Outsourcing CoWIN’s Technology A ‘Premature’ Move: Experts

Kazim Rizvi, Sharat Chandra and Abhimanyu Bhosale explain if it’s a good idea to open source COWIN’s tech.

India is set to help at least 20 countries to build a technology to run their own inoculation drives.

(Photo: The Quint)

India is likely to make CoWIN – the digital platform that helped implement the nationwide COVID-19 vaccination programme – an open source for other countries, so they can use the technology to run their own inoculation drives.

RS Sharma, Chairman of National Health Authority of India (NHAI) in an interview with ET Now on Tuesday, 22 June, said that CoWIN is an international product and its technology should be open-sourced to other countries.

Several countries including Vietnam, Peru, Mexico, Iraq, the Dominican Republic, Panama, Ukraine, Nigeria, the United Arab Emirates and Uganda have expressed interest in learning about the CoWIN technology to run their own COVID vaccination programmes, PTI reported.

The CoWIN framework is designed to provide equitable distribution of vaccines in India. There are 32,15,01,492 registrations till date, with 29,50,74,872 doses administered so far (first dose and second dose cumulatively). But the technology on which CoWIN runs is not entirely smooth.

The Quint spoke to experts: Kazim Rizvi, CEO, of The Dialogue, a privacy policy think tank, Sharat Chandra, a cyber expert, and Abhimanyu Bhosale, CEO of CrelioHealth, a medical records management app.

'Iron Out the Glitches First'

Tech Evangelist Sharat Chandra told The Quint the government seems to be in a rush to introduce 'VaccineTechMaitri', another COVID diplomacy tool, by making CoWIN an open source.

Chandra believes that while there is nothing wrong in the intent, it is important to iron out glitches first .

The Quint earlier reported how techies are gaming the open-source Application Programming Interface (API) of CoWIN in a bid to book vaccine slots.

According to Vikas Sheel, IAS, Additional Secretary, Ministry of Health and Family Welfare, at least 4,13,173 vaccination certificates, generated by CoWIN, needed correction.

An open API refers to a publicly available application programming interface (API) that provides developers access to a proprietary software application.

While CoWIN has introduced several updates to stop automation of scheduling a vaccine slot, it seems that bots continue to abuse the API, despite several measures taken by the digital platform.

"Let’s face it. The platform is not bereft of bugs. The platform boasts of 300 million registered users. In terms of scalability, the platform has handled close to 30,000 vaccine transactions per second. It is too early to put CoWIN in the league of UPI’s success story,” said Chandra.

Echoing similar sentiments, Kazim Rizvi, Founding Director of The Dialogue, a privacy policy think tank believes that there are efforts to curb/rectify the errors in data entry etc, and there are also concerns regarding usage of bots for booking. These challenges need to be addressed as we move towards universal coverage.

Benefits of Open Adoption

Meanwhile, Abhimanyu Bhosale Co-Founder and CEO at CrelioHealth believes that open-sourcing the platform is actually a good decision. He points out two benefits of making the platform an open source.

• The software application’s internal functions are readable, so details on how and what information is managed becomes clear
• Open adoption makes it easier for people to use it for their own purposes.

"We should be asking to open source every government application so it can be audited based on what information it stores and how it uses that private information about users," Bhosale added.

Premature Move

However, CoWIN’s lacunae aggravates the problem of digital inclusion and potential abuse.

Chandra believes that focus should be on mitigating risks associated with the platform. Concerns around data privacy and consent should be addressed before the tech is made available to other countries.

"It’s too premature to think about exporting CoWIN tech to other nations. The platform has not evolved to cover all kinds of vaccinations in the country. The government should use CoWIN for Mission Indradhanush, government’s programme for vaccination for kids upto 2 years of age and pregnant women and then offer the tech to SAARC nations," he added.

There are more than a billion people across the globe without any legitimate proof of identity. The platform needs to be more inclusive and make provisions for those who do not possess identity documents.

“How would Rohingyas and refugees get vaccinated? Such underprivileged sections of the society would be more vulnerable to the onslaught of the impending third wave,” Chandra asked.

Privacy Concerns

Talking from a data privacy perspective, Rizvi explains that 'the information collected on the platform includes sensitive data, including the possible linkage of a person to their health ID. This comes in the absence of a data protection law, that would adequately arm the beneficiary with remedies, and agency over their data. A nuanced privacy policy, and terms of use of the data collected will also be helpful in enhancing trust, and thus allowing for wider adoption and wider coverage.'

As is the case with most digital platforms, privacy of citizens and the remedies available to them in case of any breaches are important. Considering privacy is a fundamental right in India, it is incumbent on the government agencies to adhere to the principles enshrined in the Puttaswamy judgment.

"It is also important to note that we must stay away from function creep – where data is collected for one purpose and is used in a different context. This has adverse effects on the rights of privacy of the citizens, and erodes trust in the system itself," Rizvi added.