Aarogya Setu App Privacy Concerns: How Worried Should We Be About Our Privacy?

Indian government is pushing for the use of the Aarogya Setu app as one of its efforts to curb the spread of Coronavirus in the country.

India¡¯s own COVID-19 contact tracing app has hence been mandated for use by many workers, both private and government alike. With this increased use though, come increasing concerns of data privacy.

Aarogya Setu App

The most recent of these privacy concerns were raised by an ethical French hacker by the name of Robert Baptiste aka Elliot Alderson. In a tweet, Alderson mentioned that he had found a security issue in the app and that ¡°the privacy of 90 million Indians is at stake.¡±

It did not take long for the tweet to catch the eye of Aarogya Setu app developers. The team contacted Alderson shortly who disclosed the security loophole to the team. The team has now released a statement verifying the cause for concern.

Hi @SetuAarogya,

A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private?

Regards,

PS: @RahulGandhi was right

¡ª Elliot Alderson (@fs0c131y) May 5, 2020

First and foremost, the team clarifies that no personal information of any Aarogya Setu app user has been proven to be at risk by Alderson. Building on this, a new statement by the team at Aarogya Setu mentions two concerns raised by Alderson and subsequently answers them.

One was that the app fetches the user location at various points of use and another was that the users are able to change the stats on home screen by changing the radius and latitude-longitude in the app through a script.

The team at Aarogya Setu clarified that the app is meant to track the location at various points, as mentioned in its privacy policy. As for the second concern, the team maintains that the radius parameters are fixed for one of 5 values and cannot be changed outside of that.

Statement from Team #AarogyaSetu on data security of the App. pic.twitter.com/JS9ow82Hom

¡ª Aarogya Setu (@SetuAarogya) May 5, 2020

But is that justification enough for all the privacy concerns around the app? Not really.

Post the response by the Aarogya Setu app team, Alderson took to twitter again to poke the developers, posting ¡°Do you know what triangulation is @SetuAarogya?¡± It is highly likely that another security issue will soon be raised by the ethical hacker.

Alderson is not alone

A new report by Edelman sheds light on the level of trust people are placing on their national government during the COVID 19 pandemic. ¡°The public is relying on government to protect them in a manner not seen since World War II,¡± says the report.

The study shows the notion to be prevalent across activities. People are trusting their governments to provide economic relief, restore normalcy, contain COVID-19, and inform the public while being guided by their best interest every step of the way.

Reuters

Since the Aarogya Setu app is a form of the gathering and imparting information to public, it can be understood that the people of India are placing all their trust on the app and privacy concerns around location tracking and data procurement are not being paid any heed.

Edward Snowden, founder of WikiLeaks, warned of this. As per Snowden, all such digital contact tracing measures being used by the governments across the world will go on to become surveillance systems and will have a huge impact on the privacy of the users. He warns that such apps/ measures will not just stop existing once the pandemic is under control.

Google and Apple, who are now working on a similar COVID-19 tracing app, had to recently reassure of the same. Engineers from both the teams confirmed that the upcoming app will be shut down after the pandemic is over. Maybe an assurity like this is what is needed to have greater privacy faith in the Aarogya Setu app, too.