Centre for Internet and Society

Do We Really Need an App for That? Examining the Utility and Privacy Implications of India’s Digital Vaccine Certificates

divyank — 2021-08-03T05:13:28Z

We examine the purported benefits of digital vaccine certificates over regular paper-based ones and analyse the privacy implications of their use.

This blogpost was edited by Gurshabad Grover, Yesha Tshering Paul, and Amber Sinha.
It was originally published on Digital Identities: Design and Uses and is cross-posted here.

In an experiment to streamline its COVID-19 immunisation drive, India has adopted a centralised vaccine administration system called CoWIN (or COVID Vaccine Intelligence Network). In addition to facilitating registration for both online and walk-in vaccine appointments, the system also allows for the digital verification of vaccine certificates, which it issues to people who have received a dose. This development aligns with a global trend, as many countries have adopted or are in the process of adopting “vaccine passports” to facilitate safe movement of people while resuming commercial activity.

Some places, such as the EU, have constrained the scope of use of their vaccine certificates to international travel. The Indian government, however, has so far skirted important questions around where and when this technology should be used. By allowing anyone to use the online CoWIN portal to scan and verify certificates, and even providing a way for the private-sector to incorporate this functionality into their applications, the government has opened up the possibility of these digital certificates being used, and even mandated, for domestic everyday use such as going to a grocery shop, a crowded venue, or a workplace.

In this blog post, we examine the purported benefits of digital vaccine certificates over regular paper-based ones, analyse the privacy implications of their use, and present recommendations to make them more privacy respecting. We hope that such an analysis can help inform policy on appropriate use of this technology and improve its privacy properties in cases where its use is warranted.

We also note that while this post only examines the merits of a technological solution put out by the government, it is more important to consider the effects that placing restrictions on the movement of unvaccinated people has on their civil liberties in the face of a vaccine rollout that is inequitable along many lines, including gender, caste-class, and access to technology.

How do digital vaccine certificates work?

Every vaccine recipient in the country is required to be registered on the CoWIN platform using one of seven existing identity documents. [1] Once a vaccine is administered, CoWIN generates a vaccine certificate which the recipient can access on the CoWIN website. The certificate is a single page document that contains the recipient’s personal information — their name, age, gender, identity document details, unique health ID, a reference ID — and some details about the vaccine given. [2] It also includes a “secure QR code” and a link to CoWIN’s verification portal.

The verification portal allows for the verification of a certificate by scanning the attached QR code. Upon completion, the portal displays a success message along with some of the information printed on the certificate.

Verification is done using a cryptographic mechanism known as digital signatures, which are encoded into the QR code attached to a vaccine certificate. This mechanism allows “offline verification”, which means that the CoWIN verification portal or any private sector app attempting to verify a certificate does not need to contact the CoWIN servers to establish its authenticity. It instead uses a “public key” issued by CoWIN beforehand to verify the digital signature attached to the certificate.

The benefit of this convoluted design is that it protects user privacy. Performing verification offline and not contacting the CoWIN servers, precludes CoWIN from gleaning sensitive metadata about usage of the vaccine certificate. This means that CoWIN does not learn about where and when an individual uses their vaccine certificate, and who is verifying it. This closes off a potential avenue for mass surveillance. [3] However, given how certificate revocation checks are being implemented (detailed in the privacy implications section below), CoWIN ends up learning this information anyway.

Where is digital verification useful?

The primary argument for the adoption of digital verification of vaccine certificates over visual examination of regular paper-based ones is security. In the face of vaccine hesitancy, there are concerns that people may forge vaccine certificates to get around any restrictions that may be put in place on the movement of unvaccinated people. The use of digital signatures serves to allay these fears.

In its current form, however, digital verification of vaccine certificates is no more secure than visually inspecting paper-based ones. While the “secure QR code” attached to digital certificates can be used to verify the authenticity of the certificate itself, the CoWIN verification portal does not provide any mechanism nor does it instruct verifiers to authenticate the identity of the person presenting the certificate. This means that unless an accompanying identity document is also checked, an individual can simply present someone else’s certificate.

