Aarogya Setu mandatory in containment zones; private firms question move

The government on Friday mandated the use of its contact tracing app Aarogya Setu in containment zones and for all public and private entity employees, raising questions about the privacy, legality and efficacy of such a measure.

In its annexure to the lockdown extension guidelines on Friday, the Ministry of Home Affairs said that for containment zones, "The local authority shall  ensure 100% coverage of Aarogya Setu app among the residents of containment zones."

It further said "Use of Aarogya Setu app shall be mandatory for all employees, both private and public It shall be the responsibility of the Head of the respective Organizations to ensure 100% coverage of this app among the employees."

Privacy experts and technology lawyers have long questioned the efficacy of using contact tracing apps at large scale without adequate testing for coronavirus (Covid-19).

 "In containment zones, one can argue that it is a limited circumference. But within a containment zone, it is not necessary that everyone will have a smartphone. Even if a there is a way being planned to involve feature phone users, then this is an app tracing or telecom tracing effort. Citizens being forced to install and facilitate surveillance is not conducive to health related efforts. It can be challenged," said Raman Jit Singh Chima, Senior International Counsel and Asia Pacific Policy Director, Access Now.

The government had said earlier that it does not plan to make Aarogya Setu mandatory.

"India is the only democratic country that has mandated the use of a contact tracing app for its citizens. The mandatory use of such an app will further exclude sections of population which have been digitally excluded. The Government has gone back on its earlier promise on the Aarogya Setu app being voluntary," said Prasanth Sugathan, legal director at Software Freedom Law Centre.

The lockdown and mandate to download Aarogya Setu has come under the Disaster management Act, 2005.

There is also the larger question of not making the source code of the app available for examination by the larger technology community.  "This app is not secure, it's source code is not open for examination and it's security vulnerabilities are already being exploited. Why don't Indians deserve a secure way of protecting them against the disease? Why can't we do what all democracies are doing? We should open source the code, fix the vulnerabilities, ensure that in addition to the disease, our citizens don't also have to worry about data theft or mass surveillance," said Mishi Choudhary, Technology Lawyer and Founder SFLC.in.

In addition, asking employers to mandate the use of the app could face legal challenge.

"Also, the DMA is not applicable to private parties generally. If the government is trying to force employers to enforce this, they would have to bring an ordinance on labour matters - which could be challenged. An employer can say it is not legally binding because these are just guidelines from the Union government," said Chima.

He further said that the medical tracing sector experts have been raising concerns about the tech sector is forcing app models. "There seem to be no contact tracers manning Aarogya Setu. It can generate false positives and potentially give inaccurate results, causing harm for individuals. The public health response needs to be adequate first," he added.