To contain the domestic spread of the Coronavirus, the Indian Prime Minister Narendra Modi has impelled fellow Indian citizens to download a new smartphone app, Aarogya Setu, which was custom-built by his government. The app has been designed to help citizens identify their risks of contracting and spreading the virus. Within hours, the Indian public responded and Aarogya Setu became India’s fastest downloaded app with nearly 100 million downloads and counting.
The app was developed by the National Informatics Centre under India’s Ministry of Electronics and Information Technology (MEITY) and is currently available in 12 Indian languages with plans to expand coverage to all 22 languages. With the larger public, critics have also responded chastising the government for developing an app that furthers their interests or intent to surveil at the expense of individual rights, namely, privacy. Specifically, they claim that the Modi government is intent on using the pandemic to erode privacy.
Aarogya Setu’s proponents assert that the app provides the government an indispensable tool in identifying new COVID-19 clusters or ‘hotspots’ and acting to contain the spread in those affected areas. The app is designed to keep track of users that an individual comes in contact with, and then alerts app users if any of these contacts test positive for COVID-19. Given the vast geographies across India, officials claim that the app allows healthcare workers to isolate those who have shown symptoms given expected gaps in testing. The app, in other words, helps health officials identify who to test and where to test. Government figures estimate that around 13,000 users of the app have tested positive for COVID-19 which has allowed healthcare officials to use data from the app to assess an additional 60,000 people who could have been exposed to the virus with isolation and quarantine suggested for some.
India’s new COVID-19 app is unique in several ways. Many countries are currently exploring different methods to track and limit the mobility of citizens but are doing so through either bluetooth or global positioning system methods that notify users if they are around someone who has contracted COVID-19. Aarogya Setu, however, is a far more sweeping app; it is able to track users’ movement through bluetooth and geographic information system services but it also assigns each user a colour coded tag that displays the risk of possible infection. Going further, the app provides access to telemedicine options, pharmaceutical and available diagnostic services.
Despite these ostensible advantages, risks exist to downloading and using the app that privacy advocates and other critics have voiced. Once the app is downloaded and used, it is able to collect data of that particular user, his/her movement and location. Questions loom around who owns and uses that data. Since India has no data protection law, in effect, now thorny questions around data ownership and usage become risks given weak rules around data collection. The app’s design is also not known outside save a few within the government who conceived it, which means that access to the data is restricted. Critics have also expressed worries since the app is not open source which means that the code designed is not available for scrutiny by outside developers who could ascertain whether or not the data collected is restricted and used for stated purposes. Other countries have avoided this situation by making public the design of their COVID-19 apps; the United Kingdom’s National Health Service and the Singapore government, for instance, have opened up the source code of their own contact tracing apps for further scrutiny.
These questions acquire new importance since the Indian government is now mandating the download and use of Aarogya Setu. So far, at least one million people, from the public and private sectors, have been ordered to use the app or else face fines or potential jail time. This coercive approach sets India apart from other countries that are nudging citizens to download similar tracking apps while working with telecom companies to gather location specific data from users. Indian critics also fear that users will be forced to retain the app once COVID-19 ebbs since there is no public sunset clause that disbands the service despite assurances from the government that data collected through the app will be deleted regularly. Officials from the National Institution for Transforming India (NITI Aayog) argue that such privacy concerns are overblown and the data collected through the app will be used through the user’s consent or once an individual tests positive; in addition, they have pledged to release the source code of the app soon.
Privacy concerns are front and centre for critics just as the Modi government appears to be on the cusp of passing a data protection bill that gives it considerable power to collect, access and hold certain kinds of data. Opposition parties fear that this pandemic has effectively hastened the government’s intent to entrench a powerful ‘surveillance state’ with Aarogya Setu being the latest cog in that regime. Without a coherent legal framework and design around the app that strikes a balance between privacy and disease containment, this fear will likely come true.