On June 16, Prime Minister's Focal Person on COVID-19 tweeted "Grateful to @umarsaif & his startup @surveyauto1 for providing a platform to help hotspot-based selective lockdowns in Pakistan. It is based on sophisticated mathematical & epidemiological models to pinpoint hotspots and enables the govt to monitor compliance."

This seemingly innocent tweet started a whole Twitter storm.

Sconding Dr Faisal Sultan, SAPM on Digital Pakistan, Ms Tania Aidrus tweeted: "Strong emotions notwithstanding, we REALLY need to pull together as one during a national crisis like this. We should feel comfortable acknowledging everyone contributing to the national #Covid_19 response effort regardless of affiliations," placing credit for developing Smart Lockdown System app squarely on Dr Umar Saif.

However, CEO of NITB, Shabahat Ali Shah, immediately rubbished the claims that Smart Lockdown System app used any help from Dr Umar Saif or his company SurveyAuto. This gave rise to the question: Who built this technology?

The center of the whole controversy is NCOC Smart Lockdown System app. The app provides a dashboard to NCOC to view coronavirus cases in real time on a map, giving policymakers a useful guide on which areas were getting more COVID cases and hence could be locked down in a smart manner instead of locking down whole cities. This is the key aspect of Govt's "smart lockdown strategy" where only specific areas at the micro level are locked down to control Coronavirus while keeping the rest of the city open for business and other important activities.

Dr Saif's claim that his company SurveyAuto built the app was also picked by The News (where Dr Saif also works) and MIT Technology Review. The story, without citing sources, claims that Smart Lockdown System uses machine learning to track coronavirus cases.

However, our investigations revealed that Smart Lockdown System app was built completely by NITB in collaboration with TPL Maps (a private geomapping company based in Pakistan). NCOC Smart Lockdown System app does not use machine learning nor any other AI models as claimed by Dr Saif. While Dr Saif's company uses machine learning models to conduct surveys and estimate approximate figures based on a pre-built model, such technology was not very useful in collecting Coronavirus case data, which requires high degree of accuracy. NCOC Smart Lockdown System uses confirmed coronavirus case data and maps them on accurate local maps provided by TPL Maps, this system was built by NITB in collaboration with TPL Maps.

While talking to Business Recorder, Ms Tania Aidrus, the Chief Digital Officer of Pakistan and SAPM clarified the matter. She said the while NITB's Smart Lockdown System did not have any input from SurveyAuto, Dr Saif did help with population estimations in various areas. The confusion, she maintained, arose because of the thumbnail Dr Saif erroneously used from the NITB system.

Two Systems, one problem

The problem, according to Ms Aidrus, is two fold. The first part of the problem was mapping coronavirus cases in real time, that problem is being solved with the NITB Smart Lockdown System which provides a dashboard to the NCOC (National Command and Operation Centre). However, smartly locking down areas requires NCOC to know the population density of various localities. Population density data, while available with the Pakistan Bureau of Statistics (PBS), is not digitized. Due to the lack of digitization of population density data, Dr Umar Saif was formally invited by NCOC and his app SurveyAuto was used to estimate population densities of localities to find out if they qualified to be locked down.

This system was used in sync with NITB's real time COVID reporting system to provide a better picture to NCOC. The whole confusion arose because Dr Saif used NITB's screenshot by mistake, according to MS Aidrus, leading some to believe that Dr Saif was claiming credit for NITB's system, which is not the case, she maintained.

Were SoPs Followed?

In a notification dated 16th April 2020, Ministry of IT laid down clear rules on deployment of IT systems aimed to join the government's fight against Coronavirus. The notification states that all apps and IT systems to be deployed to fight against Coronavirus must be approved by the Ministry of IT via NITB.

While talking to Business Recorder, The head of NITB expressed his ignorance about whether a second system from SurveyAuto to estimate population density was deployed at the NCOC, leading one to believe that SoPs laid down by the MoIT were clearly disregarded. Furthermore, according to "3rd Party Application Deployment Standard Operating Procedures" by the Ministry of IT, all applications and systems deployed by the government must be audited by a team from the government's side.

Application Architecture Audit: A team will conduct an application audit to determine if there are any security loopholes or vulnerabilities that may cause harm to existing systems or result in data leakages. This audit shall be completed within 7 working days of receiving the request from the Private Organization

-MoIT SOPs

If SurveyAuto's technology was indeed deployed in the service of NCOC, no such audit was done by the MoIT.

End-2-End Testing: A team comprising of NITB/NTC along with the Private Organization shall test the deployed application along with any integrations in an offline environment. Any issues/concerns raised by this team shall be resolved by the Private Organization in a prompt manner.

-MoIT SOPs

Similarly, MoIT's SOPs clearly give the responsibility of testing any applications or systems deployed by the government to NITB/NTC. The fact that Mr Shabahat Ali Shah denies any deployment of SurveyAuto system leads one to believe that if SurveyAuto's systems were indeed deployed for NCOC, they were deployed in clear violations of the SOPs laid down by the Ministry of IT.

Operational Responsibilities: Once the application is live, NITB/NTC will take Level-1 Operational responsibilities. Level-2 and Level-3 support shall remain with the Private Organization.

-MoIT SOPs

In addition to that, the MoIT gives Level-1 operational responsibilities to NITB for any third-party systems deployment. The fact that NITB remains unaware of any such deployment points to a stark violation of MoIT rules and NITB was bypassed to allow a third-party deployment on government servers.

While NITB may have been bypassed with good intentions in this case, it does give rise to a number of concerns especially with respect to data privacy and security.

While Dr Saif claims that he provided his company's technology pro-bono as a goodwill gesture, this may not be always true for all cases. The SOPs in place by the MoIT ensure that highly sensitive and valuable government data is not leaked to third-parties and potentially hostile actors, bypassing of the rules on ad-hoc basis make it extremely difficult for different departments to collaborate and ensure that all government departments are on the same page.

The very public hostility and conflict in this specific case makes it obvious that collaboration between different government departments remains inadequate. Question remains: How was a third-party app deployed at NCOC without NITB's knowledge, if such is indeed the case as claimed by Dr Umar Saif, Ms Tania Aidrus and Dr Faisal Sultan.

Update: Head of NITB, Mr Shabahat Ali Shah, denies that even population density data is being used from SurveyAuto system's estimates. Mr Shah maintained that NITB has all population density data digitized and geomapped, and no SurveyAuto technology is deployed anywhere on government servers.