- In containment zones and for office workers, Aarogya Setu is mandatory in India.
- Government says that Aarogya Setu app stores users data for up to 60 days.
- To allay privacy concerns, the government has said that it will be make Setu app source code public.
As nations increasingly adopt digital contact tracing as part of measures to prevent a resurgence of coronavirus, India's Aarogya Setu app -- though not as invasive as China's -- has sparked privacy concerns, with some experts warning that the tool is prone to surveillance abuse because of no strong data-protection laws in the world's largest democracy.
"As shown by other democratic countries, the contact tracing app should only be voluntary and not made mandatory," said Prasanth Sugathan, legal director at the Software Freedom Law Center, a digital-rights advocacy group.
India's Aarogya Setu, with about 9.08 crore users as of now, has been the most downloaded app on Play Store.
Enforcement Levels: As of now, Aarogya Setu is mandatory for working professionals in government and private sectors.
Technology and security: The app works by using both Bluetooth and GPS location data. Government claims that the Bluetooth interaction data automatically gets deleted after 30 days. But data of positive cases is stored for 60 days.
The location data from Aarogya Setu is stored on a centralised server in an encrypted format. It is used either through the user's consent or once a person tests positive, says the government.
"We should adopt a data minimalistic and decentralised approach," Sugathan said. "Instead of the decentralised approach followed by most countries, we have opted for a centralised approach with very little safeguards."
At present, the tool works using static identity, which is a fixed digital ID assigned to a user. Static identity is less secure and less private than dynamic IDs, which are randomly generated through automation after regular intervals.
The government's principal scientific advisor, Prof K VijayRaghavan, has told India Today that the app will soon be equipped with dynamic-identity features.
The app's source code is not available publically as of now, which has been questioned by privacy advocates.
A source code constitutes the basic structure of a program or app which consists of all its commands. Through the source code, independent researchers can test the functioning of an app.
Prof VijayRaghavan confirmed to India Today that the Aarogya Setu source code be made public in the near future for anyone to test its functions.
Data protection statute
In his comments, Parag Gupta, co-founder of the San Francisco based Tickle Life tech firm, underscored the need for tight statutory safeguards over individual and business data even as he praised Aarogya Setu as an efficient contact-tracing tool.
"There is much to be desired from the Indian policymakers about the next draft of Personal Data Protection Bill and for stricter regulation to safeguard the privacy and protection of individuals' and companies data in India, especially when it comes to government initiatives," Gupta said.
Currently under scrutiny of a parliamentary panel, the proposed legislation mandates that no data would be collected from a citizen unless their consent was taken in a manner prescribed by the law.
Aarogya Setu, Gupta explained, uses a mixture of GPS and bluetooth data, which he said is the current standard in contact tracking apps across the globe.
"Things might look different once Google-Apple's joint effort yields something more concrete. Till then, this is efficient, fast and can give a real sense to people about how they can safeguard themselves," he said.
Dr Peter Bannister, a biomedical engineer and executive chair at the UKs Institution of Engineering and Technology, stressed that winning public trust holds the key to the successful implementation of contact-tracing apps with a centralized database, like Aarogya Setu.
"Studies have consistently shown that the public is equally reluctant to share data with governments as with large multinationals and yet these are the only organizations capable of delivering a solution which can help us manage and ultimately overcome the disease," he remarked.
"In addition, access to population data can enable more sophisticated analysis, including approaches which have not yet been devised. However, this aspect means that use of data and overall trust in the chosen implementation is critical to convincing the public to participate," he added.
Contact-tracing in China
China's level of data surveillance through contact-tracing regime is probably the highest in the world.
Unlike any other country, the Chinese app is not a stand-alone tool. It's embedded in many of the country's popular payment, messaging and search-engine apps.
Its users receive algorithm-based ratings from those hosting apps. For them, it's mandatory to furnish their names, addresses national identity, passport and phone numbers, and so forth.
The use of the Chinese app varies area-wise. It's mandatory for travel in Covid-19 zones.
Using GPS, WiFi, bluetooth and details of financial transactions, calls and messages, the app collects the user's information on physical and digital contacts, location and financial contacts in a centralised manner. A user's health data is then used to grant or reject travelling permissions.
Contact-tracing in South Korea
South Korea probably ranks next to China in terms of high data surveillance. It has adopted a tightly-regulated tracing and testing strategy. Since South Korea doesn't have a lockdown in place, the country is enforcing strict quarantine for those who are infected with coronavirus. If anyone breaks quarantine, South Korea mandatorily asks them to wear a tracking bracelet.
Apart from the government's own Corona 100m app, other private tracking and mapping tools and wristbands are also used in the country.
South Korean authorities use CCTV footage, financial transactions and GPS location to collect user data. Contact-tracing is strict on travellers, possible contacts of positive cases and quarantined people.
Once a person is tested positive, a record of their movement, travel route, age and sex is circulated to all the people in that region.
The installation of the app is part mandatory for those the authorities suspect at risk, but the alerts about a positive case are sent to everyone on a location-based warning through text messages. This raises suspicion that the government could be doing anonymized location tracking of all cell phones.
Contact-tracing in Australia
Australia's COVIDSafe app works on Bluetooth handshake and keeps record of physical contacts of the past 21 days.
The data is stored locally on the users' phones unless they test positive, in which case it is sent to centralised servers hosted by Amazon online services.
The app collects the users' name, age, phone numbers and postcodes. The installation is voluntary but the Prime Minister has urged citizens to install it, saying it will take "millions more (installations)" for the tool to be effective.
Contact-tracing in the United Kingdom
The United Kingdom's health department rolled out the first trial version of the NHS tracking app on Monday.
It works on Bluetooth handshake and randomised IDs. The data is stored on a centralised server. Users are not required to share personal data until they test positive and decide to submit their records for further contact-tracing.
These are still early days for the app and the government has said that, based on feedback, the tool will be rolled out for the rest of the population in near future.
Contact-tracing in the United States
America's federal government has not rolled out any contact-tracing app so far. But President Donald Trump has said his administration will have a look at the upcoming joint initiative by tech giants Google and Apple, which are expected to introduce an app based on Bluetooth technology to help governments contact-trace past cases.
Google and Apple are creating a system using which the governments can create effective contact tracing app for the iPhone and Android. The system mandates that only Bluetooth data is used for contact tracing, that the user ID would be dynamic and refreshed every 15 minutes, that the data will not be centrally stored and that the app will not be allowed to collect GPS location data.
Google and Apple have said they expect this project to roll out later this month and it will be available until WHO doesn't declare coronavirus pandemic over.
Contact-tracing in Singapore
Singapore's TraceTogether app works on Bluetooth handshake technology. It doesn't collect the user's location data. Once a person is tested positive, their Bluetooth contacts are alerted and advised accordingly.
Installation of the app is voluntary. But the government is now appealing everyone to install it as the country is facing a second wave of outbreak after initial success in containment.
The app stores the user's mobile phone number for communication and generates random anonymised IDs for identification. The data is stored on a centralised server and its source code is public, which allows security experts to test the app's functionality.
A user can write an email with their phone number if they wish to opt out from tracing.
Contact-tracing in Israel
After the government in Israel was told by the country's Supreme Court to either stop mass surveillance of cell-phone locations to track Covid-19 cases or seek appropriate permission from the parliament, the Israeli health ministry rolled out an app called The Shield. The use of the app is not mandatory but is encouraged by the government.
The app collects GPS and WiFi data and stores it on a user's phone. It alerts the users if any of their contacts are tested positive for Covid-19.