Aarogya Setu’s problems go beyond its privacy flaws!

Launched over a month ago, the Aarogya Setu app, India’s contact tracing app developed as a means to alert users of contact with a COVID-19 patient who has tested positive, has been a mixed bag of results. While the government has claimed moral victory for being the most downloaded app, privacy critics have been slamming the app for hiding more than it is revealing to the public.

 

The World Health Organization states that contact tracing has three components, identification (of the person who is infected), listing (listing all people he may have come in contact with) and follow-up (where all listed people need to be monitored for symptoms and signs of infection). Almost all of the work that goes into contact tracing is manual work and generates a lot of data. This data needs to be stored and analysed to identify the potential spread of infection in your area (district, state or country). The manual method works when the number of infected people are low but as numbers increase, the scale of the operation makes it near impossible to trace contacts. 

A contact tracing app like Aaraogya Setu basically reverses the process of contact tracing. Instead of health care workers going from patient to possible contacts, it relies on potential contacts to reach out to healthcare workers, thereby identifying themselves, thereby getting to the main aim of contact tracing, i.e. follow-up on contacts and treating them before they become vectors for the spread of the disease.  

There are many problems with Aaorogya Setu

Information that it collects

The privacy problems with Aarogya Setu are out in the open and quite simple to fix. The app is not open sourced, so it does not really tell you what information it is collecting. According to the developers of Aarogya Setu, it needs Bluetooth as well as GPS data to function. Countries like Singapore, Australia, Italy, Switzerland built their contact tracing apps using Bluetooth alone. Ghana, Iceland, Israel needed GPS locations alone. Turkey, Ghana, Bulgaria needed Bluetooth as well as GPS locations. So, Aarogya Setu is in the august company of the apps made by Turkey, Ghana and Bulgaria. So be it. What is the problem with releasing the source code. If the app is not collecting any information that would leave the government red-faced, the code should simply be released, just like Singapore did. 

Timing of the App Release

When Singapore launched Trace Together on 20th March, Singapore had 385 confirmed COVID cases. People downloaded the app, went around their normal business, before a lockdown was announced, on April 3rd. The aim of the app was to help people report themselves to the health authorities DURING the lockdown, if the app alerted them. As lockdown continues, people who get alerts will be isolated, tested and quarantined, thereby breaking the chain of transmission. 

Aarogya Setu on the other hand, was released on 2nd April, when India had over 2000 cases, but more importantly, when India had been a good week into its lockdown. Movement of personnel involved only in essential services was well established. Even after installing the app, people have hardly moved beyond a few kilometres from their homes and come in contact with just a handful people, whom they would remember, like the grocery store boy, milkman, etc. Contact tracing apps are meant to alert people, if they might have taken public transport or sat down for a meeting of 10-15 minutes with a COVID positive individual. Aarogya Setu downloads at the moment, mean nothing more than curiosity, just like it was with PokeMonGo, that CEO of NITI Aayog, proudly beat. 

Strength is in numbers and we don’t have them

A pilot study of contract tracing app conducted by University of Oxford showed that 80% of smartphone users (about 56% of UK’s population) would have to use the contact tracing app for it to reliably perform its job. As per a December 2019 report, India had just over 50 crore smartphone users, which covers just about 37% of its total population, even after the app is made mandatory and forcefully installed on all smartphones. 

Singapore, who initiated the trend of contact tracing app has 4.27 million smartphone users for its 5.6 million population. But with just over 1.4 million installations and increasing number of cases, they too have realised that apps can only do so much. 

Users who test positive rather than COVID-positive user

The utility of the app really lies when individuals have used the app for a while, crossed paths with people while using the app and when a person tested positive for COVID-19 is actually marked positive on the app. This would involve updating the test results of the individual in the app. Forcing individuals to install the app after they have tested positive means nothing because the hard work of contact tracing still needs to be done. 

Currently, what the app is doing is simply updating users the number of COVID positive individuals with a certain radius of their vicinity. The same is being done by resident welfare association WhatsApp groups, with sometimes even personal details of individuals like vehicle numbers and pictures. Unverified and inaacurate information you say, yes, but where is data on Aarogya Setu, verifiable and accurate?  

Accuracy of information - Different users, different information 

If a contact tracing app is being made mandatory, the least it needs to do is provide accurate information. A Twitter user recently reported how 3 users in the same location received three different number of COVID cases in the same vicinity radius if 1 km.

#ArogyaSetu All of us 3 room-mates have different status on our apps. We stay in close proximity of 10 feet the whole day! How can the number of cases differ for each one? Doubt the accuracy of this app. #arogyasetuapp @SetuAarogya @NICMeity @PMOIndia pic.twitter.com/YRmmYMzh0D

— Shrutika Patade (@patade_shrutika) May 2, 2020

 

A contact tracing app, like any other app, needs to be fed with data, its functioning tested and changes made on how it processes that information. Was Aarogya Setu beta tested, what were its results? Who is conducting analysis of data that has been collected after a record number of installations, what is the outcome of the analysis are just a few of the questions that arise and need to be answered. 

Usage while easing Lockdown

Aarogya Setu will definitely be helpful once restrictions are lifted and people who were treated for COVID-19 make their way back to normal life as before and even keep a track of where outbreaks might be happening. But going forward, as the world opens up, people are going to move across borders. When flights resume, people would want to jump continents again and this is when contact tracing will be most useful. 

If you are waiting at London Heathrow with 800 people from 50 different nationalities each carrying their own version of Aarogya Setu on their phones, these apps will need to find a way to talk to each other at the terminal and also, once you reach your destination. Nation specific apps, their different architectures and data storing and sharing policies and frameworks will simply not work when we the world to open up. 

This is where the Apple and Google collaboration for exposure notification would be immensely helpful. As we move ahead, exposure notification will become part of your phone’s operating system and with a simple toggle ‘on or off’, you should be able to opt in or opt out of this service, when you want. Since the notification system works only with Bluetooth and your GPS location is not shared, it will also lay to rest fears about privacy. All code under this collaboration is already in the public domain.  

It would be wiser for the government to stop coercing people to download the app and just work on integrating its systems efficiently. So, when the lockdown opens and exposure notification is on each smartphone by default, we can transition to a post lockdown world effortlessly.