There are no simple solutions to this limitation; adding a requirement to inspect identity documents in addition to digital verification of the vaccine certificate would not be a strong enough security measure to prevent the use of duplicate vaccine certificates. People who are motivated enough to forge a vaccine certificate, can also duplicate one of the seven ID documents which can be used to register on CoWIN, some of which are simple paper-based documents. [4] Requiring even stronger identity checks, such as the use of Aadhaar-based biometrics, would make digital verification of vaccine certificates more secure. However, this would be a wildly disproportionate incursion on user privacy — allowing for the mass collection of metadata like when and where a certificate is used — something that digital vaccine certificates were explicitly designed to prevent. Additionally, in Russia, people were found issuing fake certificates by discarding real vaccine doses instead of administering them. No technological solution can prevent such fraud.

As such, the utility of digital certificates is limited to uses such as international travel, where border control agencies already have strong identity checks in place for travellers. Any everyday usage of the digital verification functionality on vaccine certificates would not present any benefit over visually examining a piece of paper or a screen.

Privacy implications of digital certificates

In addition to providing little security utility over manual inspection of certificates, digital certificates also present privacy issues, these are listed below along with recommendations to mitigate them:

(i) The verification portal leaks sensitive metadata to CoWIN’s servers: An analysis of network requests made by the CoWin verification portal reveals that it conducts a ‘revocation check’ each time a certificate is verified. This check was also found in the source code, which is made openly available. [5]

Revocation checks are an important security consideration while using digital signatures. They allow the issuing authority (CoWIN, in this case) to revoke a certificate in case the account associated with it is lost or stolen, or if a certificate requires correction. However, the way they have been implemented here presents a significant privacy issue. Sending certificate details to the server on every verification attempt allows it to learn about where and when an individual is using their vaccine certificate.

We note that the revocation check performed by the CoWIN portal does not necessarily mean that it is storing this information. Nevertheless, sending certificate information to the server directly contradicts claims of an “offline verification” process, which is the basis of the design of these digital certificates.

Recommendations: Implementing privacy-respecting revocation checks such as Certificate Revocation Lists, [6] or Range Queries [7] would mitigate this issue. However, these solutions are either complex or present bandwidth and storage tradeoffs for the verifier.

(ii) Oversharing of personally identifiable information: CoWIN’s vaccine certificates include more personally identifiable information (name, age, gender, identity document details and unique health ID) than is required for the purpose of verifying the certificate. An examination of the vaccine certificates available to us revealed that while the Aadhaar number is appropriately masked, other personal identifiers such as passport number and unique health ID were not masked. Additionally, the inclusion of demographic details, such as age and gender, provides little security benefit by limiting the pool of duplicate certificates that can be used and are not required in light of the security analysis above.

Recommendation: Personal identifiers (such as passport number and unique health ID) should be appropriately masked and demographic details (age, gender) can be removed.

The minimal set of data required for identity-linked usage for digital verification, as described above, is a full name and masked ID document details. All other personally identifying information can be removed. In case of paper-based certificates, which is suggested for domestic usage, only the details about vaccine validity would suffice and no personal information is required.

(iii) Making information available digitally increases the likelihood of collection: All of the personal information printed on the certificate is also encoded into the QR code. This is necessary because the digital signature verification process also verifies the integrity of this information (i.e. it wasn’t modified). A side effect of this is that the personal information is made readily available in digital form to verifiers when it is scanned, making it easy for them to store. This is especially likely in private sector apps who may be interested in collecting demographic information and personal identifiers to track customer behaviour.

Recommendation: Removing extraneous information from the certificate, as suggested above, mitigates this risk as well.

Conclusion

Our analysis reveals that without incorporating strong, privacy-invasive identity checks, digital verification of vaccine certificates does not provide any security benefit over manually inspecting a piece of paper. The utility of digital verification is limited to purposes that already conduct strong identity checks.

In addition to their limited applicability, in their current form, these digital certificates also generate a trail of data and metadata, giving both government and industry an opportunity to infringe upon the privacy of the individuals using them.

Keeping this in mind, the adoption of this technology should be discouraged for everyday use.

References

[1] Exceptions exist for people without state-issued identity documents.

[2] This information was gathered by inspecting three vaccine certificates linked to the author’s CoWIN account, which they were authorised to view, and may not be fully accurate.

[3] This design is similar to Aadhaar’s “offline KYC” process.

