Security researchers question Govt’s Arogya Setu app designed to track COVID-19 patients

Hyderabad: Even as the government of India launched the ‘ArogyaSetu’ app, a mobile application intended for basic COVID-19 contact tracing, techies and data researchers are viewing the mobile app with suspicion. Data researchers have alleged that the app’s primary purpose is to collect information, rather than provide any new information on COVID-19 to the public.

For instance, the ArogyaSetu app requires the user to turn on BlueTooth and location sharing to ‘Always’. By doing this, the App detects other devices with Aarogya Setu installed that have come in the Bluetooth / GPS proximity of the user’s phone.

In case any of the contacts are tested positive for COVID-19, the app is expected to ascertain the risk of infection “based on recency and proximity of the interaction”.

Data researchers believe that there are ways of creating apps where the server (which is accessed by the government in this case) does not gain personal information of its citizens. In fact, a group of researchers headed by Prof. Carmela Troncoso at the Swiss Federal Institute of Technology Lausanne have developed a data system that hides all personal information from the server.

In absence of such measures, techies allege that ArogyaSetu app could just be a surveillance app meant for information collection. “The app is designed to track everyone's location and store it for future reference. The government is assuming everyone installs it and then inform people who have come in contact with a COVID-19 patient. These are wildly hypothetical assumptions,” says Srinivas Kodali, an independent data researcher based in Hyderabad.

Michael Vale, a lecturer in Digital Rights and Regulation at UCL Laws said, “Governments cannot be trusted with social network data from Bluetooth… We don't know if Bluetooth tracing will truly help fight COVID-19. Some epidemiologists say yes. But we know that centralising data is a recipe for misuse by law enforcement and police, at least in some countries where the rule of law is weak and power grabs are frequent.”

Meanwhile, the government of India has maintained that “Aarogya Setu has privacy-first by design and as an essential element. The personal data collected by the App is encrypted using state-of-the-art technology and stays secure… Personal data collected is only for tackling COVID-19 and for our fight against Pandemic.”

The Central government on April 3 further announced that it is soon to implement a citizen app technology platform for combating COVID-19, constituting a seven-member committee.