MORE FROM KrASIA

Indonesians skeptical of the state’s COVID-19 prevention apps

The Indonesian government’s COVID-19 prevention apps offer no novel features, yet expose users to privacy risks.

Photo courtesy of Unsplash.

To track, trace, and contain the coronavirus, governments around the world are turning to technology, each adopting different tools in hopes that they can flatten the curve and prevent a second wave of infections. Singapore and South Korea, in particular, have developed and released apps, maps, and other tech resources for contact tracing that have been widely adopted by their respective populations.

Indonesia, whose government has been criticized for being slow to mitigate the viral outbreak, launched three apps in March and April. The first one, PeduliLindungi, was released by the Ministry of Information to support contact tracing, tracking, and geofencing.

Screenshots of PeduliLindungi’s interface. The app notifies users if they are in a high-risk area.

Built to be similar to Singapore’s TraceTogether, the smartphone app monitors a user’s movements and logs their two-week history, utilizing devices’ Bluetooth connections to record encounters between people. Whenever an individual tests positive for COVID-19, those in their PeduliLindungi history will be alerted automatically. “We created this app to protect COVID-19-positive patients, people under monitoring, patients under surveillance, suspects, and all citizens through their smartphones,” said information and technology minister Johnny G. Plate.

Another app, called 10 Rumah Aman (“10 Safe Houses”), was designed to supplement PeduliLindungi. Launched by the Presidential Staff Office (KSP), this app utilizes artificial intelligence to generate maps that show the most recently logged body temperatures of people who are nearby, allowing you to check on anyone who may need help. (Each user records their body temperature in a third-party app called Prixa.)

Screenshots of 10 Rumah Aman’s interface. The app logs a user’s body temperature and and facilitates food distribution between people who live close to each other.

This app has other features too—food-sharing arrangements, tips for healthy living, self-assessment logs, and real-time reports of the body temperatures of people around you. KSP also collaborated with agritech startups such as Sayurbox and TaniHub to create an in-app e-commerce function where users can buy groceries and over-the-counter medication.

Inarisk prompts users to provide information about themselves and their living conditions.

The third app, Inarisk, was rolled out by the National Disaster Mitigation Agency on April 12. The app counts on users to conduct self-assessments by answering 21 questions to determine each individual’s risk level. Other than personal information, users have to describe their family situations and living environment.

As of April 18, PeduliLindungi has been downloaded by more than 1.9 million people, meaning that only about two in every 100 Indonesians are using the app. Together, the other two apps have fewer than 20,000 downloads.

Plate hoped the download numbers for these apps will rise as the country has more than 100 million smartphone users. During a video conference, he called upon influential figures such as celebrities and social media influencers to promote the apps.

Leaping without looking

It’s still too soon to draw conclusions about whether these apps are useful in curbing COVID-19. However, it must be noted that 10 Rumah Aman and Inarisk only include features that already exist in other health and wellness apps developed by companies that focus on these sectors, at times even falling behind.

Various apps such as Halodoc have launched telehealth services focused on queries about COVID-19, covering early symptom screenings and online pharmacy services. Other apps with large user bases, such as Gojek and Grab, also provided similar features. Indonesia’s official COVID-19 site also has more real-time data and a case distribution map that are not included in the apps.

“I suspect that the government and the application developers just went along with what neighboring countries are doing, without understanding the actual use cases,” said Ahmad Nadim, a medical doctor and CEO of healthtech startup Vaxcorp to KrASIA. “After all, as we can see, there are no novel features being developed, and the implementation is not better.”

This sentiment is echoed by Aisha Shaidra, a Jakarta-based journalist who installed PeduliLindungi to figure out how it works. “The app only tells us if we are in a red zone [which is high risk], but doesn’t specify [details about] the risk. It would be better if it also shows the radius. Also, there are no information updates, such as the number of cases,” she said.

Shaidra’s other concern is that the app drained her phone’s battery, as Bluetooth connectivity and the device’s location services need to be constantly turned on. She said she will not keep using the app because it doesn’t offer useful functionality or information.

These shortcomings limit the apps’ usefulness in containing the pandemic. For contact tracing to be accurate and effective, at least three-quarters of the population needs to install and run a tracing app, as stated by Singapore’s national development minister Lawrence Wong.

Pratama Persadha, a researcher from Jakarta’s Communication and Information System Security Research Center, observed that the Indonesian government’s tracing contact app lacks usability. “Who would want to install [the app]? That is, unless the government forces people to do it, with provisions like cash handouts for citizens to buy internet data packages,” he said to local media outlet Katadata.

In order to raise the number of people who are using these state-backed apps, Vaxcorp’s Nadim said the government must be more open about their actions to ward off the public’s skepticism. “Like all things, [the apps need] product campaigns, strategic partnerships, clear value propositions, as well as transparent reporting and data usage,” he said.