[4] “Aadhaar Card: UIDAI says downloaded versions on ordinary paper, mAadhaar perfectly valid”, Zee Business, April 29 2019, https://www.zeebiz.com/india/news-aadhaar-card-uidai-says-downloaded-versions-on-ordinary-paper-maadhaar-perfectly-valid-96790.

[5] This check was also verified to be present in the reference code made available for private-sector applications incorporating this functionality, suggesting that private sector apps will also be affected by this.

[6] Certificate Revocation Lists allow the server to provide a list of revoked certificates to the verifier, instead of the verifier querying the server each time. This, however, can place heavy bandwidth and storage requirements on the verifying app as this list can potentially grow long.

[7] Range Queries are described in this paper. In this method, the verifier requests revocation status from the server by specifying a range of certificate identifiers within which the certificate being verified lies. If there are any revoked certificates within this range, the server will send their identifiers to the verifier, who can then check if the certificate in question is on the list. For this to work, the range selected must be sufficiently large to include enough potential candidates to keep the server from guessing which one is in use.

For more details visit https://cis-india.org/internet-governance/blog/do-we-really-need-an-app-for-that-examining-the-utility-and-privacy-implications-of-india2019s-digital-vaccine-certificates

COVID-19 Charter Of Recommendations on Gig Work

Aayush Rathi and Ambika Tandon — 2020-05-13T08:53:02Z

Tandem Research and the Centre for Internet and Society organised a webinar on 9 April 2020, with unions representing gig workers and researchers studying labour rights and gig work, to uncover the experiences of gig workers during the lockdown. Based on the discussion, the participants of the webinar have drafted a set of recommendations for government agencies and platform companies to safeguard workers’ well being. Here are excerpts from this charter of recommendation shared with multiple central and state government agencies and platforms companies.

Summary of discussions from the COVID-19 and Gig Economy webinar, authored by Zothan Mawii, Tandem Research

Contributors

Aayush Rathi, Ambika Tandon and Tasneem Mewa, The Centre for Internet and Society, India
Aditi Surie, Indian Institute for Human Settlements
Anita Gurumurthy and Nandini Chami, IT for Change
Astha Kapoor, Aapti Institute
Dharmendra Vaishnav, Indian Delivery Lions (IDL)
Janaki Srinivasan, International Institute of Information Technology, Bangalore
Kaveri Medappa, University of Sussex
Pradyumna Taduri, Fairwork Foundation
Rakhi Sehgal, Gurgaon Shramik Kendra
Sangeet Jain, Researcher
Shaik Salauddin, Indian Federation of App-based Transport Workers (IFAT)
Shohini Sengupta, Assistant Professor of Research, Jindal School of Banking and Finance
Simiran Lalvani, Independent researcher
Tanveer Pasha, Ola, Taxi 4 Sure and Uber Drivers and Owners’ Association (OTU)
P. Vignesh Ilavarasan, Researcher and professor, IIT Delhi
Vinay Sarathy, United Food Delivery Partners’ Union (UFDPU)
Vinay K. Sreenivasa, Advocate, Alternative Law Forum
Zothan Mawii, Iona Eckstein and Urvashi Aneja, Tandem Research

Context

The nationwide lockdown in response to the ongoing COVID-19 pandemic has had a devastating impact on ‘gig workers’ working for on-demand service platforms such as those providing ride-hailing, home-based work and food delivery services and also e-commerce companies. Those driving for on-demand transportation companies have lost their source of livelihood as services remain suspended.

Workers for on-demand delivery and home-based services, on the other hand, have been deemed “essential” and continue to work although demand has fallen drastically. Earnings for delivery workers have fallen to as low as INR 100-300 per day for a whole day’s work. Workers face a high risk of contracting COVID-19 due to their exposure to multiple customers. Apprehensions are rising after a delivery worker for Zomato tested positive for COVID-19 in New Delhi. Demand has fallen further but delivery workers must continue to put themselves and their families’ health and safety at risk with limited or no provisions for personal protective equipment or other safety measures offered by companies.

The relief works announced by the central and state governments do not specifically provide for ‘gig workers’. At the same time, the measures announced by on-demand service companies are inadequate, ambiguous and inconsistent. The eligibility, manner and quantum of relief and the process of availing relief is unclear to workers.

