1 crore phones have Aarogya Setu app, but is it useful, does it respect your privacy?

A week ago, the Centre released a contact tracing application named ‘Aarogya Setu’ which records a user’s movements of employing Bluetooth and GPS. The software alerts the user if indeed they touch a Covid-19 patient whose location data is also recorded in the app.

Contact tracing software have recently been used in countries such as for example Singapore and China too. But privacy experts in India remember that in terms of Aarogya Setu, there is quite little information about how the iphone app will be operated and how it'll collect, store, and share user data.

How the software works

Upon downloading the Aarogya Setu app, users are asked to register utilizing their mobile numbers and enter their name, gender and age. Also, they are asked to select any medical conditions they could have from a list of options provided. Most of all, it asks users to keep their Bluetooth and location services (GPS-based generally in most phones) on constantly.

The app will use both technologies to pinpoint a person’s location with reasonable precision. The application also has a “self-assessment” tool which allows you to assess your risk using an automated chat bot.

A description of the iphone app says that private information of users will be placed locally in the user’s device. The government will get usage of the same data in “anonymised, aggregated datasets for the purpose of creating reports [...]”. If a user tests positive, however, this personal information could be directed at the government.

Within weekly of going live on Google Playstore and Apple App store, Aarogya Setu has been downloaded by more than one crore people, giving the government an abundance of information.

There is very little clarity on who'll have access to this data, and if it'll be shared with the state governments in virtually any form.

There is such a dearth of information that it isn’t clear how the main objective - of alerting persons about positive cases - will continue to work.

How exactly to know a test result?

The iphone app itself doesn’t allow users to self-report as positive, just how is it supposed to know of the person’s Covid-19 test result?

A senior bureaucrat from the Telangana state government speculated that it could be done through data furnished by the Indian Council of Medical Research (ICMR), the nodal agency that approves Covid-19 testing facilities in the country.

“ICMR has all information on all people who have tested positive up to now, with their mobile numbers. Perhaps, once someone is tested positive, his mobile number is fed in to the Aarogya Setu app,” he said.

So far, the state government hasn’t received any communication about the sharing of Aarogya Setu data from the Union ministry of electronics and it or medical ministry. “Right now, the app appears to be targeted limited to individual-citizen use,” the senior official said.

Sidharth Deb, policy and parliamentary counsel of digital rights advocacy group Internet Freedom Foundation (IFF), said that the legal/legislative grounds which the software is functioning is unknown.

“Our surveillance architecture isn't aligned with the right to privacy,” Deb said. “Firstly, the federal government needs to elucidate the worthiness of contact tracing and location surveillance in this situation. They also ought to be transparent about how the info will be stored, the extent to which it really is collected, the purpose that it'll be processed and by when it will be deleted.”

He said the federal government must also clarify which government departments could have access to the info.

Additionally, Deb said the app’s claim of “anonymised aggregation” also requires scrutiny. “There are cases wherein anonymised datasets remain information security risks and will still be vulnerable to re-identification of personally identifiable information,” he said.

Mr Srinivas Kodali, an unbiased researcher and privacy rights activist, noted that that mass adoption of Aargoya Setu will be an essential element in its success. “Almost everyone will need the app installed on the phones. We don’t know if this is feasible in India where internet and mobile connectivity is merely picking right up,” he said.

Additionally, he argued that whatever insights the app is able to provide needs to be given to the state governments aswell, because it is they who are in the forefront of pandemic response activities. “In any case, an app won’t resolve everything. We are looking for vaccines, medical and safety equipment to handle the problem,” he added.