Why is PM Modi fixated on the Privacy Disaster Aarogya Setu App? Everything you need to know.

In his speech dated April 14, PM Modi laid down a seven-pointer guideline with the extension of the lockdown. In it, he asked the Indian population to download and register within the Government developed the Aarogya Setu App.

What is the Aarogya Setu App?

The Government of India developed the contract tracing Aarogya Setu mobile application. The aim behind it is to connect essential health services with the people of India against COVID-19. It helps the Department of Health to reach out and inform users of the app regarding risks, best practices and relevant advisories about COVID-19.

The app was launched on April 1, 2020, to track coronavirus patients in the country. It is a small app (size: 3 MB on Play Store and 33 MB on Apple Store) with simple UI. The app requires location and Bluetooth access. It also calculates the risk of infection using the symptoms of the user and his proximity with COVID-19 patient. Aarogya Setu app became the most downloaded app in the last 13 days, Amitabh Kant, CEO of NITI Aayog tweeted.

Telephone took 75 years to reach 50 milion users, radio 38 yrs,television 13 yrs,Internet 4 yrs, Facebook 19 months, Pokemon Go 19 days. #AarogyaSetu,India’s app to fight COVID-19 has reached 50 mn users in just 13 days-fastest ever globally for an App

Salute the spirit of India! pic.twitter.com/xKqt3Tmj4f

— Amitabh Kant (@amitabhk87) April 14, 2020

Once the user provides Bluetooth and Location permissions, the app requests for some basic info that will help build data about the users. The information includes age, gender, name, health status and also asks for the countries that the user has been to in the past few weeks. The application also asks if the user belongs to any one of the exempted categories of professionals. Then it asks if the user will be willing to help in times of need.

The app has 4.7 stars rating on Google Play Store and 4.4 stars on Apple Store.

What do users have to say about the app?

On Play Store

Aniruddha Ghosh reviewed the app on the Google play store. He rated the app 3 stars and said:

Some issues: 1. This app turns on the Bluetooth for the COVID scan. But it should turn it off when exiting the app. 2. Scroll does not work properly. One has to scroll slowly without removing his finger from the screen for it to work. 3. The app just tells whether your risk of infection is low or not. It should include more real-time details. Overall, it is a two-page informative app that tells if you're in a safe area or not with the to-dos and don'ts; and another self-assessment questionnaire.

Anurag Gangpal rated the app 2 star and said:

Why everyone is asked to register on the app again and again whenever one opens it? We are asked to register several times a day. Required questions can be asked to be answered even if we register once. This registration whenever we open this app is useless and time-wasting exercise. Above all, this registration, again and again, is an unnecessary irritation for everyone. If this repeated registration continues, people will uninstall it.

Sarkar rated it 2 stars on Play store and reviewed:

It will drain the phone battery. Also if someone does not carry the phone along, it will not be effective. After I log in, it just takes a survey and displays a static page. I expected some map showing live tracking of infected users. Its just some data collection tool without giving me much info in return.

On Apple Store

Manoj Ji rated the app 5 stars on Apple store and said:

Great Initiative by NIC and Govt. Of India! When I first saw a message about this app on a Whatsapp group, I was a bit hesitant to download it thinking it might be a possible scam to gather public data by someone, but after verifying it is from NIC and Govt. of India, I downloaded installed and registered. It felt good finding I’m safe and in the green zone. I feel safe now as this app might help to know if I am in the vicinity of a Corona infected person so I can be extra cautious. Thank you, NIC and Modi Ji! So thoughtful of you. I have shared app to other WhatsApp groups too so others can take advantage of this app. 🙏

Sarsila O rated the app 1 star. Her review read:

Extreme invasion of privacy This app service wants you to set YOUR LOCATION to be ALWAYS ON. So if this app fails or gets breached, your location information can easily be leaked. This also is extremely risky because people might discriminate violently against Covid19 patients or high-risk people. We do not live in a society that purely consists of people who would only avoid the patients. Please reconsider and reflect on the societal behaviour we are living in. This is a thoughtless step of invading someone’s privacy, and that includes the common people, not only the patients.

What are its Privacy issues?

Even Google and Apple are developing a contract tracing app. But API and Bluetooth access have not been the primary security concern there. Most health experts and epidemiologists emphasise the importance of contact tracing in containing the speed of spread. Then, what makes Aarogya Setu different?

Sidharth Deb, Policy and Parliamentary Counsel of Internet Freedom Foundation wrote a paper on the privacy issues of Aarogya Setu. He wrote about the complete framework of contract tracing in past, present and future. He says, "India lacks a comprehensive data protection law and has not reformed its surveillance framework in line with the right to privacy."

Deb added, “The involvement of the health ministry is minimal or negligible. Besides, other departments and institutions in the government are steering the app. Even in the case of the Apple-Google announcement of its joint partnership, there is an intent to work with public health authorities who are steering the effort. Therefore, it certainly seems like there is a degree of institutional divergence when compared with international examples.”

Issues

One of the first privacy issues that come forward is that the App does not specify who will use the information. Also, Aarogya Setu seeks data that goes well beyond contact tracing. It collects everything from smoking preferences to occupation and GPS data. Besides, the report added that there are also risks of misidentification (or a false-positive) if the device is switched or is shared between people.

Secondly, in the face of transparency, the app has only delivered front-end privacy policy. The Indian government has not released any information about the source code of the app. This does not help ethical hackers in identifying security threats in the app and makes it potentially more vulnerable to malicious attacks.

Further, the data collected by Aarogya Setu is stored both on the device and on central servers. And while the terms of service say that time-stamped records of user contact will be deleted in 30 days, but not to anonymised and aggregated data sets. This means that encrypted user data on its servers could last beyond the purposes of tracing coronavirus.

In a similar attempt, the Government of Singapore released a contact tracing app- TraceTogether. The app does not use space data, i.e. GPS to locate people. Only physical location traces can access the location of the people. Now, GPS doesn’t offer the precision that is needed for contact tracing which is between 0-10 metres. It can only help analyse how crowded a place is.

Why does PM Modi want us to use the Aarogya Setu App?

Earlier, Prime Minister Modi urged the citizens to download the application to keep themselves safe during the pandemic outbreak. He said that this tracking app is an essential tool in COVID-19 fight. It is possible to use it as an e-pass to facilitate travel from one place to another, PTI reported. The app will provide constant precautionary measures and raise awareness. Anivar Aravind, the Founder Executive Director of Indic Project, in a tweet said that we should expect more identity integrations and also more protocol integrations for limited mobility.

Upon reading the report further, we could see that the app's privacy policy has this line- "… for which the information may lawfully be used or is otherwise required under any other law for the time being in force."

"This does not suggest intent on the part of the government to destroy these systems. As a result, there is a risk the personal information of users may be held for the duration of this public health crisis and beyond," Deb wrote. This could mean that the app is keeping the data related to individuals for longer than promised. The Government could use this data in future health programs or similar pandemics (God forbid!).

Due to its unclear policies regarding the data use, it looks like a cunning move on the part of the Government on how will they use this data apart from contact tracing. The motive of the app is vague and it repetitively collects information from users every time they open the app. This makes the app look like a long term idea, rather than just suiting the COVID-19 needs.