We urge you to bolster the socio-economic and healthcare protections for ‘gig workers’ in India in light of the outbreak of COVID-19. Any efforts aimed at directing relief to ‘gig workers’ will have to be combined, involving the central and state governments and on-demand service companies.

We suggest that the measures adopted incorporate the recommendations outlined below. The recommendations have been drafted after discussion between civil society actors including labour unions from delivery and transportation sectors, researchers, and activists. A summary of the discussions leading to this charter of recommendations can be found here.

Charter of Recommendation on Gig Work

For more details visit https://cis-india.org/raw/covid-19-charter-of-recommendations

Atmanirbhar Bharat Meets Digital India: An Evaluation of COVID-19 Relief for Migrants

ankan — 2021-06-03T12:53:57Z

With the onset of the national lockdown on 24th March 2020 in response to the outbreak of COVID-19, the fate of millions of migrant workers was left uncertain. In addition, lack of enumeration and registration of migrant workers became a major obstacle for all State Governments and the Central Government to channelize relief and welfare measures.

A majority of workers were dependent on relief provided by NGOs, Civil Society Organizations and individuals or credit via kinship networks. With mounting domestic and international pressures, various relief and welfare schemes were rolled out but they were too little, too late and more often than not characterised by poor implementation.

The aim of this report is to qualitatively assess health conditions of migrant workers and access to welfare during the first COVID-19 lockdown. The primary focus is on the host states of Tamil Nadu, Maharashtra and Haryana. 20 in-depth interviews were conducted remotely with migrant workers working in various sectors. Their access to welfare schemes of the Central Government as well as of their host states was ascertained. Emphasis was also laid on their access to healthcare facilities in relation to COVID-19 and non-COVID-19 ailments.

The findings of the report showcase a dismal state of affairs. No one in our sample group received any kind of dry ration or cooked food in a sustained manner and, in the rare occasions when they did, it was woefully inadequate. Of the three states considered, we found that relief distribution was the best in Tamil Nadu followed by Maharashtra and then Haryana. Even the Direct Cash Transfer Scheme of the Central Government under ‘Atmanirbhar Bharat’ did not reach the migrant workers. Moreover, the migrant workers were apprehensive to report any COVID-19 related symptom due to the draconian treatment that followed therein and the crumbling healthcare sector made it impossible to avail facilities in non-COVID-19 related issues. Lastly, a case has been made for the creation of bottom-level infrastructures to further dialogue between various stakeholders, including associations of migrant workers, for the implementation of schemes and policies which can consolidate migrant workers as a relevant political subject. As migrant workers reel from the impact of the second wave, pushing for on-ground infrastructure and supporting community-based organisations becomes even more urgent.

Click here to read the report authored by Ankan Barman and edited by Ayush Rathi. [PDF, 882 kb]

For more details visit https://cis-india.org/raw/migrant-workers-solidarity-network-and-cis-ankan-barman-atmanirbhar-bharat-meets-digital-india-an-evaluation-of-covid-19-relief-for-migrants

A Compilation of Research on the Gig Economy

Aayush Rathi, Ambika Tandon, Sumandro Chattapadhyay — 2020-05-19T08:20:20Z

Over the past year, researchers at CIS have been studying gig economies and gig workers in India. Their work has involved consultative discussions with domestic workers, food delivery workers, taxi drivers, trade union leaders, and government representatives to document the state of gig work in India, and highlight the concerns of gig workers. The imposition of a severe lockdown in India in response to the outbreak of COVID-19 has left gig workers in precarious positions. Without the privilege of social distancing, these workers are having to contend with a drastic reduction in income, while also placing themselves at heightened health risks.

On gig economy during the COVID-19 pandemic

Supported by Feminist Internet Research Network led by the Association for Progressive Communications (APC) and funded by the International Development Research Centre (IDRC)

Along with Tandem Research, we spoke to leaders of four unions that represent gig workers across the country about the risks and vulnerabilities that they are having to contend with in the face of the COVID-19 crisis. Zothan Mawii (Tandem Research), Ambika Tandon, and Aayush Rathi share key reflections in this essay published on The Wire. (link).
Based on the discussion, a charter of recommendations was prepared with contributions from participants, and was shared with public and private stakeholders. (link)

