Updated: May 25, 2020
“This is being done in the national interest. If someone has so much issue with it, then simply don't download it.” India’s IT minister Ravi Shankar Prasad said on 9 May 2020 of Aarogya Setu, the government’s app to track Covid-19 cases
Bengaluru: Prasad’s declaration is not an option for a growing number of Indians.
Having the Aarogya Setu tracking app on your phone is now a condition for millions of workers in India to enter office premises, work from home, register attendance, and in some cases, be paid salaries. Some managers are even insisting that employees’ family members get the app.
Aarogya Setu is among the Indian government’s main responses to the Covid-19 pandemic. Designed by the Ministry of Electronics and Information Technology along with volunteers from the private sector, the app is supposed to help trace people who have been infected with the Coronavirus.
It was launched as a voluntary app, but the number of people who aren’t required to use it today is fast shrinking. India is now the only democracy to make its tracking app mandatory for people outside containment zones.
On 1 May, the Ministry of Home Affairs issued an order that said “100% coverage” of the Aarogya Setu was mandatory for public and private sector employees going to work, people in ‘containment zones’ (areas with high levels of infection), Indian nationals flown in from abroad on special flights, and those travelling on special trains.
As companies prepare to emerge out of the lockdown, employers are now rushing to comply with the order. They have sent out emails and circulars mandating that their staff download the app and confirm it with screenshots, emails, and declaration forms.
This reporter has verified, through copies of official emails and messages, details of how 49 organisations are enforcing the app’s download. All employees who volunteered information requested anonymity.
Many state governments, police forces and government departments have insisted on the app as a travel pass and employment condition, while health officials are getting people in isolation or quarantine to compulsorily download the app. The Delhi-based Internet Democracy Project is keeping track of when and where the Aarogya Setu is mandatory. At the time of writing, Aarogya Setu has been downloaded over 100 million times.
Concerns And Compliance
Emails from the companies explain that they are enforcing downloads to avoid legal repercussions and penalties. The MHA order of 1 May says that violators can be prosecuted under the Disaster Management Act, 2005, which provides for a year’s imprisonment for disobedience.
Many employees said they had just followed orders, but they did not believe the app was effective. Some openly refused to install the app, while others said they were postponing the download while they work from home. About four out of five people interviewed said they had installed the app for compliance and then uninstalled it.
Those who didn’t use Aarogya Setu said they had data security concerns – the app requires the phone’s GPS and Bluetooth to be on at all times. Those who didn’t have smartphones did not know how to comply. The Aarogya Setu is not yet available for feature phones, though the government has repeatedly said a version will be launched soon.
India does not have a data-protection law, which means people using it might have no legal recourse if their data is misused by any agency or even the government, or if their privacy is violated. In response to criticism, the government issued a data collection protocol on 11 May. Data collected must be deleted in six months, and any breach is now punishable under the Disaster Management Act, 2005.
These Companies Require Aarogya Setu
The Delhi Metro Rail Corporation sent a notice to its employees on May 1, 2020, asking all officers and staff (including outsourced staff) to download the app.
HCL Technologies Ltd’s “Pandemic Task Force” insists on Aarogya Setu for entry into its offices across India.
KPMG, IBM, Cisco India, Deloitte India, Infiniti, Cognizant, Fidelity Investments, L&T Finance, ICICI Lombard, and law firm Khaitan & Co., have all asked employees to sign a self-declaration form saying they have downloaded the app. Some employees who have started to report to the office said that security guards at their offices checked their phones before allowing them to enter.
Air India and SpiceJet Airways have asked their ground staff and pilots to download the app. SpiceJet has said that trainers will check the pilots’ health status on the app before they fly.
Caterpillar’s Progress Rail Innovation, based in Noida, a containment zone, has asked employees to fill a self-declaration form about the download, even though they are all still working from home.
Flipkart’s checklist for returning employees has made downloading Aarogya Setu mandatory, along with wearing a mask and carrying the Flipkart ID.
Mercedes Benz, Bangalore; Novartis; Nestle India; Kirloskar Chillers; Capgemini; Daimler India; Aditya Birla Capital; different units under Tata; Concentrix Corp, Mumbai; ISGEC Heavy Engineering, Haryana; Diptab Ventures, Bangalore; OneAdvanced health solutions, Bangalore; Virtuoso Optoelectronics, Nasik; and Robert Bosch have sent emails about office protocols like floor markings, staggered canteen hours, sanitised premises and social distancing to battle the pandemic.
Among the mandatory provisions is the installation of Aarogya Setu. Some employees said
phones of those reporting to the production units are checked at the door, during the
temperature check. Others take a signature on a self-declaration form.
Kirloskar’s email comes with a Google Doc that employees have to fill. “Any misrepresentation can be held against you and appropriate action will be taken,” it says in capital letters.
A doctor at Apollo Telehealth Services, Hyderabad, said there was no official email, but guards checked employees’ phones for the app and maintained a list of their statuses everyday.
The central government through its Department of Personnel and Training issued directions to all government offices on 29 April, 2020, asking all its officers and staff to download the app and check their health status prior to coming to work.
Public sector units, such as BSNL, Southern Railways, Northern Coalfields Limited, and Coal India, have also made downloads mandatory. At the entry, employees must show the app’s message certifying the user as “low-risk” or “safe”—an assessment arrived at after users enter their details.
Some organisations seem to go beyond the MHA order in enforcing the app’s use. Bharat Petroleum & Oil Companies Ltd (BPCL) insisted that employees’ families also download the app. An employee in one of their refineries said the company wasn’t checking their phones, but all staff had to submit their name, number of family members and how many have downloaded the app.
Banks like HSBC, IDFC, Deutsche, and Kotak Mahindra, have encouraged employees to download the app, and confirm to their line managers that they have done so.
