Aarogya Setu Protest
By Vickram Crishna
This is a statement of protest against the mandating of installation of privacy-breaching software on persons who may be affected by the risk of infection under certain circumstances, detailed below. SFLC.in reserves the right to file, or to assist with filing of petitions against the inclusion of this clause in the order, either in a High Court or directly in the Supreme Court. Such petition shall inter alia call for a statement from the Union Home Secretary, explaining the circumstances under which such an order, ultra vires of the law covered by the National Disaster Management Act, and directly contravening the Constitution of India, thereby exceeding the authority of the executive, has been released.
1. The order issued on May 1, 2020, (40-3/2020-DM-I(A) dt 01.05.2020), detailing the scope of graduated easing of the lockdown across the country, includes specific instructions for persons who will be allowed to attend places of employment, whether public/state or private sector (clause 3 iii.), and for persons living within designated ‘containment zones’, (Annexure 1, clause 15) to install and use the 'Aarogya Setu' (or, sic ‘Aarogya Setu’) smartphone app.
2. The app is a data collection tool that makes no verifiable claim for husbanding of the data, which is personal and personally identifiable information about phone users.
3. The app claims to be useful for protecting users from the risks of infection, but carries no guarantees or assurances that this is even possible.
4. Apart from whether it is even theoretically possible for the app to assist in safeguarding users, the order gives no instructions to anyone about usage of the app in a manner that will actually achieve that objective (also see para 7 below).
5. The tool uses Bluetooth (near distance) and GPS (locational) radio signalling tools, both of which are extremely unreliable for the stated purpose, and have never been used for assuring proximity of any two or more users. In fact, neither communication system is capable of giving that assurance, even in open air spaces, and completely incapable in covered and walled spaces. That is established science. To expect otherwise is not just wishful thinking, but has not even been tested in such an application, and for such a purpose.
6. The app in question can only be installed on Apple phones and Android phones using operating systems created after the introduction of Android ver 6. As such, the order excludes the ability of those who don't use smartphones (an estimated 70% of India) and also those who own older phones to be gainfully employed in a workplace, or to legally continue to live in containment zones. The order makes no provision for people already living in such designated containment zones to be moved safely to live elsewhere, rather, it provides for criminalisation of existing residents who are unable to install the app.
7. The 2017 judgment on privacy spells out in no uncertain terms that any intrusion upon personal space must be in the form of a law (or, temporarily, an order) that specifically limits such intrusion, in terms of parameters of intrusion and specific time period for which such intrusion might be allowed, and the purpose for which such intrusion is needed.
8. The app itself, as mentioned above, fails to establish in any way that it can achieve any level of assurance of identification of genuine exposure to the risk of infection. Apart from that, neither the app nor the order offers any instruction, guidance nor stipulation as to how such exposure is to be dealt with, other than baldly stating that the officials legally mandated to administer those areas called containment zones must undertake ‘contact tracing’. There is no instruction or guideline on the management of contact tracing, which is a highly specialised feature of the branch of healthcare management known as epidemiology. In the current environment, where mistreatment and exclusion of persons (and their families) who are not in any way known to be certainly at risk, but who belong to particular communities or professions, such as healthcare and transportation workers, is rampant, this is both dangerous and unacceptable.
9. Quite apart from the Constitutional issues, the development and release of this app, which claims to have been created by the government (this claim is detailed in the Google Play Store) is based on secret software code. This is directly against declared government policy, which demands the usage of Free and Open Software. Not only is the code secret, but the terms of access to the app from the authorised sources (the Apple and Google Stores/repositories) specifically outlaws any deconstruction of the source code (of course, this outlawing is only legally practical within India, whereas the app can be downloaded anywhere in the world) under threat of prosecution. It is clear that such a stipulation defies, on the one hand, the letter and spirit of Free and Open Software, and, on the other, prevents any public audit of the app to ensure that it only does what it claims, in terms of the data collected, now, and in future versions. Further, it casts serious doubt on the unsubstantiated claim that the app development has taken place under government control, or that the development was actually done only by directly government contracted agents.
10. The secretive nature of the code makes it impossible for independent verification of the operation of the app and of the limitations to the dissemination of the data collected by the app. The development of such tools, to further the global response to the pandemic nature of the Covid-19 virus, is an iterative process, that can only improve with use. However, without releasing the code (both at the app and server) that controls the utility of the app, neither technologists in India nor any other part of the world are able to contribute to such improvement. It prevents India from taking a leadership role in the development of such technologies. This is a deplorable attitude to adopt, and speaks poorly of our confidence in dealing with this pandemic.
Vickram Crishna
Independent Researcher
Advisor, SFLC.In
Disclaimer: The opinions expressed within this article are the personal opinions of the author. The opinions appearing in the article do not reflect the views of SFLC.in and SFLC.in does not assume any responsibility or liability for the same.