On domestic workers in the platform economy

Supported by Feminist Internet Research Network led by the Association for Progressive Communications (APC) and funded by the International Development Research Centre (IDRC)

We discussed our ongoing research on the platformisation of domestic work in India with domestic workers, union members, and representatives from the Karnataka Labour Department in November 2019. Tasneem Mewa documented the rich discussion from this consultation. (link)

CIS worked with members of the Domestic Workers Rights Union to conduct field research on the lives and challenges of domestic workers in the platform economy. The following essays published on GenderIT capture their experiences of doing this research:

Parijatha G.P. writes about a “gated society management app,” MyGate, and the experiences of surveillance of migrant workers in Bengaluru. (link)
Radha Keerthna writes about the similarity in the conditions of domestic workers in the traditional and platform economy, particularly the precarity and invisibility of labour. (link)
Sumathi, a union leader, reflects on and her experience as an activist-researcher interacting with domestic gig workers through the course of our study. (link)
Zeenathunissa shares the difficulty of speaking to domestic workers in the gig economy, especially when workers undergo constant surveillance by employers and companies. (link)

On economic, algorithmic, and affective vulnerabilities of gig workers

Supported by Azim Premji University

CIS commissioned a set of four field studies of platform workers delivering food and driving taxis for platform companies in Mumbai and New Delhi. The researchers involved wrote a series of essays that were published by Platypus blog of CASTAC:

Anushree Gupta explores women’s presence as workers as well as passengers/customers in the ride hailing platform economy in Mumbai and related concerns of safety and risk mitigation. (link)
Sarah Zia highlights how algorithmic management of work and revenue targets of gig workers impact their everyday lives and plans for the future. (link)
Kinship networks are a critical source of safety and security for workers in the gig economy. Simiran Lalvani writes about the network among transportation workers in Mumbai, also reflecting on implications for those who are excluded. (link)
Noopur Raval and Rajendra Jadhav describe the unregulated and exploitative temporal structures of gig work, and how work-time of gig workers get configured by customer-facing promises of platform companies. (link)
The four researchers, led by Noopur Raval (co-PI for the project, held a roundtable discussion to reflect on methods, challenges, inter-subjectivities and possible future directions for research on the gig economy and its workers. (link)

The consultants - Noopur Raval, Anushree Gupta, Rajendra Jadhav, Sarah Zia and Simiran Lalvani - involved in this project on mapping digital labour in India’s platform economies (in Mumbai and New Delhi) gathered in Bengaluru on July 19, 2019 to share their preliminary field insights along with reflections on what it meant to do such studies, how they went about studying gig-work, and challenges that arose in their work. Watch the livestream from this discussion here.

For more details visit https://cis-india.org/raw/a-compilation-of-research-on-the-gig-economy

'I feel the pain of having nowhere to go': A Manipuri Trans Woman Recounts Her Ongoing Lockdown Ordeal

Santa Khurai — 2020-06-22T11:42:39Z

"My life and work in Bengaluru came to an abrupt halt with the COVID-19 outbreak and lockdown this March. We no longer had jobs and were forced to plan our departure from the city." -- As told to Santa Khurai, Manipur-based queer and Nupi Manbi activist, artist and writer. Compiled by Aayush Rathi, a cisgender, heterosexual man, and researcher with Centre for Internet and Society, India. This account is part of an ongoing CIS research project on gender, welfare and surveillance in India, and is supported by Privacy International, UK.

Originally published by Firstpost, June 20, 2020.

In 2015, I left my home state of Manipur for Bengaluru.

My name is Sarik*; I prefer to be known as Siku. I am a Nupi Manbi (trans woman).

Other Nupi Manbi had told me that Bengaluru is tolerant of transgender individuals, and that it is easy to find decent, well-paying jobs here. I contacted friends who had already moved here and relocated with their help.

Immediately, I found work at a fabric dyeing factory. The salary meant I could send some money home, my family was able to invest some of the funds in a monthly marup [revolving informal credit collective], and I was able to dream of someday having enough to buy a piece of land in Manipur.

I wasn’t to know at the time that just five years later, the happiness and hope would both prove fleeting.

***

I grew up in a small locality of Imphal East District, the youngest of three siblings. My mother had passed away, my father is a priest and story-teller, and my older brother worked as a traditional cook. As a result, our lives were fairly hand-to-mouth.

