More information about Aarogya Setu App published by Government of India

more information about Aarogya Setu App published by Government of India

As India settles into an extended coronavirus lockdown, the government wants to ensure it fervently pursues contact tracing. To this end, the 'Narendra Modi' government launched the 'Aarogya Setu' [Hindi for a bridge to healthcare] mobile app on April 2. The app is meant to alert users if they have come in contact with a Covid-19 positive patient, and what measures they need to take in case that happens. But cyber-security experts worry that 'Aarogya Setu' could violate its user's privacy and be a surveillance tool in the hands of the government.

How App Works...

The stated purpose of this app is to spread the awareness and to connect essential health services to the people of India. This app will augment the initiatives of the Department of Health to contain the risks of COVID-19, and sharing the best practices and advisories. This is a tracking app which uses smartphone's GPS and Bluetooth features to track the coronavirus infection. Aarogya Setu app is available for Android and iOS mobile operating systems. Using bluetooth technology, the Aarogya Setu app tries to determine the risk if one has been near a Covid-19 infected person (within six feet of distance) by scanning through a database of known cases across India, and using location information it determines the location one is in belongs to the infected areas based on the data available.

Despite glaring flaws, prime minister Modi recommended that citizens download this app while announcing an extension of the national lockdown till May 3. Several government agencies have also been spreading awareness about Aarogya Setu through different social media and other channels.

One reason for this could be that for the app to successfully undertake contact tracing for Covid-19, at least 50% of India's population needs to download the app. That in itself may prove a challenge given that only over 500 million people among India's 1.3 billion have smartphones.
But privacy concerns are still at the heart of all issues with Aarogya Setu.

All Intents And Purposes...

Purpose limitation, which predefines the end to which data collected will be used, is a key factor in privacy agreements. Vague language in Aarogya Setu's privacy agreement leaves it open for the government to repurpose this data for its other agencies. "To protect people's right to privacy, countries (including Singapore) say that contact tracing will be used strictly for disease control and cannot be used to enforce lockdowns or quarantines. Aarogya Setu retains the flexibility to do just that, or to ensure comply legal orders and so on," IFF's explainer about the app.

Singapore's Trace Together, for instance, explicitly states that the data collected through the app can only be used by the country's health ministry. Curiously, the committee that designed India's app "lacks any representation from the ministry of health and family welfare, or any independent involvement of persons with a medical or epidemiological background," according to IFF's paper.

What Information Provides Us After Download This Application...

Once you download the app, it walks you through the information it will provide you. The user then has to enter their mobile phone number, verified with a one-time password. After this, the user enters their name, age, gender, profession, travel history, and known contact with a coronavirus patient.

After this, the app takes the user to a dashboard that has basic information about Covid-19, including hygiene and social distancing protocols. It also has details to on how one could donate to the prime minister's coronavirus-specific relief fund, PM-Cares. Future iterations, perhaps, will see this app do more than just contact tracing and act instead as a central source of information.

Too much information...

Aarogya Setu also asks its users to provide both Bluetooth and location services access. This, in effect, is meant to help the app identify contact tracers of a Covid-19 positive patient. This happens through data sharing between devices with the app when they are in each other's proximity. 

Permission that it wants and why...

Aarogya Setu warns users that should they deny permission to GPS and Bluetooth, it could lead to a false assessment of the Covid-19 situation. But more alarmingly, it asks users to have the device in their possession at all times, and that an exchange of devices could lead to the app reporting false positives.“How will switching devices lead to a conclusion that someone is falsely identified as Covid-19 positive? Does this mean that people are categorised as Covid-19 positive based on the data collected by the application itself, instead of a formal test result to confirm a positive diagnosis?” asks Deb in IFF’s paper. “If this is indeed the case, there is a need to strongly commence dialogue to roll back the application and fine tune the entire process.”