Analysis of Contact Tracing Apps: Case in Point - Aarogya Setu


With the rapidly spreading COVID-19 pandemic, countries around the world are looking at deploying all possible tools in their arsenal to rein this in. Contact tracing apps for smartphones is one such tool that is rapidly gaining prominence. These applications allow governments to leverage technology and data to identify and contain potential hotspots. Data-driven focused approaches become more critical as governments are looking at easing lockdown restrictions.


Aarogya Setu is a mobile app developed by the Government of India to primarily perform contact tracing and also act as an outreach platform to keep users updated.


What is Contact Tracing?


A general illustration of Contact Tracing based off of CDC-material. Upon reuse credit CFCF and CDC


Contact tracing is the process of identifying individuals who may have come into contact with an infected person. By identifying such connections, testing them for infection, and further tracing their contacts if needed, we can take a targeted approach to contain the spread of infections and also alerting traced contacts to the possibility of infection.

What does Aarogya Setu do?


This app is developed by the National Informatics Center for both Android and iOS users. The app works by collecting the user's current location and other information like their name, gender, and profession to determine if the user has any potential risk of contracting COVID19. The app requires Device Location and Bluetooth permissions to work as designed.


Since this app is not open source and its internal workings have not been explored, we can only infer how this works based on similar apps implemented by other countries. After you install the app on your smartphone, it will detect other devices nearby (within Bluetooth range) that also have this app installed. A unique identifier is assigned to each installation of the app. By using this unique identifier, every nearby device with the app is identified, and this data is saved on the Government's servers. If a user tests positive for COVID19, all users who were nearby at any point in time after installing the app are alerted about the potential risk and would be tested if needed. Advanced algorithms and Artificial intelligence are also used to make sense of this data on a large scale to monitor potential hotspots and inform users if they are at 'low' or 'high' risk of getting the virus.

How do contact tracing apps work?

The primary purpose of all contact tracing apps is to identify when you are physically close to someone else and then try to figure out how close you are and how long you were in contact. However, the implementation varies from being lightweight & transparent to pervasive and invasive. For example, China's system records data, including citizen's identity, location, and even online payment history so that local police can watch for those who break quarantine protocols.


The Decentralised Model and the Centralised Model are primarily two models based on which the contact tracing apps are built. Aarogya Setu and the implementations of many other countries like the UK, France, etc. are more aligned with the Centralised Model. However, due to widespread criticism, some of these countries are contemplating a switch to a system being developed by tech giants Apple & Google, which promotes the Decentralised model.

The below illustration from NHS, UK aptly summaries the two models:



What can be done better?

The recent decision to make the app mandatory for workers in the private and public sectors has generated diverse debates on this topic. According to COVID Tracing Tracker, India is the only democracy that has made it's app mandatory for millions of people. Internet Freedom Foundation (IFF), a well-known privacy watchdog, has appealed to Prime Minister Narendra Modi not to make the use of the app mandatory as it can have a 'damaging effect on privacy, autonomy, and dignity of workers'. It has already sent a joint representation endorsed by 45 organizations, including Amnesty India, Access Now, Red Dot Foundation, and over 100 individuals.


To its credit, the Government clarified that the data wouldn't be used for anything other than medical emergencies. No person's private data will be revealed or shared, and data from servers will be deleted after 30 days. Although the intention behind this can be justified, the Government can take additional steps to assuage the privacy concerns of citizens.


The source code of this app, for instance, can be made open source for public scrutiny. This can serve dual purposes of increasing public confidence and allow tech-savvy citizens and privacy organizations to inspect and maybe even improve the app's security. Similar apps have been open-sourced in other countries like Singapore. Recently the UK, which faced criticisms for its implementation, has published a technical white paper detailing how it works and has also made the code available on GitHub so that anyone technically inclined can look into it.

The Government of India can also look into the feasibility of adopting the API & Contact Tracing System developed by Apple & Google, which is expected to be released this month. Many European countries have already committed to using this protocol, and this is comparatively more privacy-conscious when benchmarked against existing protocols implemented by governments worldwide.

Tracking the trackers

Countries and tech companies are rushing to deliver apps & systems for contact tracing with no immediate end to the pandemic being visible. As aptly pointed out by MIT Technology Review, despite the deluge of services currently available and those expected to come in the upcoming months, we know very little about them and how they could affect society. Also, citizens of different countries saw drastically different levels of surveillance and transparency.

Keeping this in mind, MIT Technology Review has created COVID Tracing Tracker to capture details of every significant automated contact tracing effort around the world. Hopefully, such projects act as catalysts to increase accountability and transparency.

The road ahead

For contact tracing apps to truly achieve its potential, the majority of users need to install these apps. In an interview with BBC, big data experts from the University of Oxford estimate that 56% of the population must use the app to halt the outbreak. Lower numbers would still help slow the spread of COVID19.

Currently, privacy concerns, lack of transparency, lack of awareness, institutional distrust over surveillance, etc., are being the impediments to achieving this critical mass of users. Governments worldwide should do more to increase transparency, address privacy concerns, and build confidence amongst their citizens so that more users feel comfortable installing these applications and contributing to a safer society.

Sources & Additional Links

https://www.livemint.com/industry/infotech/why-privacy-advocates-have-concerns-over-aarogya- setu-app-11588509094177.html

https://www.ncsc.gov.uk/blog-post/security-behind-nhs-contact-tracing-app https://www.technologyreview.com/2020/05/07/1000961/launching-mittr-covid-tracing-tracker/

https://www.bbc.co.uk/news/technology-52294896 https://en.wikipedia.org/wiki/Contact_tracing



Disclaimer:

1) The views expressed or any statements made by the author are solely attributable to them, and such views or statements, does not reflect Guftagoo's stand on this issue.

2) Our readers are encouraged to independently verify the veracity, authenticity of the statements, as Guftagoo disclaims any liability arising from any action taken or any loss arising from reliance on any such statement.

3) Please note that our aim is to encourage healthy conversations and while the articles would be open for comments, we reserve the right to delete any comments which are either abusive, defamatory in nature, or in any way against our websites' policy of encouraging healthy conversations.

13 views

©2019 by Guftagoo. Proudly created with Wix.com