The frequent shifting of homes was very difficult for me, but I had no choice in the matter. I used to earn money by assisting other transgender friends in their tailoring works. While I worked hard in order to set aside enough money to own a small piece of land, it proved impossible with my meagre earnings.

After years of struggle, I decided to move to a big city with the aspiration to earn more.

***

My life and work in Bengaluru came to an abrupt halt with the COVID-19 outbreak and lockdown this March.

We no longer had jobs and were forced to plan our departure from the city. The Manipur government had announced measures that would allow stranded citizens to return to the state, so we began the formal process for our repatriation.

On 14 May 2020, three of us left Bengaluru in a special train that was organised for returnees to Manipur. Four days later, we were in Manipur.

When we reached Imphal, all returnees were first assembled at Modern College in Porompat, Imphal East. From there, we were sent to our respective constituencies to be quarantined. In the process, I was separated from my friends.

I was taken to Wangkhei Girl School as my permanent address falls under this constituency. At the quarantine centre, I was allocated a room shared by six other men. All the inmates were also sharing a toilet. This made me very uncomfortable; my body was undergoing changes due to hormonal effects.

In my discomfort, I reached out to transgender activist Santa Khurai, highlighting the need to set up a separate quarantine centre for transgender people. She immediately created a WhatsApp group for all the transgender people housed at different quarantine centres, keeping us updated about a separate quarantine centre for us. On the evening of 20 May, we rejoiced on seeing photos of the quarantine centre set up for transgender people. That night was the end of my terrible stay at the common quarantine centre.

***

On 21 May, I was shifted to the quarantine centre for transgender people at Ideal Blind School, Takyel. There, I was reunited with two of my friends. We stayed there for 17 days, receiving support from Santa Khurai through telecounseling. Before the quarantine period concluded, we were tested for COVID-19. We did not receive the results, but were advised to go back home. We were provided an acknowledgment in the form of a medical document. The relatives and parents of the other two trans girls had come to pick them up, but since my family doesn’t own a vehicle and it was not possible to hire on, I called a transgender friend to drop me home. I could sense some animosity in the neighbourhood, and decided not to step out from the house.

On the morning of 4 June, local governing bodies and clubs including Meira Paibi [a women’s rights group] thronged my house. A large crowd gathered in the temple shed. The club and Meira Paibi leader called my family members out and we were made to sit in the middle of a large group of people. They asked me to produce the result of the COVID-19 test, and I showed the acknowledgement given to us at the quarantine centre. People in the crowd passed the paper to each other disapprovingly, arguing that I hadn’t been declared COVID negative. One of the local club leaders called the police and doctors. The doctor who was in charge of the facility for transgender persons responded to the call, and validated my discharge from quarantine.

After few hours, even the police arrived and said that I could stay at home. However, the locals pressured the cops into taking my family — including my frail father who is in his 80s — to the police station.

***

We were finally allowed to leave the police station after several rounds of interrogation. My father, my brother (along with his wife and son) were taken back home by the police, while I was separately dropped off at a hotel in Gandhi Avenue, Thangal Bazar. I was advised to check in the hotel at around 3 pm; the charge was Rs 1,000 per day. When I asked the man who would pay for the room, he said, “Let’s see. At least you will be safe to stay here as the locals didn’t accept you coming home. You stay here until the test result come out.”

I called Santa in desperation, who consoled and reassured me. In the meantime, I had also called my sister to ask if some clothes could be brought for me. Her response alarmed and frightened me: My sister told me that my family were not being allowed to enter the house. The gate had been locked and they were instructed to stay at a quarantine centre as they were exposed to me. The news shocked me and made me desperate in wanting the test result to come out expeditiously, so that it would at least prevent any further hardships for my family.

Now I’m staying at the hotel. I fear going back to the house, the hostility of the locals, my family being attacked, my old father being forced to stay at a quarantine centre. I feel the pain of having nowhere to go. It is also infuriating to think that this could have been completely avoided had the officials not been in a haste to make us leave the quarantine centre, and had let us stay till the actual test results were received.

* Name changed to protect identity.

For more details visit https://cis-india.org/raw/a-manipuri-trans-woman-recounts-her-ongoing-lockdown-ordeal-covid19