Will the coronavirus crisis inevitably result in an expansion of the surveillance state in India?

An app that requires you to send in selfies to the government every hour. Another that can tell you – and the authorities – everyone you have come into contact with over the last month. State governments gathering huge amounts of data about people’s movements without court orders. Entire lists with addresses and phone numbers of quarantined individuals being made public.

As the globe grapples with an extremely contagious disease that has infected more than a million people and killed over 50,000 worldwide, the coronavirus crisis has led to lowered standards of privacy and a huge increase in invasive government surveillance.

Many of these initiatives are being seen as emergency measures, as desperate attempts by authorities to trace and isolate carriers of the virus to prevent it from infecting more people.

But with a vaccine not expected until mid-way through 2021 at the earliest, it is starting to become clear that the emergency might last far longer than we expect – and that an expansion of the surveillance state may just become the new normal.

“That is indeed the biggest concern,” said Vrinda Bhandari, a lawyer who has worked on privacy and surveillance in India. “Right now we are ready to give up our civil liberties to fight the virus and there’s no appetite for a privacy argument. But what is the duration of this ‘disaster’? If by the end of, let’s say August, things have eased up a bit, but Covid-19 is still around, will the government step away from such surveillance measures?”

Aarogya Setu

This week, the Union government unveiled “Aarogya Setu” (Health Bridge), a contact tracing app intended to mimic efforts in Singapore and elsewhere that track the virus and inform people if they have come into contact with an infected person.

Here’s how it works: you download the app, which then asks you for personal information and also for permission to keep both bluetooth and your GPS on permanently. If you test positive for Covid-19, anyone else with the same app who may have been in the vicinity of your phone number will be sent an alert.

The app claims that data will only be shared with the government of India, and that it does not allow your name or number to be disclosed to the public. It allows for personal information to be used by the government in “anonymized, aggregated datasets” unless you test positive, in which case the data can also be shared with other people “to carry out necessary medical and administrative interventions”.

Although the app makes certain claims about what it plans to do with the data, its disclosures are inadequate. It does not define clearly what information will be collected, how it will be stored, and for what specific uses the government can access the data.

Medianama also pointed out that the app had been developed in conjunction with online pharamacy and healthcare company 1mg, raising questions about how exactly the private sector is involved.

A few months ago, an app that tracks and stores the data of every single person you come into contact would have seemed too invasive. Today, however, the massive spread of the virus has tremendously increased the appetite of citizens for surveillance measures.

Privacy vs Virus

Even some of the most prominent privacy advocates have said they are open to some of these efforts, considering the scale of the challenge.

Glenn Greenwald, co-founder of the Intercept and the journalist who helped expose enormous surveillance efforts in the West, told Buzzfeed News that he is “much more receptive to proposals that in my entire life I never expected I would be, because of the gravity of the threat”.

The inspiration for many has come from countries like South Korea and Taiwan. Unlike China, which coupled aggressive surveillance with coercive government actions, these countries are democracies that used relatively more transparent, if still extremely invasive, methods to keep their infection numbers down.

In Taiwan, for example, if you are under quarantine and your phone runs out of battery, the authorities immediately get in touch with you. The country uses existing phone signals to create an “electronic fence” to ensure people observe quarantine rules.

In India, Karnataka and Telangana are now attempting a slightly lower tech version of this. People who have been told to observe home quarantine will have to download the government’s app and send in selfies periodically to prove that they are staying at home. Analysts will look at the geotags in the photos to confirm that they have not violated the quarantine rules.

In Karnataka’s case, a selfie will have to be sent every hour, except between 10 pm and 7 am, or else the person may be moved to mass quarantine facilities.

Tech analyst Ben Thompson, who lives in Taiwan, made the case that invasive surveillance has in a sense helped residents of the country retain the liberty to move around.

“Life here is normal. Kids are in school, restaurants are open, the grocery stores are well-stocked. I would be lying if I didn’t admit that the rather shocking assertions of government authority and surveillance that make this possible, all of which I would have decried a few months ago, feels pretty liberating even as it is troubling.”

Indian context

But even as invasive surveillance is embraced by those who might have questioned it before, there are aspects of its context specific to India that are worrisome.

For starters, Taiwan and South Korea’s surveillance efforts were accompanied by extremely aggressive testing policies, making it possible for huge numbers of people to find out if they have the virus.

The idea is that a combination testing and tracing would limit the spread of the disease. At just 18 tests per million, compared to nearly 7000 per million in South Korea and even over 1000 per million in the United States, India is far behind most other nations on this front.

What use is mass surveillance if the population isn’t being tested enough? And can such tech-focused approaches actually work in India, where hundreds of millions still do not have smartphones?

“Examples can be taken from China, Singapore, Korea, Taiwan,” said Apar Gupta, of the Internet Freedom Foundation. “But even beyond the distinction within the legal framework within these countries, it really is necessary for people to understand that technology deployment by itself in a society like India where there is a large level of diversity, will not be able to completely take care of the coronavirus – a lot of people will not have the underlying tech frameworks – hence it will not be a silver bullet, so there will be a distinction based on economic disparity.”

