Aarogya Setu comes clean amid its privacy issues

After the government made it mandatory for every organisation to implement the download of Aarogya Setu app, its security issues' debate rose again. Even Rahul Gandhi posed a question yesterday:

The Arogya Setu app, is a sophisticated surveillance system. It is outsourced to a private operator, with no institutional oversight. This raises serious data security and privacy concerns. Technology can help keep us safe, but fear must not be leveraged to track citizens without their consent.

Aarogya Setu is India's very own mobile tracking app. National Informatics Centre (NIC) of the Ministry of Electronics and Information Technology (MeitY) developed the app. It uses GPS and Bluetooth technology to track COVID-19 infection. However, ever since the government launched the app, people have raised questions regarding the data privacy of users. We did it too.

But now the Government has come out clean. In a twitter post-video, it said:

User’s privacy and data security are the keystones of @SetuAarogya App. No personal information is exchanged post the registration. Thus, all processing of contact tracing and risk assessment is done in an anonymised manner. Watch this video to know more! @PIB_India@PMOIndiapic.twitter.com/z4Le23ctFN

— MyGovIndia (@mygovindia) May 4, 2020

How safe are we on the Aarogya Setu App?

Well, here is how the app works.

A user downloads the Aarogya Setu app. Then the app asks to fill mobile number and other personal information while registering. Even the information that the app asks is simple. It asks whether you have travelled in the past few days or do you feel any COVID-19 symptoms. Then the app encrypts the data and stores it on the server.

Once the user registers successfully, the app generates an ID. Then it links the ID to the mobile number. The video said that the servers on the app store data for 45 days only. Even on the phone, it stores it for 30 days only. Also, only for patients who have tested positive, the server keeps data for 60 days.

After that, a user has to re-fill his/her data in the app. And when another person who also has the app installed comes near the user, it just gives a warning. Even here, the app does not share any personal information.

Now, if a person was a high-risk patient or the app classified it as so, the app will not send any information to the servers. The government added that they will only use the data to administer necessary medical interventions. No third party has access to the data.

Let us know what you think in the comments.