Centre releases app to track Covid-19 patients

‘Aarogya Setu’ will record movements of users on their phones HOW THE APP WORKS: Upon downloading, users are asked to register using their mobile numbers. They are also asked to enter their name, gender, age and medical condition based on a set of furnis

A week ago, the Centre released a contract tracing application. The app named ‘Aarogya Setu’, upon being downloaded in a user’s smartphone, will record all his movements using Bluetooth and GPS. During this time, if the user is found to have come across a Covid-19 positive patient whose location data is also recorded in this app, he/she will be alerted about it.

Contact tracing apps are not new and have recently been used in countries such as Singapore and China, albeit eliciting criticism from some quarters. Privacy experts in India note that when it comes to Aargoya Setu, there is very little information on how the app will be operated and how it will collect, store, and share user data.

How the app works: Upon downloading, users are asked to register using their mobile numbers. They are also asked to enter their name, gender, age and medical condition based on a set of furnished options. Most importantly, it asks users to keep their Bluetooth and location services (GPS-based in most phones) on at all times. The app will use both technologies to pin-point a person’s location with reasonable precision. The app also has a “self-assessment” tool which allows you to assess your risk using an automated chatbot.

Documentation in the app notes that personal information of users would be stored locally in the user’s device. The government will get access to the same data in “anonymised, aggregated datasets for the purpose of generating reports [...]”. If a user tests positive, however, this personal information could be given to the government.

Within a week of going live on Google Playstore (it is also available on the iOS store), the app has been downloaded by more than one crore people, giving the government a wealth of information. There is very little clarity on who will have access to this data, and if it will be shared with the state governments in any form.

There is such a dearth of information that it isn’t clear how the main objective — of alerting people about positive cases — will work. The app itself doesn’t allow users to selfreport as positive, so how is it supposed to know of the person’s Covid-19 test result?

A senior bureaucrat from the Telangana state government speculated that it could be done through data furnished by the Indian Council of Medical Research (ICMR), the Central institution that is running the Covid19 testing operation in the country. “ICMR has all details of all people who have tested positive so far, along with their mobile numbers. Perhaps, once someone is tested positive, his mobile number is fed into the Aarogya Setu app,” he said.

So far, the state government hasn’t received any communication about the sharing of Aarogya Setu data from Union ministry of electronics and information technology or the health ministry. “Right now, the app seems to be targeted only for individual-citizen usage,” he said.

Mr Sidharth Deb, policy and parliamentary counsel for the Internet Freedom Foundation (IFF), a digital rights advocacy group, pointed out that the legal/legislative grounds on which the app is functioning remains unknown. “Our surveillance architecture is not aligned with the right to privacy. Firstly, the government needs to elucidate the value of contact tracing and location surveillance in this situation.

They also need to be transparent about how the data will be stored, the extent to which it is collected, the purpose for which it will be processed and by when it will be deleted,” he said. He added that the government must clarify which government departments will have access to the data.

Additionally, Mr Deb said the app’s claim of “anonymised aggregation” also require scrutiny. “There are cases wherein anonymised datasets remain information security risks and can still be vulnerable to reidentification of personally identifiable information,” he said.

Mr Srinivas Kodali, an independent researcher and privacy rights activist, noted that that mass adoption of Aargoya Setu would be an essential factor in its success. “Almost everyone needs to have the app installed on their phones. We don’t know if this is feasible in India where internet and mobile connectivity is just picking up,” he said. Additionally, he argued that whatever insights the app is able to provide needs to be given to the state governments as well, since it is they who are at the forefront of the pandemic response activities. “In any case, an app won’t solve everything. We need vaccines, medical and safety equipment to address the situation,” he added.