How not to Outlaw Illegal Surveillance

The saga of the illegal enforcement of surveillance via a so-called 'contact tracing' app continues in court, writes VICKRAM CRISHNA.

——-

The Indian smartphone app called Aarogya Setu, claimed to be of assistance in treating patients affected by the coronavirus infection called SARS-CoV-2, which has taken on the status of a worldwide pandemic, continues to be controversial.

Commonly, for the control of contagious diseases, one of the methods used to find persons at risk is to identify those who may have been exposed to people who already have been infected by the virus. Ideally, infected people will be able to advise special investigators (who are trained to quickly and safely obtain useful information) about those whom they may have infected unknowingly before they became aware of their own infectious status.

This presumes, firstly, that people behave responsibly and do not continue to deliberately infect others even after they have fallen ill. For infectious diseases that display symptoms quickly, and are spread by direct contact, through touch, this is not particularly difficult.

However, the exact mechanisms of the nature of this infection, which was publicly unknown until December 2019, are not absolutely determined as yet.

It is likely to be airborne, by contact with moisture expelled during breathing, talking, or coughing, and such moisture droplets may stay airborne for up to ten minutes in the immediate vicinity of the infected person, up to a distance that has been estimated to be about 2 meters.

Such infectiousness is fairly easily arrested by wearing face masks, but the masks need to be capable of blocking very tiny drops of moisture while allowing the passage of oxygen. People need to minimise risks by maintaining a safe ('social') distance from each other, even while wearing the right kind of masks.

Since the contagion has continued now for nearly a year and continues to infect random new people regularly, it can be assumed that either the wearing of masks or maintenance of social distancing is not effective, in the conduct of ordinary life. For this reason, restrictions, termed 'lockdown', have been applied in countries around the world, particularly in cities, and the use of mass transit has been severely restricted.

Crippling Effect

This has had a crippling effect on the conduct of business, and economies around the world have been severely affected.

Those already in trouble, such as India, have virtually collapsed, leading to a desperate situation known as stagflation, inflation without growth, or negative growth.

Contact tracing, the epidemiological identification of persons at risk, has been proposed and might be assisted by carrying electronic devices that will record the proximity between persons continually. If those persons are also carrying such electronic devices, then it could become more feasible to identify them quickly, when a person falls ill.

In some countries, special-purpose devices have been developed and distributed, that might aid with such identification. In others, smartphones have been used, with proximity recording tools loaded, that is supposed to serve the purpose.

In no other democratic country has any attempt been made to enforce such usage.

There are problems, both legal and technological, with the enforcement under the National Disaster Management Act, of an attempt made to mandate a smartphone contact tracing app, and the issues have been covered in detail in this publication.

On December 11, 2020, a detailed hearing took place in Bengaluru, in the Karnataka High Court, on a petition filed by well-known software engineer Anivar Aravind.

The court had, in a preliminary hearing, demanded to be informed in detail about the technical issues around the use of phones for contact tracing, that were listed in the petition. The government had pleaded for time to file a suitable reply, hence the delay in proceeding with the case.

It may be pertinent to note that recently, the Central Information Commissioner had flayed various Ministries concerned with the deployment of the same app, for the 'preposterous' plea, in the response under the Right to Information Act, that they had no information about it. It might also be pertinent to note that officers committing such offences are liable to be fined from Rs 25,000 upwards for either delaying information, or furnishing misleading or false replies. In this case, no such penalty has been levied, although that had been threatened.

In any case, the Government has now, rather conveniently, been able to file a reply in court that furnishes some of the information requested in numerous RTI applications over the months of India's lockdown, implying that it actually had such information available in the first place.

Sousveillance: not Privacy 

In court on December 11, while pleading on behalf of the petitioner, Adv. Colin Gonsalves, listed chapter and verse of the Puttuswamy judgment on privacy (2017), which mandated the passage of very specific legislation for any data collection, that must limit such collection and storage, for both purpose and period. The National Disaster Management Act is a general law, one that cannot be construed as applicable.

Further, the terms and conditions of the app mandate an agreement that cannot be termed informed consent. Since many of the persons who in fact have installed the app have done so by coercion, thanks to a government order compelling its use to avail all kinds of services, including entry to public and private spaces and the use of public transport, the question of consent does not arise.

That instruction has been withdrawn, following an outcry, and court orders against its applicability in some jurisdictions.

Unfree Software 

Adv Gonsalves also questioned the government's claim to have developed open-source software. In fact, the published code (as previously reported in The Leaflet) is not what is distributed for installation, nor has the real code that governs the actual storage and subsequent distribution of data been even published.

The obfuscation around the code, and the involvement of private organisations and persons in both creating the solution, and data handling, deserves a forensic investigation, by an independent, court-appointed, group of legal and technical experts, whether or not such a request is included as a specific prayer in this petition.

The government has submitted, or argued verbally, in court that the app has been highly successful, with 50 million downloads recorded on Android smartphones.

However, leaving aside the question of coercion being conflated with popularity, for which the published record of instances where the use of the app has been mandated has been submitted in court, Gonsalves disparaged the use of downloads as a metric of success.

In any case, given that the government itself publicises the number of smartphones in use in India to be over 300 million, the fact that only a sixth of them have installed the app should, perhaps, be seen as a dismal failure. And the resistance by nearly 85 percent of smartphone users to the coercion of installing a data collection app, given the continuing mystery around the parameters of data collection, needs to be seen for what it is, a digital equivalent of work to rule.

The submissions by the government to the court in this context have little value other than the denial of the largest civil protest in India, by ordinary citizens, against the enforcement of illegal surveillance under the guise of healthcare management.

(Vickram Crishna is a trained engineer and manager. The author's case against the Union of India and Others, opposing the operation of the state-operated technology-based national identification scheme, also resulted in a definitive judgment affirming the fundamental right to personal privacy. The views are personal.)