What is Aarogya Setu?
Aarogya Setu, a COVID-19 tracking Indian app developed by the National Informatics Centre
under the Ministry of Electronics and Information Technology, was launched on 2 April, 2020.
This app is designed to keep a track of all its users whether they are suffering from the Corona
virus disease or have they been in recent contact with any such person. The app aims at
augmenting the initiatives of the Government of India, particularly the Health Department in
proactively reaching out to and informing the users of the app regarding the risks, practices to
avoid them and relevant advisory pertaining to containment of COVID-19. It also connects
essential health services with the citizen to fight against COVID-19.
On 14 April, Prime Minister Narendra Modi addressed the whole nation to download the App.
This App uses phone's Bluetooth and GPS system to keep record of the health status of all
users. These records are stored in the till the user tests positive or declares symptoms through
self-assessment survey by the app. The data collected by the app is broadly divided in 4 sections
� demographic data (name, mobile number, age, gender, etc.), contact data (such as proximate
distance between individuals), self-assessment data (user's response of the survey by Aarogya
Setu) and location data (geographical location of contact with other users), collectively known
as response data.
How the app works?
After installing the app, it starts off with asking for authenticate sign up by user's mobile
number, followed by security and privacy notice about details which the app will collect. The
app requests for access to device's Bluetooth and GPS and then begins the self assessment
survey with some very basic questions such as name, age, gender, country, symptom checklist
(for cough, fever, diabetes, lung disease, heart disease, etc), countries travelled in last 30 days
and professional details (healthcare workers/ delivery workforce/ police/ law enforcement
personals/ pharmacist/ grocery store worker/ pharmacist/ industry workers). Then the
dashboard of the app features the risk level box informing about whether the person is under
low risk or high risk category.
Is there any protocol issued by the Government regarding the app?
The protocol for the COVID-19 tracking app was issued by Ministry of Electronics and
Information lying down guidelines for sharing the data of Aarogya Setu users with government
agencies and third parties as well. This then gave rise to the controversy of privacy of the data
shared on the app. According to the protocol, the response data will only be shared where it is
"strictly necessary to directly formulate or implement appropriate health response".
may reach to the app's developer i.e., National Informatics Centre, Health Ministry,
departments of state/ UT/ local government, National Disaster Management Authority, public
health institutions of center, state and local bodies. The protocol also lays down that the data
been shared will remain till 180 days and then automatically deleted after the
protocol will be in force only for 6 months from the date of issue.
The users data in the app will only be shared with the government of India, without disclosing
the name and contact number of the user. The government says that the app will also collect
data from other nearby users related to time, exact location of where you came in contact with
the other user.
The personal information data is stored locally in the device and will only be
uploaded and used by the government in anonymized aggregated dataset, that is, by removing
personally identifiable information. These data may also be shared with other "necessary and
relevant persons/ authorities."
How safe is it for users?
Ethical hackers alerted about the potential security issues in the app. Legal experts and the
common citizens have stressed the need for personal data protection laws to back
government's decision to make the app mandatory. However the app builders insisted that it
does not reveal the user's identity at any point, also the ethical hackers have not mentioned
about the identification of any individual but just about the geographical location and other not
so relevant information.
A comparison of government backed contact tracing apps was made
under five criterions; Voluntary, Limited, Data Restrictions, Transparency and Minimized. India
is among three countries to make the app mandatory, among four countries to not have
limitations on the use of the data, and since Aarogya Setu was open-sourced it hampered the
transparency. (However, it was made open-sourced on 26 May 2020).
Moreover, there is no
more transparency regarding the inner functioning of the app, especially when it is promoted
by the government itself and asking for personal details of the citizen of the country.
- The Hindu (19 May, 2020)
(The Aarogya Setu Data Access and Knowledge Sharing Protocol,2020)