Legal fig-leafs

Governments have recognised this, and their responses have been to draw in data without even having to ask individuals to download an app or consent to being tracked.

The Delhi government, for example, handed over 25,429 phone numbers to the Delhi Police to ensure that those ordered into quarantine actually stuck to the rules. It is as yet unclear under what legal basis such an action was taken, and what efforts the government is taking to ensure that the data that is collected and stored will not be misused.

Anyone asking questions about such actions are usually told that extraordinary times call for extraordinary measures.

“But the whole point of the Constitution is for extreme situations,” said Murali Neelakantan, a lawyer who has worked on questions of health policy and surveillance. “Laws are made for these unusual circumstances. The test of society’s belief in the rule of law is in instances like this.”

Gupta, of the Internet Freedom Foundation, points out that authorities haven’t even done the bare minimum when it comes to creating a legal foundation for their actions, whether in the case of the apps, the use of personal data or actions like publicly listing the names and addresses of all of those in quarantine, which has prompted fears of stigmatisation and evictions.

“There is a complete absence of legality to how these apps have been deployed and developed,” he said. “There are no privacy features that tie in to legal safeguards. While these are exceptional circumstances, even a much criticised law such as the Epidemic Act – which provides for standing rules to be created by governments – has not been availed of in a way that can provide a fig leaf of legality.”

Abuse and misuse

Moreover, there is little reason for good faith when it comes to the government’s actions on this front . Indian authorities have repeatedly shown a disregard for personal data and enunciated the desire to use private information as a national resource.

The current government at the Centre argued in the Supreme Court that there is no right to privacy, a contention that was dismissed by the court. A Personal Data Protection law that was supposed to be in force several years ago has still not yet been passed by Parliament.

Indeed, just days before India was consumed by Covid-19 stories, the Indian Express reported on how the Centre had been demanding call data records of every single user across huge pockets of the country over the last few months.

There is no guarantee that any expansion of the surveillance state as a result of Covid-19 will come with oversight or fetters.

“If, at the society level we all start accepting that so long as there is a crisis, we don’t care about rule of law, we’re testing the theory that every time the government says there is a crisis, people will yield,” Neelakantan said. “There is an incentive to be in a space of emergency... the government will perpetually be in an emergency, whether it is Covid, China, Pakistan, something or the other and we’ll keep yielding.”

If governments use this moment as a carte blanche to draw in personal data and use it as they wish, there is also a genuine fear that it will be misused.

“India is a multicultural society. Such a deep level of information can be used to target certain groups and minorities,” Gupta said. “We have already seen state govts are requiring people to take selfies, this shows a level of coerciveness that is already present and usually while state government policies may be equally unfriendly to people, the actual implementation is very arbitrary and usually exposes itself towards a level of bias which is distinct over ranges of caste, religion and economic privilege.”

Way forward

Despite all these concerns, few today are arguing that health surveillance should not be carried out. Instead, the demand is to ensure that any such efforts come with oversight, legal backing and a concerted effort to limit the chances of abuse or misuse.

Technologists all over the world have been thinking about how to move forward on disease mitigation without giving up personal information.

Last Sunday, at “Coronathon for India”, a hackathon held by members of the country’s Information Technology community, one team presented a prototype that would allow for contact tracing – the same thing that Aarogya Setu aims to do – while still ensuring the privacy of individuals.

Paras Chopra, the co-founder of a software company who helped organise the hackathon, said that the interaction between volunteer teams at the event brought up ideas of how to implement such measures.

“There may be good or bad ways to handle privacy, so if there are two teams dealing with it differently [at the hackathon], that contrast can teach us,” he said.

On the legal front, in Europe and the United States, authorities have made it clear that any information gathered under Covid-19 surveillance efforts come with very clear purpose limitations – laws prevent them from being used for any other reasons other than virus mitigation efforts.

India too needs much more clarity on the legal fetters and oversight, even as it does what is necessary to tackle the virus.

“The government is more than happy to arrogate more power to itself,” said Bhandari. “But it doesn’t want to have the accompanying transparency and accountability... There has to be growing awareness of these issues, or else we will be in a new normal.”

Gupta framed it as an opportunity for India.

While many countries moved quickly to copy each others approaches in the first few weeks of the coronavirus crisis, India’s decision to move to a lockdown at an earlier stage than many others handed it the platform to better think through its approach.

“Such kind of programs were done during earlier waves of the Corona pandemic, and we can take opportunities to learn from their expereinces,” Gupt asaid. “Rather than copying models that already exist, there is a good chance for India to build an approach that respects user privacy.”

Update: Medianama updated its story on AarogyaSetu, with 1mg co-founder Prashant Tandon denying any involvement in the development of the app. The government also issued a press release calling the app the result of a public-private partnership with no details on which private company was involved.