Aarogya Setu- India’s First Line of Defense against Covid-19

Technology has touched almost every facet of human life. Especially, in these tough times when the world is facing a pandemic, leveraging technology to trace the spread of the Covid-19 virus digitally has proved to be a boon for the governments across the globe. ‘Contact Tracing’ , a fancy word used for tracing & alerting individuals who are possibly infected or who came in the proximity of the infected persons, in order so that the protocol of ISOLATION, QUARANTINE AND TESTING can be done promptly and with ease. This ‘corona tracking application’ is designed to protect the contacts of our contacts in order to break the chain of infection rather than protecting an individual or his contacts. Many countries across the globe have developed their personalized contact tracing applications, such as ‘Ha Magen’ in Israel, ‘ Trace Together’ in Singapore, ‘Home Quarantine’ app in Poland and ‘Aarogya Setu’ application in India[1]. I will be examining the Aarogya Setu application from an ethical perspective in the subsequent paragraphs.

Aarogya Setu application has been serving as the first line of defense against the coronavirus and has proved to be an effective tool for the government in order to keep track of the Covid-19 positive cases, contact tracing and segregating containment zones from the non-containment zones in the locality. The application has been downloaded by over 100 million people[2] and its efficacy in monitoring the health status of the masses in a densely populated country like India has reduced the burden on the already fragile health infrastructure and the overburdened bureaucracy. The application works using location based data of the user and Bluetooth Technology. After installation, it requires the user to give consent for location information and Bluetooth services, and also asks for personal information from the user.

Employing digital tracing on the population level for identifying early cases poses multiple ethical challenges. Let’s try to examine ethically the contact tracing apps in general and Aarogya Setu as an example in various aspects[4].

1. Testing: Contact tracing apps cannot be considered as a reliable platform to ascertain the positive Covid-19 cases and an alternative to Testing. Infact widespread testing is a crucial component in order to ensure the efficacy of this application. India is conducting 5500 tests/1M population which is way lower considering it’s 134 crore population[3]. It is therefore the moral responsibility to ramp up the testing infrastructure as the ability to conduct testing should not be linked to digital contact tracing.

2. Aggregated vs Identifiable Data: Systems must be designed to guarantee the security and confidentiality of user data exclusively through their encryption and anonymization concept and the verifiability of the source code. Anonymized aggregated data can be shared with government and researchers within the constraints of regulations and existing laws. At the same it is necessary for contact tracing apps to ensure that there should be enough safeguards in place to ensure that the data collected is used for epidemiological purpose only. The Law Ministry of India has made it clear that the data stored is fully encrypted and is deleted within 45 days for non-risk users and 60 days from date of discharge/cure for Covid-19 patients[2].

3. Voluntary consent: Consent based data sharing is the most ethical approach to data sharing for contact tracing as a way to mitigate privacy risks. In the case of Aarogya Setu application, the Indian government has made it mandatory to download the application for the all private and government employees and people living in the Covid-19 containment zones. The user consent in this case has become inconsequential with the mandated usage of the app. On the other hand government has been advocating the mandatory usage of the application on the pretext that it is impossible to carry out manual contact tracing considering the size and population of India and therefore app is an effective tool to contain the spread of Covid-19. This is an ethical dilemma which when examined from a Pragmatist point of view tilts towards the greater public good weighing against privacy and voluntary consent.

4. Privacy risks: Privacy is the most important concern while dealing with contact tracing apps. Access to a user’s personal data, his location coordinates and constant surveillance is a violation of his/her privacy. The Indian legal system considers ‘Right to Privacy’ as a fundamental right and employing a surveillance tool on a country level with no institutional oversight is a breach of privacy. The Supreme Court of Israel adjudicated that the government cannot use surveillance techniques for Covid-19 without any legislative sanction. A ‘French’ ethical hacker recently claimed that there were security issues with the Aarogya Setu app and the privacy of over 100 million Indians is at stake , however the government clarified that there was no data or security breach[2].

It is necessary that verifiable technical measures such as cryptography and anonymization techniques must be employed to ensure user privacy. The researchers at MIT have developed the PACT protocol which is used to develop contact tracing apps keeping privacy as the focal point[5]. In these apps Bluetooth is employed to ascertain proximity of the users rather than GPS and the PACT protocol broadcasts constantly changing and randomly chosen ‘chirp’ values, which are not useful in identification of the user. This PACT protocol ensures integrity, transparency and openness giving the autonomy to its users to have full control over the lifecycle of the system. However, it is worth noting that it is not possible to have absolute privacy and therefore the decision should be left at the behest of the people in a democratic country like India to strike an appropriate balance between social health and civil liberties.

