THE MYTH OF AROGYA SETU By S Sudhakaran

Introduction:           The Government launched the Aarogya Setu app which replaced the Corona Kavach App under the banner of MeiTY on 02 Apr 20. As on date the Mobile App has crossed 50 million downloads across the country and is being downloaded at a good pace. The Government is aggressively backing this Application as it has no other alternative and therefore the PM is leading from front in popularizing the Application. Therefore, the Government is justified in doing so.

The Key question however is, does the Aarogya Setu has the key technology ingredients to combat corona? This is a question we need to find an answer objectively and truthfully, failing which it will just be a dead horse being flogged and presented to appease the public as a digital response form the government, which at the first place would be a lie.

Under these circumstances, the Government should critically examine the capability of the technology that is being used in the Aarogya Setu and its ability to help in this war. If such an exercise is not objectively carried out, this App may just be the leading force to amplify the “Fog of War” against the campaign waged by India to combat this pandemic.

Pre-Requisites for a Contact Tracing App :  The mobile subscribers become the ideal platform as that is the common technology platform carried by a vast majority of the population. A contact tracing App for real-time detection of Pandemic spread can exploit the mobile platform in three different ways.

(a)      Mobile OS based Tracing:          The Android/IOS/Windows platform can permanently enable the Geo-location recording feature and based on a cloud analytics engine, the mobile which was in close proximity can be easily identified and a tree with upto fourth level contact of the identified infected person can be mapped instantaneously. This is the most effective & accurate method to carry out contact tracing as there is no requirement of downloading any app and the App can function in limited coverage zones as well, with the innovative use of technology.

(b)      Telco Data based Tracing:         The Second method of contact tracing is using an analytic engine to directly tap the telco mobile registration and location data to identify the location of mobiles. But this shall be highly intrusive in nature and may violate individual privacy laws and amount to state surveillance. Therefore, democratic setups cannot adopt such draconian measures. Further the accuracy of such systems are very poor as it would be impossible to identify contacts at zero coverage areas and during mobile exchanged mobility patterns. The false positives in such a tracing will be significantly high and therefore the error in numbers that are identified will exponentially increase and may not match the actual numbers.

(c)       Mobile Application based Tracing:      The Mobile application-based tracing is a more easy and achievable method, if implemented correctly. The data privacy challenges & Information Security need to be handled carefully failing which there could be significant potential to be exploited by hackers. Usage of Bluetooth for last mile also may lead to information security challenges and Bluejacking of private data form the victim devices.

Pros & Cons of the Various Methods :           The OS based method is the most efficient in terms of immediate reachability and penetration. The results shared shall be most accurate due to its spontaneity of penetration and is the most useful method of all the three. However, the following are the main drawbacks and challenges to practically adopt this method.

(a)      The Operating systems are controlled by multi-national Giants like Google, Apple Microsoft, Huwaei etc and convergence of these players for a single cause will be an impossibility.

(b)      The data if allowed to be acquired would need specific sanction of the government and would need to be tapped from the servers of these MNC’s. The possibility of Data usage to subvert the Government and its policies cannot be ruled out. In other words it could mark the beginning of a Digital Colonialism and Corporate Surveillance over Government.

           It is therefore evident that a country like India cannot afford to use such a method for contact tracing despite its promising nature till such time an Indigenised OS is developed for use by the country. This is therefore a good starting point to initiate such project at the national level.

           The poor efficiency & accuracy of the Telco method and its data privacy challenges are good enough reasons to overlook this method. It has no significant benefits over the other two methods, other than the fact that a covert surveillance can be mounted without the knowledge of any user. Covert surveillance is a taboo in any democratic state and therefore the possibility of usage of such technologies is considered unviable and impractical.

           The Mobile App method is the most democratic and practical method as it needs no consent from any players. The consent of the user is a sufficient enough condition to use such a technology. The navigation and the online delivery platforms already use this method and has seen extensive acceptance amongst the public. Since the consent of the user is taken at the time of the installation, the legalities of the Data privacy aspects are mostly covered, provided there is transparent use of technology backed by good information security measures.

