Virus tracing app raises privacy concerns in India

NEW DELHI — As India enters an extended coronavirus lockdown, the government is actively pursuing contact tracing to help control infections. At the heart of the effort in the country of 1.3 billion people is a smartphone app that evaluates users’ infection risk based on location services such as Bluetooth and GPS.

In April, India launched the Aarogya Setu app, which helps people identify whether they have been near someone who tested positive for the virus. Since then, the app has been downloaded more than 90 million times in a country with a smartphone user base of about 500 million. To popularize it, a campaign featuring Bollywood celebrities was launched.

But the monitoring technology has prompted a raft of questions about privacy, security, and potential data breaches — and whether it compromises civil liberties and gives the government snooping powers.

“Aarogya Setu is a form of surveillance and inflicts tangible privacy injury,” said Apar Gupta, executive director of the Internet Freedom Foundation.

In this Thursday, May 7, 2020 photo, an Indian man uses Aarogya Setu app on his mobile phone in New Delhi, India. As India enters an extended coronavirus lockdown, the government is fervently pursuing contact tracing to control infections. At the heart of the effort in the country of 1.3 billion people is a smartphone app that evaluates users’ infection risk based on location services such as Bluetooth and GPS. (AP Photo/Altaf Qadri)

On Wednesday, Ravi Shankar Prasad, a senior minister, said the app was “robust” in terms of privacy protection and data security. The government also said no data or security breach had been identified with the app after concerns about potential security issues were raised by tech experts.

Mobile tracing apps to help contain infections have already been developed in the U.S., China, Singapore, Australia, and many European countries. Other countries are scrambling to deploy their own smartphone tools. But in India, the technological intervention has exacerbated concerns like in no other country.

India still doesn’t have a comprehensive data privacy law to protect people’s personal data. What is more alarming, experts say, are sweeping orders that make the use of the app mandatory for many Indians.

The government requires that Aarogya Setu app be used by all workers, both private and public, and by members of the military. Installation of the app is also mandatory in regions declared as containment zones. Stranded Indians abroad who wish to be repatriated also need to install it on their mobile phones before entering the country.

Now, the police are stepping in.

In Noida, a burgeoning satellite town half an hour’s drive from New Delhi, police have made it a punishable offense if people don’t use the app.

Millions of Indians, many of them oblivious of any privacy concerns, have enthusiastically downloaded the app at Prime Minister Narendra Modi’s urging. Some were encouraged by their employers who said they cannot work without the app.

“It will be very good if almost everyone uses it,” said Umesh Ram, a food delivery rider.

But some are cautious.

Satish Kumar Rastogi, an electrician, recently deleted the app from his phone. “Imagine if I put wrong details by mistake, then it will give wrong information about me,” Rastogi said.

The government has not said if it plans to impose fines on people who don’t install the app, but hopes that if infections are tracked with the help of the app, more people will be able to resume at least part of their normal routines. India is the hardest-hit country in South Asia, with over 46,000 confirmed coronavirus cases and more than 1,500 deaths.

Critics have raised concerns about the possibility of breaches of the database and fear the monitoring technology could be used to collect personal information. They also say the app is vague about which government departments will have access to the database.

“The app needs some independent oversight mechanism,” said Anirudh Burman, a scholar at Carnegie India.

Most privacy rights organizations said if the government makes the app’s source code publicly available, it will increase transparency.

The monitoring technology is also opposed by the main opposition Congress party. Last week its leader, Rahul Gandhi, called the app “a sophisticated surveillance system.”

Abhishek Singh, the chief executive of MyGovIndia, which developed Aarogya Setu, said the app “will not reveal anyone’s personal details” and the “data in the app is completely secure.”

“No third party will be given access to the data,” Singh said. “The app is secure and no one should be worried about privacy concerns.”

India is not new to privacy violations and data breaches. In 2018, a controversial billion-member biometric database called “Aadhaar” was breached, putting the identity details of more than 1 billion citizens at risk.

Similar cases of data breaches have been reported during the pandemic.

Many Indian states published quarantine lists on their official websites which included names of people who were suspected of being virus carriers. The app, experts say, presents similar concerns but on a much larger scale.

Apart from the privacy concerns, there is little evidence that the app will be effective without widespread virus testing, which India lacks.

India is testing around 75,000 samples daily. Health experts say this number is not enough.

A recent study by epidemiologists at Oxford University estimated that 60% of the population in any given area need to use a contact tracing technology, combined with other measures such as broader testing and the quarantining of vulnerable people, for the app to be able to contain the virus.

“India has to couple contact tracing technology with far broader testing. Testing is the primary solution to contact the infections,” said Dr. Anant Bhan, a public health and bioethics expert.