Unhealthy bridge

ON May 1, 2020, the Union Home Secretary issued an Order (40-3/2020-DM-I(A) dt 01.05.2020) asserting that in his capacity as Chairperson NEC, new guidelines are in effect under the provisions of sec 6(2)1 of the National Disaster Management Act 2005. The clause merely affirms that the National Disaster Management Authority, which acts through the National Executive Committee, is to lay down policies on disaster management.

The guidelines expressly declare, in two separate clauses, that persons in employment who must attend work at a designated workplace (both in government service and in the private sector) (Annexure 1 clause 15) and persons residing in what are called 'containment zones' (clause 3-iii.) must install an app called "Aarogya Setu" or "Arogya Setu" on their phones.

However, the NDMA itself states clearly, clause 72 "overriding effect" that it supersedes other rules and laws in effect. It does not state that it overrides the Constitution of India, and there's an excellent reason for this.

The Act envisaged the development of a rapid response management system, to deal with natural disasters and the like, where a national effort would be needed to cope with a situation that might overwhelm the resources of one or more states. The Covid-19 crisis is potentially a little different, in that it hardly respects mere political borders that are frequently traversed in the normal course, a healthcare crisis whose primary spread is through ordinary people. But it is not now, and if the situation is professionally managed, perhaps it will never be an Emergency, that calls for the suspension of all civil rights.

Unconstituted Authority

The authority of the Union Home Secretary, in any capacity, much less the provisions of the National Disaster Management Act, 2005, to order people residing in India to mandatorily allow the government to breach their personal privacy, is highly doubtful.

What makes it far more objectionable, though, is that there is hardly any credible reason to believe that this app, or any other app that leverages the technologies presently built into the modern smartphone, can help a weak, close to non-existent healthcare infrastructure, to actually deal professionally and competently with a pandemic that might cross all boundaries.

Tech Talk

To understand why this is so, one needs to focus on the capabilities, and then widen one's scope to see how they might fit into a larger framework.

Firstly, most models of smartphones incorporate several multi-band radios, mostly capable of two way communications. We are familiar with the phone application, of course, because it is a phone, and allows people to speak to one another across great distances, aided by existing communication networks. But it is also 'smart', it has some inbuilt computing capability, and it uses digital processors to accomplish that. And some of the radios are digital radios, made to fit in well with non-voice applications, all of which means that the device can exchange non-verbal communications with other phones, and also with other computers.

Two of these technologies are Bluetooth and GPS location tools. The first of these, Bluetooth, is a weak signalling arrangement that allows non-verbal signalling over short distances, about 10 metres, in fact. It is used most often to connect the phone's audio to speakers or amplifiers, and is quite versatile that way. The other device needs to be digital, of course, as that is how it is designed to work.

Which means it also connects to other phones. Some people use it to send photos and other media conveniently between a pair of phones. It isn't really quick for this, though, as not just the distance, but the data throughput is also limited.

The real problem with it is that it was developed to connect easily with other devices, and sometimes that can boomerang, as other devices within range can sometimes connect without permission. This is especially so when the Bluetooth settings invite contacts to connect that way, which is good if you want your speakers to hook seamlessly with your phone, not so good if your neighbour downloads your phonebook and anything else, or uploads a virus/malware that locks up your phone memory and effectively bricks the phone (the expression dates back to the time when the shape of mobile phones resembled that of bricks – a phone that didn't work was basically no different from a brick).

GPS (global positioning system) location is a different issue, of course. Just like old GPS devices, the phone is capable of identifying signals from 3 or more satellites orbiting the planet, and can calculate its position on earth by comparing the signal strengths of each of those connections. This sounds a bit vague, and unfortunately, it doesn't get any sharper by recalling the wonderful assistance provided by a roadmap service. The reason that works so well is that the phone is preloaded with roadmaps, and if the phone is moving along, the assumption that it is moving along a road is really quite reasonable. It doesn't work at all well when surrounded by tall buildings and the roads are not a given, and this is not due to any fundamental failure in the GPS systems. Rather, phones are not, in fact, dedicated GPS devices, and provide at best a reasonable approximation that works for most people most of the time.

