AAROGYA SETU: LONG ARM OF THE APP

In his April 14 address that announced the extension of the coronavirus lockdown till May 3, Prime Minister Narendra Modi appealed to Indians to follow a seven-pronged strategy to combat the pandemic. One of the measures was to download the Aarogya Setu contact-tracing app. The app, conceived by NITI Aayog, has been developed in two weeks by the National Informatics Centre in collaboration with the developers of makemytrip.com and 1mg.com.

Aarogya Setu is designed on the premise that if two mobile phones are within Bluetooth range of each other, their users are potentially close enough to transmit the novel coronavirus to one another. Since its launch on April 2, the app, which is available in 11 Indian languages, has registered nearly 50 million downloads. A World Bank report released on April 12 says innovative solutions like the Aarogya Setu could greatly help track contagious diseases while a University of Oxford study considers digital contact-tracing as effective, provided there is widespread adoption.

Despite such praise, Aarogya Setu has attracted criticism over privacy issues as it seeks users’ personal information, such as name, age, sex, profession and countries visited in the past 30 days. Every 15 minutes, it collects data about the user’s location and the places the user

visits. According to the app’s terms of service, personal information and location data are securely stored on the mobile device. The information is uploaded to a central server only when a user tests positive for COVID-19 or a self-assessment of symptoms indicates the possibility of infection.

While uploading to the server, the information is hashed with a unique, randomly generated device ID (DiD) number, which is used to identify the user in all subsequent app-related activities. “The DiD is reconnected to the personal information only when the user’s risk of infection is so high that the government needs to tell the person to get tested,” says Rahul Matthan, a cyber-law expert consulted by the Union government during the development of the app.

When two registered users come within each other’s Bluetooth range, their apps automatically exchange DiDs and information about where the contact happened and for what duration. Every phone builds a log of every other phone in its close proximity, thereby creating a social chain of people a user has come in contact with. If such a user tests positive for COVID-19, the system alerts all those who came in close proximity of the person. Such users are advised to quarantine themselves and, should they develop symptoms, get tested. Like Aarogya Setu user Aarti Singh (name changed) from Delhi, who received an alert when a buyer at a grocery store she had been to tested positive. “The app sent me an alert because it had recorded my location,” says the 42-year-old architect. To Singh’s relief, her RT-PCR (reverse transcription polymerase chain reaction) test turned out to be negative.

Cyber security experts claim contact-tracing apps in other countries, such as Singapore and Israel, are not so intrusive. Singapore’s TraceTogether app requires only the user’s mobile number. Data is transferred to a central server only after a COVIDpositive user grants consent. The TraceTogether app doesn’t collect location data either. In its guidelines on using technology to combat COVID-19, the European Commission has advised against processing data on location or movement of individuals. Aarogya Setu asks for GPS location even though this has no role in contact-tracing. “Location data will not be used for surveillance,” says NITI Aayog CEO Amitabh Kant. “It is used only for hotspots or where more testing is required. The identity of a COVID-19 person will never be revealed to anyone.” The app’s privacy policy states that the information is uploaded to a cloud server in anonymised and aggregated datasets only “for the purpose of generating reports, heat maps and other statistical visualisations”. Critics, however, argue that it is unclear as to what the government views as ‘anonymised’. In a detailed report on contact-tracing apps, New Delhi-based NGO Internet Freedom Foundation (IFF) has flagged the app’s shortcomings in terms of data collection and storage, purpose limitation and transparency. The app’s privacy policy states that information will be purged from the phone after 30 days and from the server after 45 days if the user does not test COVID-positive in that period. Information about users who test positive will be purged 60 days after they have been declared cured. However, personal data collected while registering with the app will be retained till the account exists and, thereafter, “as long as required under any law in force for the time being”. Nowhere in the policy, though, is the legal requirement for this defined. “Users have no way of checking if the government has deleted the data. They should have a judicial remedy to hold the government account

Similar apps in other countries are less intrusive. Singapore’s TraceTogether app requires only the user’s mobile number and does not record location data

able,” says Sidharth Deb, policy and parliamentary counsel at IFF. The other sore point is that the liability clause exempts the government in the event of unauthorised access and modification of a user’s information. Kant allays such fears. “The government will not use the data gathered by the app for any purpose other than COVID-19 medical examination,” he asserts. While the personal information collected cannot be disclosed or transferred to a third party, critics point out that since the privacy policy does not specify which government department owns the data, it remains a property of the Union government and is, arguably, open to use by all agencies, including the police. The other fear is that the government could significantly expand its surveillance powers by combining the app’s data with existing government databases, many of which are seeded with mobile numbers. Deb questions a clause that allows the government to share the personal data with “other necessary and relevant persons” for COVID-19 related “medical and administrative interventions”. “Administrative functions can also mean that such information can be used towards, say, implementing lockdown and quarantine orders. This is against global best practices. For instance, the EU says that to comply with its General Data Protection Regulation, the data collected by contact-tracing solutions should be used only for healthcare-related responses to the crisis,” he says. Matthan argues that the health ministry cannot possibly work in isolation while combating COVID-19, and inter-departmental cooperation and sharing of information is critical. India has an estimated 400 million or more smartphone users. If even half of them download Aarogya Setu, it could create a contact-tracing map of 200 million—15 per cent of the total population. “In a unique crisis, the app may have a very legitimate objective, but it doesn’t stand up to the test of proportionality,” says Amber Sinha, executive director at the not-for-profit Centre for Internet & Society. “Only data of COVID19-infected users should be pulled to the cloud server.” For Matthan, this criticism does not hold water as the details of only those infected are uploaded to the server. “Let’s assume 100,000 people will be infected in India. So, the data of only 100,000 people will be pulled out by the government for analysis and it will remain on the server for only 60 days. So that’s the canvas of the app in a country with 1.3 billion people,” he explains. Deb says the fact that the app’s code is not open source compromises transparency. “The Singapore tracing app has a dedicated website, which details how the data is collected, stored, used and deleted. The source code is published for public scrutiny,” he says. Aarogya Setu, in contrast, prohibits users from reverse engineering the backend source code, which means independent researchers cannot ascertain the veracity of official claims that the app is doing this and not that.

Despite these concerns, the official line is that Aarogya Setu has enough built-in security features to perform its legitimate task without infringing upon the privacy of citizens. Privacy concerns can be dealt with by legislating sunset clauses on tracking systems,” says the World Bank report. The next goal is to scale up Aarogya Setu by integrating it with feature phones through IVR support. ■

NITI Aayog CEO Amitabh Kant says the data gathered by Aarogya Setu will not be used for any other purpose except COVID-19 medical examination