What is Aarogya Setu?

Aarogya Setu, a COVID-19 tracking Indian app developed by the National Informatics Centre under the Ministry of Electronics and Information Technology, was launched on 2 April, 2020. This app is designed to keep a track of all its users whether they are suffering from the Corona virus disease or have they been in recent contact with any such person. The app aims at augmenting the initiatives of the Government of India, particularly the Health Department in proactively reaching out to and informing the users of the app regarding the risks, practices to avoid them and relevant advisory pertaining to containment of COVID-19. It also connects essential health services with the citizen to fight against COVID-19.

On 14 April, Prime Minister Narendra Modi addressed the whole nation to download the App. This App uses phone's Bluetooth and GPS system to keep record of the health status of all users. These records are stored in the till the user tests positive or declares symptoms through self-assessment survey by the app. The data collected by the app is broadly divided in 4 sections � demographic data (name, mobile number, age, gender, etc.), contact data (such as proximate distance between individuals), self-assessment data (user's response of the survey by Aarogya Setu) and location data (geographical location of contact with other users), collectively known as response data.

How the app works?

After installing the app, it starts off with asking for authenticate sign up by user's mobile number, followed by security and privacy notice about details which the app will collect. The app requests for access to device's Bluetooth and GPS and then begins the self assessment survey with some very basic questions such as name, age, gender, country, symptom checklist (for cough, fever, diabetes, lung disease, heart disease, etc), countries travelled in last 30 days and professional details (healthcare workers/ delivery workforce/ police/ law enforcement personals/ pharmacist/ grocery store worker/ pharmacist/ industry workers). Then the dashboard of the app features the risk level box informing about whether the person is under low risk or high risk category.

Is there any protocol issued by the Government regarding the app?

The protocol for the COVID-19 tracking app was issued by Ministry of Electronics and Information lying down guidelines for sharing the data of Aarogya Setu users with government agencies and third parties as well. This then gave rise to the controversy of privacy of the data shared on the app. According to the protocol, the response data will only be shared where it is "strictly necessary to directly formulate or implement appropriate health response".

The data may reach to the app's developer i.e., National Informatics Centre, Health Ministry, departments of state/ UT/ local government, National Disaster Management Authority, public health institutions of center, state and local bodies. The protocol also lays down that the data

been shared will remain till 180 days and then automatically deleted after the period. This protocol will be in force only for 6 months from the date of issue.

What does the privacy policy of the app says?

The users data in the app will only be shared with the government of India, without disclosing the name and contact number of the user. The government says that the app will also collect data from other nearby users related to time, exact location of where you came in contact with the other user.

The personal information data is stored locally in the device and will only be uploaded and used by the government in anonymized aggregated dataset, that is, by removing personally identifiable information. These data may also be shared with other "necessary and relevant persons/ authorities."

How safe is it for users?

Ethical hackers alerted about the potential security issues in the app. Legal experts and the common citizens have stressed the need for personal data protection laws to back government's decision to make the app mandatory. However the app builders insisted that it does not reveal the user's identity at any point, also the ethical hackers have not mentioned about the identification of any individual but just about the geographical location and other not so relevant information.

A comparison of government backed contact tracing apps was made under five criterions; Voluntary, Limited, Data Restrictions, Transparency and Minimized. India is among three countries to make the app mandatory, among four countries to not have limitations on the use of the data, and since Aarogya Setu was open-sourced it hampered the transparency. (However, it was made open-sourced on 26 May 2020).

Moreover, there is no legislation to detail about protection of the online privacy of Indians, making the users of the Aarogya Setu app to accept the privacy policy provided by the government. There should be more transparency regarding the inner functioning of the app, especially when it is promoted by the government itself and asking for personal details of the citizen of the country.


Reference:

• The Hindu (19 May, 2020)
•  https://mygov.in/aarogya-setu-app
  (The Aarogya Setu Data Access and Knowledge Sharing Protocol,2020)
  (Privacy Policy) (Press Release 26 th May 2020)