Contacts trac(k)ing: the genesis

Contact tracing is a specialised field of epidemiology, the study of how disease spreads. Rapidly spreading infectious diseases are a special case, fortunately, or else most of the modern world could not have come to be. Looking at the clear skies, breathing the fresh air, and listening to birdsong are some hints that, perhaps, Prime Minister Jacinda Arden of New Zealand is on the ball when she suggests that economic growth isn't the key to a successful national strategy for the post-Covid-19 world.

Still, here we are, in the midst of the pandemic, not past it, and this is a rapidly spreading infectious disease, spread by humans in proximity to each other. That is the normal state for most modern work and travel, so dealing with it is a need. The most basic thing about such contagion is that the spread is based on a mathematical truth called exponential growth. One person can expose several others, and some of them will get infected. A few of the infected people will not show any symptoms, but will still be a risk to others. Many medical researchers believe that recovered victims are no longer infectious (are immune), but the jury is out on this. Simply because we do not have the jury system in courts in India does not mean it doesn't have a place in the real world. Unchecked, the numbers rapidly spin out of control, and this is why most countries around the world have locked down, at tremendous cost and with immense hardship inflicted on many, almost exclusively the poorest.

The science behind the need

Knowing that it spreads exponentially does not, alas, simply translate into hard numbers on how many people will be infected, will fall ill, or how many will die. Only reliably conducted record-keeping can be the basis for such forecasting, and India does not actually have such a system in place, either for noting the cause of death, or indeed, for deaths themselves.

But, to understand how to continually assess the state of the disaster as time goes by, we have this really fine analysis by Nicky Case et al, which includes dynamic models that administrators and policymakers can use, both for the national estimates and within much smaller localities, to help manage the local situation with the least possible dismal immediate and future consequences.

Some of the numbers that plug into the models (the screens are provided with sliders, to make using numbers easier) come from contact tracing; others come from hospitals/health centres and, sadly, from death records.

As can well be appreciated, if people are constantly coming into contact with others, the spread of disease can be bewildering. However, diligently keeping track of infected people who move around can take away some of the mystery. Since the disease might take up to 14 days (this is an educated guess from global records kept in other countries) to manifest itself, it isn't anybody's fault. And since some people may never show symptoms, but still be risky, really, fault isn't the problem here.

But finding fault is something that police systems are unfortunately prone to do. In fact, the official police force is often publicly tracked in terms of cases solved, meaning, criminals caught, rather than cases closed, meaning resolving whether a crime took place at all. Which is still within the realm of police forces: it is unfortunate when the court of public opinion starts dealing with healthcare on the same basis, and it is against the tenets of our Constitution for administrators to start treating infection vectors (ie people or things that carry infections to others) as criminals.

Contact tracing: the science

Once the hysteria over the unknown is removed, contact tracing turns out to be a tedious and often thankless job, trying to find out just who infected how many others, and then asking those others who else they might have infected, and so on. And what makes it worse is that eye-witness memory is hugely unreliable, and gets more unreliable as time goes by. A fortnight is a long time to remember each journey, each market, each office and exactly what time of day. It takes expert questioning by trained persons to find out accurately what a person remembers.

Naturally, technologists leap into this void, and are ready with rosy promises about the devices carried by many people. They are already being used by marketing agencies to fine-tune commercial offers (in response to Unilever founder Lord Leverhulme's famous doubt about advertising: being unaware of which half of the company's advertising delivered actual sales, and which was money down the drain), evidenced by the billion-dollar valuations of such businesses as Apple and Google, that many people believe are technology companies.

In fact, Apple and Google themselves, supposedly fierce competitors in the smartphone space, have come together to propose standards to be built into phone operating systems, very often updated for free by users, that will ease the job of jogging people's memories about who and when they might have met particular other people.

The privacy question

Which brings up the elephant in the Covid-19 room: how do you identify only the people who are risky, and people at risk, without annoying anyone else, and without stepping on everyone's (digital) toes?

As 'everyone' knows, there are countries where this isn't actually a question, and there are countries where the question is brushed under the table while people are fed stories of dire emergencies. In India, since privacy is a Constitutional guarantee and not a legal inconvenience that might be set aside for a while under the Disaster Management Act, it is an important question, despite what the Union Home Secretary has done.