The Reserve Bank of India also demanded downloads, but a 5 May email from the department of regulation says “we have not received confirmations from a large number of employees, whether they have registered themselves in Aarogya Setu or not.” It asked everyone to register and confirm that evening, even if they were working from home.
Standard Chartered Global Business Services sent a broadcast email asking employees to download the app as “a collective responsibility.”
An employee working there said, “People have to self declare on a link once downloaded and the same will supposedly be enforced by managers ensuring 100% compliance to government orders.” The email says the app is “subject to inspection by authorities at checkpoints.”
Universities like Indian Institute of Science, Bangalore; Deen Dayal Upadhyay Gorakhpur University, Gorakhpur; IIT Kanpur; IIT Gandhinagar; Lala Lajpat Rai Medical College; and Postgraduate Institute of Medical Education and Research, Chandigarh have asked teaching faculty and administrative staff to install the app.
A student at Sri Ramakrishna Institute of Technology said that tutors were insisting that students register themselves in Aarogya Setu and send a screenshot of their phone showing “Low risk of infection.”
A resident doctor at PGIMS, Rohtak, said, “Physical checking was done by office staff and then only attendance was sent for getting previous month’s salary.”
An employee from the WWF India said the organisation had sent emails asking them to use the app whether they worked at office or on the field.
Many Doubt Government Assurances And App Safety
“My company hasn't asked me, but I have anyways (sic) downloaded,” said one employee. A few others said they thought the app might be useful in battling the pandemic. Most of those who downloaded Aarogya Setu said they did so to keep their jobs.
A Spicejet captain said: “I'm ok to download the app for my safety being in a "high risk" job. But do I question the security and effectivity? Yes.”
A majority of the employees who contacted this reporter had reservations about Aarogya Setu. This may not be representative of all employees, because those skeptical of the app may be more likely to speak to a journalist, but employee responses are telling.
Most were unconvinced about the government’s assurances of Aarogya Setu being data secure and “privacy first”. They were uncomfortable with keeping the GPS on at all times, a practice they have otherwise been advised against, to avoid smartphone apps from accessing location data.
An employee who works on electric vehicles in Bangalore’s Mercedes office said he understood that the company was only following orders, but didn’t download the app because he believed the government could use the data collected for surveillance at a later stage.
A corporate lawyer in a firm with almost thousand employees said, “Our (firm’s) partners are forcing us to install it stating that if you can give your data to Facebook and Instagram, why not to the government of India? Why don't you trust them etc. I told them I have neither a Facebook or an Instagram account. But still they’re forcing us to install it.”
Many Health Workers Question App’s Utility
A public health professional asked, “The app marks all health workers as high risk. If they are blocked from entering apartment complexes, hospitals or offices, how will patients be treated? How will contacts be traced manually?”
A Hyderabad telemedicine doctor said, “I don’t think it’s effective mostly because you can lie about your symptoms and show yourself at low risk (in order to come to work).” Many of the “true positives” in the hospitals didn’t have their phone with them or didn’t have smartphones, so they didn’t show up on the app anyway, she added.
A government doctor who is part of the contact tracing team in Rajasthan’s Bhilwara, a Covid-19 hotspot that successfully controlled the spread of the coronavirus so far, said the “app is of no use”.
“We do contact tracing of positive cases… by history taking and collecting all the information from positive patients and (their) contacts/,” said the government doctor about the much appreciated ‘Bhilwara model’. He illustrated how Aarogya Setu had shown a false positive.
“There was one positive case in (our) area and was treated successfully, but was by mistake showing,” he said. They had to inform the concerned authority in Jaipur and get it removed.
Nearly all employees who downloaded the app said they kept either GPS or Bluetooth, or both off.
Many who downloaded the app said they uninstalled it once their manager had checked their phone, for a variety of reasons, such as:
scepticism about the app’s utility in proportion to the perceived data security risk
the app showed different number of positive cases for phones in the same room
worries about privacy
keeping GPS and Bluetooth on always might expose their data to other apps keeping GPS and Bluetooth on always drained the phone battery
annoyance at being compelled to download it
A doctor at a public sector company’s dispensary said she downloaded Aarogya Setu to comply and be able to enter her workplace, but then uninstalled it. “I’m not sure it is safe,” she said.
Worried about keeping her location on at all times and the “high consumption of mobile data,”, an Apollo doctor said, “We just took a screenshot and show that at reception everyday. Now the whole floor does it.”
Heated Debates In Nation Without Data-Protection Law
Different state governments developed several apps and did manual contact tracing as they dealt with the infectious pandemic in their own ways. But in early April, the central government launched Aarogya Setu to replace all of them. In 3 days, it saw 5 million downloads.
Once the user downloads Aarogya Setu, she must turn on her Bluetooth and give location (GPS) permissions to the app. The user then gives her name, age, gender, phone number, profession, and recent international travel history. She can also do a self-assessment of her health, and will be marked safe, low-risk, moderate or high-risk.
The app traces the user’s location continuously, and cross-references it with the central government database of Covid positive persons. If the user has come into contact with an infected person, the app sends her a notification.
The app requires users to keep their GPS location on at all times. K. Vijay Raghavan, the Principal Scientific Adviser to the Government of India said that having location data can help the government identify infection hotspots.
The app has generated heated debates on its privacy, data security and even efficacy (MIT gives it 2 out of 5 stars). But the app’s developers have defended it. Meanwhile, the government pressed for its use through print advertisements, social media campaigns, and even in the Prime Minister’s speeches.
At the time of writing, Aarogya Setu had been downloaded over 100 million times.
(Rohini Mohan is an independent journalist based in Bengaluru.)