Read this: How Indonesian tech companies are adapting in a time of crisis

Contact tracing aims to identify transmission networks and how they relate to each other. This is achieved by tracking the mobility of known positive cases and informing each person that has come into contact with identified patients to seek medical help or self-isolate to reduce the virus’ spread. This is particularly important since a good portion of people who test positive are asymptomatic. And detailed mapping of high-risk areas based on age, population density, general hygiene standards, and personal mobility will also help determine scalable mitigation plans.

Instead of enforcing measures to track and trace the coronavirus from the onset, the Indonesian government downplayed the pandemic’s risk by ignoring warnings from foreign institutions, was late in taking preventive actions, and even snubbed scientists’ offers of assistance. These blunders resulted in a hundreds of reported deaths and thousands of identified cases.

This also calls into question the effectiveness of President Joko Widodo’s efforts to fold in a technocratic element to his administration by appointing millennial ministers and staffers. While there is no indication that former tech entrepreneurs who now hold public office were involved in the apps’ development processes, their input may have been invaluable at a critical time.

However, these former and current public officials have contributed in other ways. Belva Devara, who resigned from his position as presidential special staff, used his capacity as CEO and co-founder of education tech startup Ruangguru to provide free lessons while schools are closed. And Gojek, the company co-founded by the country’s current education minister, Nadiem Makarim, has been appointed by the Ministry of Social Affairs to distribute sembako (staple foods) as part of the government’s support program for underprivileged citizens.

As of April 21, there are 7,135 positive cases in the country, including 616 casualties and 842 recoveries. Indonesia has the highest COVID-19 death rate in Southeast Asia. Meanwhile, there are 16,763 patients who are showing symptoms and have been in close contact with infected individuals, and 186,330 people who are showing minor or no symptoms but may have been in proximity of patients from high-risk areas.

We need clear guidelines to safeguard personal privacy

Even though the Indonesian government claims that user data generated by PeduliLindungi, 10 Rumah Aman, and Inarisk will be protected, many people are still reluctant to install them due to fears of privacy breaches and mass surveillance that may continue even after the pandemic subsides. In particular, anyone whose data is stored on servers even after they uninstall these apps is at risk of having their privacy violated.

PeduliLindungi, for example, only asks for a user’s full name and phone number. However, unsuspecting users might grant the app access to their phone’s cameras and memory card, even though none of the app’s features require them. 10 Rumah Aman, on the other hand, prompts for more information, such as a user’s address, and it has third-party apps that are tethered to its platform, meaning data passing into the app is being collected by parties other than the government.

Screenshot of PeduliLindungi’s app permissions.

“It’s an ethical dilemma in every public health intervention attempt. The question is, does privacy still exist in this increasingly connected digital world?” Nadim said, adding that users need to assess to what extent they are comfortable with providing personal data, as well as where this data goes and how it is used.

It’s also important to guarantee that the data gathered will be strictly used for preventing COVID-19. The government has to audit their apps as well as third-party developers and data processors when the apps are phased out, ensuring that all collected data is wiped and cannot be exploited. Also, this data should not be shared with other government institutions.

The Ministry of Communication and Information Technology has regulated PeduliLindungi’s data usage and surveillance limits in two ministerial decrees, stating that the app should only be used during current health emergency, and will be shut down when the government declares that Indonesia is no longer in the grip of the coronavirus.

“We have commissioned and obliged all parties who manage this application to erase all gathered data when the emergency ends,” said Plate in a video press conference. It is unclear whether the two other apps will follow the same guidelines regarding their data retention.

Read this: Southeast Asian startups tighten belt as coronavirus hits revenue

There are other points of worry yet. The deputy director of the Institute for Policy Research and Advocacy (ELSAM), Wahyudi Djafar, said that there is a threat of data theft via other apps on a smartphone. As such, the government should conduct periodic assessments to “ensure that the data retrieved will be safely protected and won’t be stolen by other platforms, such as social media, maps, and others.” For now, the governmental departments that have backed PeduliLindungi, 10 Rumah Aman, and Inarisk have not stated whether they have conducted this sort of security appraisal.

Djafar also cited Indonesia’s weak data protection laws and complicated reporting protocols. Unlike Singapore, Indonesia doesn’t have a specific institution that oversees data protection. All data breaches are handled by the Ministry of Communication and Information Technology along with the Indonesian National Police’s cybercrime division.

Furthermore, there are no punitive measures for platforms that are behind data breaches. The current regulations only contain administrative sanctions, such as oral and written warnings, temporary suspensions, and mandated announcements on the platform’s website and in mass media.

On the other end, there is a lack of restorative justice for the victims of data breaches. “We only punish or incarcerate data thieves, but what about the victims whose personal data is being misused for bad purposes?” Djafar asked.

For tech-driven tracking and tracing to work, state actors must rejig policies on multiple fronts to secure the confidence of Indonesian citizens.