witnessing it happen again. With a blind trust in the app, people are denying others essential services in hospitals, pharmacies and even supermarkets if one doesn’t have it on his phone. This discrimination based on technology won’t stop and it will continue to take over our lives.

Meanwhile, for the ‘volunteers’ who build the app (oh, yes, it is not the Ministry of Health or any part of the government that is building it), it is a gateway to monetise your healthcare data. It helps them spread their ideas inside government further and gives them more room to experiment on the population. Whether it is a solution or not doesn’t matter, they just want to experiment and someday they might succeed.

Ideally in a democracy, such experimentation on the population, especially by an opaque ‘volunteer’ group, is not allowed, but we have seen enough proposals for experiments -- from FreeBasics to Aadhaar to Smart Cities. Grand ideas of a utopian future to be implemented in India, without any actual evidence that any of them work. Somehow, the people of India have become the ground for all sorts of experimentation. With our democratic institutions failing to protect our rights, it has come to this. And from courts to parliament, no one seems to care.

We are not the only country adopting these digital contact tracing solutions, but we are the only so-called democracy where it is mandatory. In the UK, the Joint Committee on Human Rights of both the House of Lords and House of Commons asked several questions about their centralised contact tracing solution. The National Health Service immediately open-sourced the UK contact tracing app and is working to ensure that the questions posed by the committee are addressed.

In India, it has come to claims between volunteers who build the app and technology lawyers and activists questioning their ulterior motives. Meanwhile, the function creep of the app has advanced from being contact tracing to one granting e-pass for people to move about. We are just waiting for it to become the gateway to India’s upcoming Health Digital Blueprint where all of your electronic health records will be stored. In the end, your health data is money, and can fetch the ‘volunteers’ some investors to profit from the data.

(The writer is an independent researcher working on data, governance and the internet)