Aarogya Setu app downloaded on 1 crore phones, but does it serve the purpose, will it respect user privacy?

Hyderabad: A week ago, the Centre released a contact tracing application named ‘Aarogya Setu’ which records a user’s movements of employing Bluetooth and GPS. The app alerts the user if they come into contact with a Covid-19 patient whose location data is also recorded in the app.

Contact tracing apps have recently been used in countries such as Singapore and China too. But privacy experts in India note that when it comes to Aarogya Setu, there is very little information on how the app will be operated and how it will collect, store, and share user data.

How the app works

Upon downloading the Aarogya Setu app, users are asked to register using their mobile numbers and enter their name, gender and age. They are also asked to select any medical conditions they may have from a list of options provided. Most importantly, it asks users to keep their Bluetooth and location services (GPS-based in most phones) on at all times.

The app will use both technologies to pinpoint a person’s location with reasonable precision. The app also has a “self-assessment” tool which allows you to assess your risk using an automated chat bot.

A description of the app says that personal information of users would be stored locally in the user’s device. The government will get access to the same data in “anonymised, aggregated datasets for the purpose of generating reports [...]”. If a user tests positive, however, this personal information could be given to the government.

Within a week of going live on Google Playstore and Apple App store, Aarogya Setu has been downloaded by more than one crore people, giving the government a wealth of information.

There is very little clarity on who will have access to this data, and if it will be shared with the state governments in any form.

There is such a dearth of information that it isn’t clear how the main objective — of alerting people about positive cases — will work.

How to know a test result?

The app itself doesn’t allow users to self-report as positive, so how is it supposed to know of the person’s Covid-19 test result?

A senior bureaucrat from the Telangana state government speculated that it could be done through data furnished by the Indian Council of Medical Research (ICMR), the nodal agency that approves Covid-19 testing facilities in the country.

“ICMR has all details of all people who have tested positive so far, along with their mobile numbers. Perhaps, once someone is tested positive, his mobile number is fed into the Aarogya Setu app,” he said.

So far, the state government hasn’t received any communication about the sharing of Aarogya Setu data from the Union ministry of electronics and information technology or the health ministry. “Right now, the app seems to be targeted only for individual-citizen use,” the senior official said.

Sidharth Deb, policy and parliamentary counsel of digital rights advocacy group Internet Freedom Foundation (IFF), said that the legal/legislative grounds on which the app is functioning is unknown.

“Our surveillance architecture is not aligned with the right to privacy,” Deb said. “Firstly, the government needs to elucidate the value of contact tracing and location surveillance in this situation. They also need to be transparent about how the data will be stored, the extent to which it is collected, the purpose for which it will be processed and by when it will be deleted.”

He said the government must also clarify which government departments will have access to the data.

Additionally, Deb said the app’s claim of “anonymised aggregation” also requires scrutiny. “There are cases wherein anonymised datasets remain information security risks and can still be vulnerable to re-identification of personally identifiable information,” he said.

Mr Srinivas Kodali, an independent researcher and privacy rights activist, noted that that mass adoption of Aargoya Setu would be an essential factor in its success. “Almost everyone needs to have the app installed on their phones. We don’t know if this is feasible in India where internet and mobile connectivity is just picking up,” he said.

Additionally, he argued that whatever insights the app is able to provide needs to be given to the state governments as well, since it is they who are at the forefront of pandemic response activities. “In any case, an app won’t solve everything. We need vaccines, medical and safety equipment to address the situation,” he added.