Coronavirus | What are the concerns around the Aarogya Setu app?

Why should there be more transparency on the inner workings of an app that seeks the personal details of millions?

The story so far: On April 2, the AarogyaSetu app — for pan-India use and available in 11 languages — was launched as the main contact tracing technology endorsed by the Central government. Developed by the National Informatics Centre under the Ministry of Electronics & Information Technology, the app got its biggest push when Prime Minister Narendra Modi urged the nation to download it while announcing the extension of the national lockdown till May 3. Soon it became one of the most downloaded apps globally, and has crossed the 75 million mark. The app has now added on functionalities such as donating to the Prime Minister’s Citizen Assistance and Relief in Emergency Situations Fund, or PM CARES fund, and hosting e-passes for essential services providers.

How does the app work?

It is designed to keep track of other AarogyaSetu users that a person came in contact with, and alert him or her if any of the contacts tests positive for COVID-19 . It achieves this using the phone’s Bluetooth and GPS capabilities. The app will keep a record of all other AarogyaSetu users that it detected nearby using Bluetooth, and also a GPS log of all the places that the device had been at 15-minute intervals. These records are stored on the phone till the time any user tests positive or declares symptoms of COVID-19 in a self-assessment survey in the app. In such cases, the records are uploaded to the servers.

According to the privacy policy of the app, it gives users a colour coding of green and yellow based on their self assessment. The data of users who fall in the yellow category are uploaded to the server, while that of those in the green category — purportedly the lower risk group — is retained in the app.

While registering, the app collects a set of personal information such as name, sex, age, phone number, current location and travel history that is uploaded to government servers, which then generates a unique digital identity for that user. When the Bluetooths of two AarogyaSetu users sniff each other out, this unique digital identity is exchanged along with the time and location of the meeting. When an app user tests positive, all unique digital identities in his or her records get an alert on the risk they face and instructions on self isolation and next steps.

Has it been effective?

The AarogyaSetu app faces the same issue as every other contact tracing technology that has come up during the pandemic period — it is people dependent. It needs widespread usage and self-reporting to be effective. Given that any number of total users will be a subset of smartphone owners in India, and there are bound to be variations in the levels of self-reporting, the efficacy is not bulletproof. The terms of use of the app also say as much, distancing the government from any failure on the part of the app in correctly identifying COVID-19 patients.

Jason Bay, the brain behind TraceTogether, a contact tracing app from Singapore which has been among the more successful ones, emphasised the point that “automated contact tracing is not a panacea”. In a blog post, “Automated contact tracing is not a coronavirus panacea” (April 11, 2020 – https://bit.ly/2yI7nXU), he said: “A human-out-of-the-loop system will certainly yield better results than having no system at all, but where a competent human-in-the-loop system with sufficient capacity exists, we caution against an over-reliance on technology.”

TraceTogether’s developers worked closely and constantly with frontline health-care workers to make the app effective.

Are there privacy concerns?

Definitely. First of all, the app exists in the privacy law vacuum that is India. With no legislation that spells out in detail how the online privacy of Indians is to be protected, AarogyaSetu users have little choice but to accept the privacy policy provided by the government. The policy goes into some detail on where and how long the data will be retained, but it leaves the language around who will have access to it vague. As per the policy, “persons carrying out medical and administrative interventions necessary in relation to COVID-19” will have access to the data. According to a working paper from the Internet Freedom Foundation, this “suggests interdepartmental exchanges of people’s personal information” and is “more excessive than countries like Singapore and even Israel”.

Beyond the legal loopholes, there are technical loopholes as well. The unique digital identity in AarogyaSetu is a static number, which increases the probability of identity breaches. A better approach would be constantly-changing digital identification keys like what Google and Apple deploy in their joint contact tracing technology.

Comment | Implement Aarogya Setu, but only through law

The abundance of data collected is also potentially problematic. AarogyaSetu uses both Bluetooth as well as GPS reference points, which could be seen as an overkill. Other apps such as TraceTogether make do with Bluetooth.

Another issue that forums such as the Internet Freedom Foundation and the Software Freedom Law Center have raised is that the AarogyaSetu app is something of a black box. There is no documentation publicly available on the app. The advocacy groups argue that there should be more transparency on the inner workings of an app that is being promoted by the government and which is asking for the personal details of millions of citizens.

How is the Apple-Google project different?

The two technology giants that had till date baulked at the idea of offering integrations with each other’s operating systems, are now doing so, thanks to a global crisis. Android and iOS phones will be able to talk to each other via Bluetooth.

While they are currently offering it built into government health-care apps, this facility may soon be baked into operating systems. This may mean that different health-care apps will also be able to speak to one another using this channel, ensuring wider reach. While Google and Apple have emphasised that consent would be required for this feature to track you, privacy concerns prevail here too.