What are the concerns around the AarogyaSetu app?-THE HINDU-26-04-2020

Details:

Developed by the National Informatics Centre under the Ministry of Electronics & Information Technology, the app got its biggest push when Prime Minister Narendra Modi urged the nation to download it while announcing the extension of the national lockdown till May 3. Soon it became one of the most downloaded apps globally, and has crossed the 75 million mark.

How does the app work?

The app will keep a record of all other AarogyaSetu users that it detected nearby using Bluetooth, and also a GPS log of all the places that the device had been at 15-minute intervals. These records are stored on the phone till the time any user tests positive or declares symptoms of COVID-19 in a self-assessment survey in the app. In such cases, the records are uploaded to the servers. According to the privacy policy of the app, it gives users a colour coding of green and yellow based on their self assessment.

When the Bluetooths of two AarogyaSetu users sniff each other out, this unique digital identity is exchanged along with the time and location of the meeting. When an app user tests positive, all unique digital identities in his or her records get an alert on the risk they face and instructions on self isolation and next steps.

Has it been effective?

Given that any number of total users will be a subset of smartphone owners in India, and there are bound to be variations in the levels of self-reporting, the efficacy is not bulletproof.

Jason Bay, the brain behind TraceTogether, a contact tracing app from Singapore which has been among the more successful ones, emphasised the point that “automated contact tracing is not a panacea”.

Are there privacy concerns?

First of all, the app exists in the privacy law vacuum that is India. With no legislation that spells out in detail how the online privacy of Indians is to be protected, AarogyaSetu users have little choice but to accept the privacy policy provided by the government. As per the policy, “persons carrying out medical and administrative interventions necessary in relation to COVID-19” will have access to the data. The unique digital identity in AarogyaSetu is a static number, which increases the probability of identity breaches.

A better approach would be constantly-changing digital identification keys like what Google and Apple deploy in their joint contact tracing technology. AarogyaSetu uses both Bluetooth as well as GPS reference points, which could be seen as an overkill. The advocacy groups argue that there should be more transparency on the inner workings of an app that is being promoted by the government and which is asking for the personal details of millions of citizens.