Similar to the TraceTogether and StopCovid apps deployed by Singapore and France respectively, Aarogya Setu is of immense use to both users and health authorities in containing the spread of the virus.
By V Sridhar
There is a controversy over the deployment and use of Aarogya Setu app released by the Centre for contact tracing and tracking of Covid-19 infected individuals. Similar to the TraceTogether and StopCovid apps deployed by Singapore and France respectively, Aarogya Setu is of immense use to both users and health authorities in containing the spread of the virus. But, does it have any serious privacy implications?
There are a couple of causes of concern. First, is the security of the exchange of contact information when devices are in BT range. During the exchange, the communication between the devices may be hacked, leading to false information and alerts. Realising this, BlueTrace, the BT protocol based in the reference protocol OpenTrace, has been modified to generate dynamic and temporary DIDs every 15 minutes instead of the static DIDs used in Aarogya Setu. BlueTrace is available on GitHub, and should be incorporated in Aarogya Setu to prevent man-in-the-middle and other related security attacks.
As an alternative to GPS tracking, the Centre can request the location data of infected individuals from telcos under existing provisions of the Indian Telegraph Act and IT Intermediary Guidelines. This can be made available from telcos’ network Operational Support Systems databases, using International Mobile Subscriber ID, in a pseudo-anonymised form. While making such requests, the Centre should keep the individual in the loop, maintaining transparency. Along with reducing fears of surveillance, this might increase the uptake of the app, which still hasn’t touched a quarter of India’s approximately 500 million smartphone users.
Keeping the privacy skeptics aside, Aarogya Setu is a great initiative that shall set the standards for all SAARC countries in this time of crisis, sans the limitations mentioned above.
The author is Professor, IIIT Bangalore. Views are personal