Image copyright
Getty Images
Image caption
The app has crossed 100 million downloads
India’s Covid-19 contact tracing app has been downloaded 100 million times, according to the information technology ministry, despite fears over privacy.
The app – Aarogya Setu, which means “bridge to health” in Sanskrit – was launched just six weeks ago.
India has made it mandatory for government and private sector employees to download it.
But users and experts in India and around the world say the app raises huge data security concerns.
How does it work?
Using a phone’s Bluetooth and location data, Aarogya Setu lets users know if they have been near a person with Covid-19 by scanning a database of known cases of infection.
The data is then shared with the government.
“If you’ve met someone in the last two weeks who has tested positive, the app calculates your risk of infection based on how recent it was and proximity, and recommends measures,” Abhishek Singh, CEO of MyGov at India’s IT ministry which built the app, told the BBC.
While your name and number won’t be made public, the app does collect this information, as well as your gender, travel history and whether you’re a smoker.
Is it mandatory to download the app?
Prime Minster Narendra Modi has tweeted in support of the app, urging everyone to download it, and it’s been made mandatory for citizens living in containment zones and for all government and private sector employees.
Noida, a suburb of the capital, Delhi, has made it compulsory for all residents to have the app, saying they can be jailed for six months for not complying.
Food delivery start-ups such as Zomato and Swiggy have also made it mandatory for all staff.
But the government directive is being questioned by some.
In an interview with The Indian Express newspaper, former Supreme Court judge BN Srikrishna said the drive to make people use the app was “utterly illegal”.
“Under what law do you mandate it? So far it is not backed by any law,” he told the newspaper.
MIT Technology Review’s Covid Tracing Tracker lists 25 contact tracing apps from countries around the globe – and there are concerns about some of them too.
Critics say apps such as China’s Health Code system, which records a user’s spending history in order to deter them from breaking quarantine, is invasive.
“Forcing people to install an app doesn’t make a success story. It just means that repression works,” says French ethical hacker Robert Baptiste, who goes by the name Elliot Alderson.
What are the main concerns about India’s app?
Aarogya Setu stores location data and requires constant access to the phone’s Bluetooth which, experts say, makes it invasive from a security and privacy viewpoint.
In Singapore, for example, the TraceTogether app can be used only by its health ministry to access data. It assures citizens that the data is to be used strictly for disease control and will not be shared with law enforcement agencies for enforcing lockdowns and quarantine.
“Aarogya Setu retains the flexibility to do just that, or to ensure compliance of legal orders and so on,” says the Internet Freedom Foundation, a digital rights and liberties advocacy group in Delhi.
Image copyright
Getty Images
Image caption
Aarogya Setu requires constant access to a user’s Bluetooth and GPS to collect multiple points of data about a user