5. Data Security: A multiple layered protection against data loss and unauthorized access is the need of the hour. Ensuring that data is stored locally on the smartphone and not passed on to third party benefitting from it such as health insurance companies or employer is the moral responsibility of the government. The Aarogya Setu privacy policy is in compliance with these principles and ensures that the personal information is securely encrypted before being stored on the cloud and is incapable of being accessed by the user[6]. A plausible exception for data usage for medical researchers i.e. epidemiological purpose should be granted via a voluntary consent explicitly taken in a separate section in the application to ensure transparency and trust.

6. Governance and equitable access: A governing body should be framed to provide oversight in determining data uses, collection and resulting intervention. The Aarogya Setu is managed by the Empowered Group on Technology and Data Management, body that overlooks collection, processing, storage and sharing of ‘anonymized data’ [7]. This is paramount in building trust among the users of the app regarding the safety of their data and an intervening body to prevent gross misuse. One other element of the application should be its accessibility. Efforts to curb the pandemic should not be turn people’s mobile phones into a digital version of the medieval leper bell. It should not be implemented in a punitive way such as providing treatments to only those who use the app. Aarogya Setu is freely available on Google Playstore & Apple App store in 11 languages considering the fact that India is a multilingual diverse nation. The idea behind the name of the application is about bridging the divide. “Aarogya” means Health and “Setu” means Bridge. This builds an perception and trust image, thus motivating citizens to be a part of ‘Corona Defeating Army’, and establish a sense of responsibility and moral obligation to fight together the pandemic as a community.

The ethical examination conducted can also be correlated with some of the ‘The ACM Code of Ethics & Professional Conduct’ principles which serves as a base document for applying them in a professional setting and laying out the basis for ethical decision making[8].

‘Respecting Privacy’: A critical aspect for those in the computing profession. They should use personal information only for legitimate ends and without violating individual rights. Establish transparent policies & procedures, clearly define , enforce and communicate retention & disposal periods to data subjects, and prevent re-identification of anonymized data as well as unauthorized data access.

‘Honor Confidentiality’: Ensure non-disclosure of personal data except in cases where it is evidence of law, medical research purpose, etc.

‘Be Fair and take action not to discriminate’: Honesty is an essential component of trustworthiness. It is the duty of professionals to ensure equitable access as well as clearly defined the privacy policies and make the source code open in order to ensure fairness.

‘Avoid harm’: It is the duty of the responsible authority to avoid harm and in cases where even well intended actions may lead to harm, minimize the harm. The computing professional also has an obligation to report any system risks that might result into harm i.e. there should be an active ‘whistle blower’ policy.

‘Contribute to society and to human well-being, acknowledging that all people are stakeholders in computing’: This ethical principle, concerning quality of life of all people, affirms an obligation for computing professionals to promote fundamental human rights & protect individual’s right to autonomy and minimize negative consequences of computing.

REFERENCES

[1] Pollyanna Sanderson, Policy Counsel at Future of Privacy Forum, Privacy & Pandemics: The role of mobile apps, April ,2020. (https://fpf.org/wp-content/uploads/2020/04/Privacy-Pandemics-The-Role-of-Mobile-Apps.pdf)

[2] Dewan Arjun, Aarogya Setu: a legal and ethical dilemma? , Financial Express, May 10, 2020. (https://www.financialexpress.com/lifestyle/health/aarogya-setu-a-legal-and-ethical-dilemma/1953985/)

[3] Worldometer coronavirus tracker (https://www.worldometers.info/coronavirus/?)

[4] Dubov Alex., Shoptaw Steven; The Value and Ethics of using Technology to Contain the COVID-19 Epidemic; The American journal of Bioethics ; Taylor and Francis; May 18, 2020.(https://doi.org/10.1080/15265161.2020.1764136)

[5] Rivest. L . Ronald et al. ; The Pact Protocol specification; April 8 ,2020. (https://pact.mit.edu/wp-content/uploads/2020/04/The-PACT-protocol-specification-ver-0.1.pdf)

[6] Aarogya Setu Privacy Policy (https://web.swaraksha.gov.in/ncv19/privacy/)

[7] ‘Aarogya setu Data protocol norms issue’: An article on The Hindu, May 11, 2020. (https://www.thehindu.com/news/national/aarogya-setu-data-protocol-norms-issued/article31560752.ece)

[8] ACM Code of Ethics and Professional conduct (https://www.acm.org/code-of-ethics)