It turns out that, indeed, it is feasible to uphold public trust in the intentions and actions of the government and to use smartphones to add some simplicity and time-saving to the job of contact tracing, without trashing privacy forever, and this is explained in this clever little cartoon drawing, also the work of Nicky Case, as it happens.

The case for being open

There is one thing that is fairly clear about this pandemic: it is a global problem. In fact, that is one of the reasons that we have organisations like the World Health Organisation (WHO), so that diseases that can potentially affect all humans can be addressed with solutions that are created by anybody.

That is why it is important that Apple and Google are working together openly, to set a standard that will be applicable to smartphones made by anybody, and used by anybody. It also explains why the Government of Singapore openly published the code for their own sponsored smartphone app, TraceTogether, which has been of some use in helping their Health Department save some time and effort in contact tracing.

It may not have helped much, as not everyone is using the app, and the job of contact tracing is so difficult. The people who are using it find that they are (ie their phones are) reporting too many contacts wrongly, which can add to the work of contact tracers, rather than cutting it down. As a result, only a fifth of the users have actually had their data used as the basis for actual contact tracing, and only a fifth of the nation-state have even become users.

Australia also has an open-code smartphone app, COVIDSafe, and faces similar problems with slow uptake, as well as wrong leads. But the app, like the Apple/Google alliance, does not expose users to unwarranted privacy risks, and several parts of the country are now gaining confidence for a return to some normalcy, thanks to an overall package of effective measures (some parts are not, however, which illustrates the complexity of the health crisis).

The thing is, nobody has actually tried to implement a contact tracing app before. Smartphones are a new thing, and global infections are fortunately rare, so this is understandable. But when something is new, it doesn't often (actually, almost never) work out of the box. It takes many tries, lots of public feedback, and the will to improve, to get it right.

Not everyone can afford to do that. But not everyone faces the risk of having over a billion people in their country fall ill. In fact, that risk is only faced by two nations in the world today, China and India. The Chinese government has not had, however, in its 80 years of existence as

a free republic (after the Japanese occupation) had to care much about its people's Constitutional freedoms, though, which is a rather different situation from India.

Open technology for a world that works together

India, however, has a long-standing public policy (pdf document) in place that publicly created technology, and in particular, information technology software, will be openly and publicly shared. Unfortunately, for no justifiable reason, the Indian government-sponsored app, Aarogya Setu, is not 'open'. Examination of the code is forbidden, according to the user agreement displayed on the Apple and Google app stores (from where the app can be downloaded), and is accompanied by a threat of prosecution.

All claims about the protection afforded by the app, to either user devices from malign remote influences, or to the data that should only be used to inform the user about her risks, have to be taken purely on faith, that the officials who make such claims are well-informed and have rigorously audited the tool. Which is, incidentally, two tools, one placed on the app and the other at some (hopefully; this is also taken on faith – the link summarises succeeding security analyses of the ongoing versions of the app and its setup, which cannot identify the actual server or its location) government-owned server.

And all of this supposed sophistication is walled off from other countries who, perhaps more desperately than India, need to and want to safeguard their people.

Open world, closed eyes

This is a sad regression to a world of divisiveness by design, to a thought process that trumpets close-minded thinking, and to a belief that the government can do no wrong.

It is precisely because of the dangers of such unthinking belief that our democratic free republic was created with four independent pillars guaranteed in place, the executive, the legislature, the judiciary and a free media ('press', but that term is too limiting). No single pillar can stand without being open to question by any and all of the others. Only with all four pulling against each other, and not supinely giving way to a supreme executive, can India have a stable system that serves the interest of the people, for whom it exists.

And therefore, most importantly, vox populi, the voice of the people, is the fifth pillar, the one that isn't institutionalised, that brings in letters questioning actions (under an Act that was originally, before the recent dilution, meant to ensure that answer would be forthcoming). And that, until this became unsafe in the wake of the pandemic, brought housewives to the barricades, calling for justice in the teeth of violent and divisive forces reminiscent of 1930s Germany.

[Vickram Crishna is a trained engineer and manager, the author's case against Union of India and Others, against the operation of the state-operated technology-based national identification scheme, also resulted in a definitive judgment affirming the fundamental right to personal privacy]