ISAS Briefs

Summary

The Indian government’s new COVID-19 mobile application, Aarogya Setu, has emerged as a key tool in helping the government curb the spread of Coronavirus. However, its development and use has stoked fears of whether the data collected will be used for the purposes claimed.

To contain the domestic spread of the Coronavirus, the Indian Prime Minister Narendra Modi has impelled fellow Indian citizens to download a new smartphone app, Aarogya Setu, which was custom-built by his government. The app has been designed to help citizens identify their risks of contracting and spreading the virus. Within hours, the Indian public responded and Aarogya Setu became India’s fastest downloaded app with nearly 100 million downloads and counting.

The app was developed by the National Informatics Centre under India’s Ministry of Electronics and Information Technology and is currently available in 12 Indian languages with plans afoot to expand coverage to all 22 languages. With the larger public, critics have also responded chastising the government for developing the app that furthers their interests at the expense of individual rights, namely, privacy. Specifically, they claim that the Modi government is intent on using the pandemic to erode privacy and rights.

Aarogya Setu’s proponents argue that the app provides the government an indispensable tool in identifying new COVID-19 clusters or ‘hotspots’ and acting to contain the spread in those affected areas. The app is designed to keep track of users that an individual comes in contact with, and then alerts app users if any of these contacts test positive for COVID-19. Given the vast geographies across India, officials claim that the app allows healthcare workers to isolate those who have shown symptoms given expected gaps in testing. The app, in other words, helps government officials identify who to test and where to test. Government figures estimate that around 13,000 users of the app have tested positive for COVID-19 which has allowed healthcare officials to use data from the app to assess an additional 60,000 people who could have been exposed to the virus with isolation and quarantine suggested for some.

India’s new COVID-19 app is unique in several ways. Many countries are currently exploring different methods to track and limit the mobility of citizens but are doing so through either bluetooth or global positioning system methods that notify users if they are around someone who has contracted COVID-19. Aarogya Setu, however, is a far more sweeping app; it is able to track users’ movement through bluetooth and geographic information system services but it goes further by assigning each user a colour coded tag that displays the risk of possible infection. Going further, the app also provides access to telemedicine options, pharmaceutical and available diagnostic services.

Despite these ostensible advantages, risks exist to downloading and using the app that privacy advocates and other critics have voiced. Once the app is downloaded and used, it is able to collect data of that particular user, his/her movement and location. Questions loom around who owns and uses that data. Since India has no data protection law, in effect, now thorny questions around data ownership and usage become risks given weak rules around data collection. The app’s design is also not known outside, but only to a few within the government who conceived it, which means that access to the data is restricted. Critics have also expressed worries since the app is not open source which implies that the code designed is not available for scrutiny by outside developers who could ascertain whether or not the data collected is restricted and used for stated purposes. Other countries have avoided this situation by making the design of their COVID-19 apps public; the United Kingdom’s National Health Service and the Singapore government, for instance, have opened up the source code of their own contact tracing apps for public scrutiny.

These questions acquire new importance since the Indian government is now mandating the download and use of Aarogya Setu. So far, at least one million people, from the public and private sectors, have been ordered to use the app or else face fines or potential jail time. This coercive approach sets India apart from other countries that are nudging citizens to download similar tracking apps while working with telecommunication companies to gather location specific data from users. Indian critics also fear that users will be forced to retain the app once COVID-19 ebbs since there is no public sunset clause that disbands the service despite assurances from the government that data collected through the app will be deleted regularly. Officials from the National Institution for Transforming India (NITI Aayog) argue that such privacy concerns are overblown and data collected through the app is only used through the user’s consent or once an individual tests positive and that the source code of the app will be made public soon.

Privacy concerns are front and centre for critics just as the government appears to be on the cusp of passing a data protection bill that gives it considerable power to collect, access and hold certain kinds of data. Opposition parties fear that the pandemic has hastened the government’s intent to entrench a powerful ‘surveillance state’ with Aarogya Setu being the latest cog in that new regime. Without a coherent legal framework and design around the app that strikes a balance between privacy and disease containment, this fear is likely to come true.

. . . . .

Dr Karthik Nachiappan is Research Fellow at the Institute of South Asian Studies (ISAS), an autonomous research institute at the National University of Singapore (NUS). He can be contacted at isaskn@nus.edu.sg. The author bears full responsibility for the facts cited and opinions expressed in this paper.