Aarogya Setu: Is open-source secure enough?
Facing flak for transparency, the government has made the Aarogya Setu app—used to gather information and tackle the spread of the coronavirus—open source, but experts say privacy fears still persist
The civil aviation minister recently said that downloading Aarogya Setu was preferable, but not mandatory, for air travel
Image: Ajay Aggarwal/Hindustan Times via Getty Images
“Releasing the source code of a rapidly evolving product that is live at this massive scale, within eight weeks of launch is a first for a government product,” claims Arnab Kumar, ex-programme director, NITI Aayog. Experts, however, say several issues still remain unaddressed. “The source code cannot indicate the government departments with which the information is being shared, and how and whether this information is being used outside the public health system,” explains Divij Joshi, Mozilla technology policy fellow. Mukhopadhyay believes that Aarogya Setu needs a legislative framework to ensure that data is not used for law enforcement or commercial purposes. “It should also be made clear that the use of the app cannot be a pre-condition for accessing goods, services and public facilities,” he says.
Kumar, however, says, “Aarogya Setu’s privacy policy has several firsts, including automated data destruction policy, clear purpose limitation to the Covid-19 effort without exception and maximizing data kept on device, minimizing data transferred to the cloud and an explicit sunset clause.” Officials state that data is only shared with government authorities directly involved in COVID-19 related medical and administrative interventions on a strictly need-to-know basis and limited in scope only to their direct work.
Global use
China and South Korea have been using similar contact tracing applications that have helped them flatten the curve. Others like Singapore, Israel and Australia have also launched contact-tracing applications, which are open source. “For a country of our size and complexity, we needed an app that not only does contact tracing but also helps in identifying hotspots that can be sanitised, and containment measures can be taken on time to prevent spread of the virus,” explains Singh.
All countries, including India, have adopted a centralised approach. “The government must publicly explain the reasons behind the design choices of the app. For instance, why did it adopt a centralised model where data is uploaded to a government server instead of a decentralised one where data is stored locally on the device,” says Mukhopadhyay.
Switzerland’s Swiss Federal Institute of Technology Lausanne and ETC Zurich have been the first to launch a product called SwissCovid, based on technology provided by Apple and Google. This application relies on a decentralised approach, which helps make user choice paramount in deciding what information to share and how it can be used.
Joshi says currently only the app code is released for Aarogya Setu. “The server code (where much of the decryption and privacy-sensitive functions happen) is still not public. Since this is a centralised app, the server code needs to be public to understand more fully how the app is functioning,” he says.
