Viability Rating of Technological Interventions for COVID-19

Viability Rating

The Viability Rating of a technological intervention considers its capacity to complement pandemic management with due regard to its population penetration, privacy and effectiveness implications.

Technology interventions are  scored on the basis of:

1. Population Penetration: What portion of its serviceable audience1 can the specific measure cater to.
2. Privacy: How well does the intervention fare against the principles of data protection.
3. Effectiveness: The ability to achieve the stated result.

A composite Viability Rating has been computed on the basis of the above factors and has been rated as:

• Cyan (high/good) if any two of Population Penetration, Privacy or Effectiveness are cyan and third is yellow.
• Yellow (medium/average) if any two of the three criteria are yellow, OR exactly one of the three criteria is magenta.
• Magenta (low/poor) if any two are magenta, OR any two are yellow and the third is magenta.

A comparative assessment of the viability rating of 30 apps has been undertaken by the authors of this post. It can be accessed here.

Population Penetration

The population penetration of the underlying technology will serve as a baseline to determine how much of its serviceable audience will be able to take advantage of a given technological intervention. This can determine the extent to its benefits and costs are spread among those affected in such a way that no group or individual receives less than a minimum benefit level or maximum cost level.

To assess the population penetration of the technology interventions, internet access is considered a primary factor. For interventions where the use of Bluetooth Low Energy is being proposed for contact tracing, an additional scaling factor is applied to account for a percentage of phones that may not support its use due to hardware limitations. This forms a reasonable basis to determine equity since exclusion based on the technology interventions studied in this document will result in the costs being borne by those who lack uninterrupted access to the internet on their terms. Further, of those who do have access, 30-40% do not use the internet on a daily basis.

Technology interventions were classified as Cyan, Yellow and Magenta based on:

• Cyan: If more than 65% of the serviceable audience can be expected to have access to the internet connection.
• Yellow: If 35%-65% of the serviceable audience can be expected to have access to the internet.
• Magenta: If less than 35% of the serviceable audience is expected to have access to the internet.

The following factors could not be factored quantitatively into the equity assessment exercise at this time as either pan-India or state level, rural/urban breakdown of data were not available

1. Multiple Language support.
2. Gender/Class/Caste divide in internet access.
3. Smartphone penetration by state.
4. Need for additional capabilities like GPS, Gyroscopes, Accelerometers to improve accuracy which may or may not be available depending on the market segment a device belongs to.
5. Tendency to share a single mobile internet connection or smartphone among multiple users.
6. Exclusion from benefits on the basis of the lack of accessibility.
7. Diffused costs versus concentrated benefits accruing from 6.

Privacy

Personally identifiable data forms the basis of all the technological interventions proposed across the globe. The consequential effects on the right to privacy of the individual and measures to preserve the data collected need to be scrutinised to ensure that immediate interests of the State would not lead to abysmal infringement of individual liberties.

The major factors considered, upon the existence of a privacy policy is the method of addressing:

1. Purpose limitation: Whether the data collected has been explicitly demonstrated to be used for the limited purpose of managing the pandemic?
2. Permissions sought vis-à-vis intent: Whether the permissions sought by the App for data collection, limits itself to the stated intent of the App?
3. Possibility of deanonymisation: Whether the data points collected and the data security practices stated by the privacy policy indicate the ease of deanonymising data?
4. Data retention: Whether there exists a clear statement on data retention policy?
5. Oversight accountability on data collected: Whether clear indications on oversight accountability have been laid down on storage of collected data?

The technological interventions have been classified as red, yellow and green on the basis of their performance on these above mentioned metrics.

• Cyan: A clear privacy policy exists with explicit statements on purpose limitation, data retention and oversight accountability on the data collected. The permissions sought by the App for data collection are minimal and stick to the intention of the App. The App collects only relevant data points and the security practices are adequate to protect sensitive personal data.
• Yellow: A privacy policy exists but is not clear on purpose limitation, data retention and oversight accountability on the data collected. The App collects multiple data points which may be irrelevant and the security practices are inadequate to protect sensitive personal data. There are possibilities of sharing such data with third parties beyond the purpose of pandemic management, without informed consent of the generator of the data.
• Magenta: The privacy policy does not exist, or is a standard form policy generated from the internet. Concerns of data retention or oversight accountability are not addressed. The permissions sought by the App for data collection is excessive and irrelevant to the intention of the App. The security practices are inadequate to protect sensitive personal data. The data collected may be shared with third parties beyond the purpose of pandemic management, without informed consent of the generator of the data.

Effectiveness

Effectiveness refers to the ability to achieve the stated result. Eg. A contact tracing App is effective if it can trace accurately and precisely.

Most mobile-based interventions are using applications that utilise Bluetooth low energy or global positioning system (GPS) or a combination of these two technologies.

The interventions have mainly been in the form of apps focused on the following use-cases:

1. Contact Tracing
2. Quarantine Management
3. Risk Determination
4. Providing COVID-19 and healthcare information (Informatory)
5. Issuing E-passes

The apps have been scored Cyan (high/good), Yellow (medium/average), or Magenta (low/poor) on the above five use-cases.

Contact Tracing

Quarantine Management

Risk Determination

Informatory

E-pass

This post was authored by Prateek Waghre, Sapni GK and Utkarsh Narain.