Aarogya Setu App design and its limitations :         The Aarogya Setu app has chosen the most practical of approaches for ensuring contact tracing of the pandemic infected users. But the very nature of its design is self-defeating and therefore may not be able to achieve its intended objective. The reasons are as follows.

(a)         Lack of Penetration :        The application has completed two weeks of time in production and has seen 5 Cr downloads and is being marketed as a world record of sorts. In a country of 135 Cr with 900 million mobile subscribers 50 million is a miniscule percentage. Even if the aspect of multiple ownership is discounted the number of people using the mobile phones could well be over 750 million subscribers.

(b)         A contact tracing app needs atleast 75% to 80% penetration of its smart phone category subscribers. The penetration of smart phone subscription is 77% of the overall user. The Aarogya Setu needs to therefore reach atleast 400 million downloads to be able to achieve any significant results as claimed by the App. Any claim of the app successfully identifying to a reasonable degree of probability is therefore false and purely speculative.

(c)         Lack of Features:              Since the numbers are on the increase and India has resorted to a total lockdown, the management of the infected people and prevention of people to swarm upon the Health care center is an important function to prevent the spread of the Pandemic. Aarogya Setu appears to have no solution for such an eventuality and has let that outside its area of responsibility.

(d)         If the problem statements are going to be addressed in Silos, it shall lead to greater inefficiencies and confusion. We have to remember that the Pandemic strikes by overwhelming the Healthcare more than by direct infection of the humans. A prepared healthcare system can handle the pandemic in a better way than otherwise. Convergence of features therefore shall make it more acceptable and shall yield to better results for identifying the infected people.

(e)         Data Privacy & Security Challenges:  Sharing of Geo location data can indirectly lead to state surveillance. While Aarogya Setu appears to have been a solution deployed as a quick response to the crisis, it has certainly overlooked the long-term Privacy and Information security challenges. There are better methods to achieve the same result if the design is refined to the stipulated standards. Right now the approach has been that of defending the indefensible and outright rejection of such possibilities

(f)          Poor power saving features:     The application seems to be on a continuous spree of scanning even if it is not required. Users across the board have complained of power discharge due to such reckless scanning and even have resorted to uninstalling the application. This may not augur well for the cause of the project as the power discharge may turn off the complete system thereby leading to a complete loss of data connectivity, which can in-turn lead to blind zones. This ultimately may lead to poor identification probability, of the positive cases in the long run. When the numbers increase beyond a certain threshold, these errors shall lead to eventual crumbling of the detection algorithm.

(g)         Identity Management:      The application appears to be clueless to deal with aspect of identity management where in users may migrate to multiple devices when the application identifies and report them as Covid-positive. This could lead to false positives and poor detection.

(h)         Post Detection Management:    The problem posed by the Covid pandemic is more of management post infection than identification. The strategy for contact tracing works, when the numbers are in hundreds. When it reaches the five-figure mark, there needs to be integrated strategy to manage the aspect of early detection/ prevention and post infection care. If the Healthcare system gets stressed or overwhelmed by the pandemic that is where the fatalities start increasing further leading to greater chaos.

(i)           One of the important functionalities of any pandemic management system should be to segregate the non-Covid patients from the Covid-positive patients. The Aarogya Setu confines its self to contact tracing and therefore may not be a potent enough tool to help the government fight this war in the dimension of patient care.

(j)           Anti-Lock down features:           while the app has advertised about   E-pass its ability to manage real-time permission appears to be seriously restricted considering the base technology at hand. However, if it can come up with a realtime validation protocol to assess the validity of the pass status, the solution could become a far better solution. But such a design would need state of the art features and a completed redesign of the basic application structure and therefore seems improbable, given the background of the team based out of commercial business foundations.

Conclusion: The need of the hour is to converge and integrate all the available solutions to deliver a unified knockout punch to the pandemic. Every software professional and company is working on its own perceived notion of the problem statement. This has definitely generated a rich repository of solutions but at the same time most of these solutions are a clone of each other. We need a unified masterplan, where these solutions can converge and take the country out of this pandemic safely without imprisonment of the people and its economy.

           If you are fighting a war, better fight like one. Half-hearted and silo approach aggravates the “Fog of War”. Let us not get consumed or waylaid by such a possibility. Afterall “Unite we Stand, Divided we Fall”.