Aarogya Setu Goes Open Source

India's Covid-19 tracking app Aarogya Setu

Indian government amid concerns over the security of the Covid-19 tracking app Aarogya Setu, made it open source with the aim of bringing transparency and improvement in the app.
Complete Coverage: Coronavirus

Crux of the Matter

History of Aarogya Setu
The app’s motive is to monitor the live location and trace the travel history of the user. It also has the health record of the user. As per the Government, Aarogya Setu uses the live location and Bluetooth-based proximity to keep track of an individual. More than 100 million people have downloaded the app so far and 98 % of users use it on Android devices.

In a press release, the Ministry of Electronics & Information Technology (MEITY) said that this app tracked around 9 lakh people related to Covid-19 positive cases and helped find 24% Covid-19 positive cases.

However, the app drew criticism and concerns over data security and Terms of Use from Cyberlaw activists and critics. Internet Freedom Foundation (IFF) was at the forefront while addressing the issue. Software developers and experts demanded the government to allow reverse engineering of the app and to publish the source code of the app.

Government’s Action
The government responded to the concerns and have made the Aarogya Setu an open-source software. As of now, only the Android version of the app has been made open source. It is expected that next week the government will make iOS version of the app open source.

Open source means that anyone can open, analyze, change, and use the original code of the software without acquiring the license to do so to develop a separate derivative software. One just has to acknowledge the owner of the app or the original code. VLC media player, WordPress, Mozilla Firefox, etc are some of the open-source software.

The government has said that this is taken in order to promote transparency of the app. The government has also launched a bounty of ₹1 lakh for anyone who can find loopholes and vulnerabilities in the app.

Problem Solved?
By making the app open source, any software developer will be able to go through the code. The move is expected to help find vulnerabilities and loopholes in the app. One can address the problems by writing fresh codes or suggesting these to the government. Cyber experts have also demanded the government to release the server-side code of the app to address the issue effectively. Moreover, it is too early to say whether this move will address security and privacy concerns.

However, open sourcing the code can also be misused by miscreants in multiple ways. It can make any vulnerability easily transparent to the public at large. Also, others can make copycat apps that redirect user data to their servers.

Other Open Source Covid Tracking Apps

  • Czech Republic government’s Covid-19 tracking App eRouška (eFacemask)
  • Singapore’s TraceTogether Covid App
  • Austria’s Stopp Corona App
  • UK’s NHS COVID-19
  • Australia’s COVIDSafe App
  • A 2008 report by the Standish Group stated that the adoption of open-source software models has resulted in savings of about $60 billion per year for consumers.
  • A 1997 paper on analysis of the hacker community and free-software principles received significant attention in the early 1998 and was one factor in motivating Netscape Communications Corporation to release their popular Netscape Communicator Internet suite as free software. This source code subsequently became the basis behind SeaMonkey, Mozilla Firefox, Thunderbird, and KompoZer.
  • Open Source for America is a group created to raise awareness in the United States Federal Government about the benefits of open-source software. Their stated goals are to encourage the government’s use of open-source software, participation in open-source software projects, and incorporation of open-source community dynamics to increase government transparency.

What does Aarogya Setu App do?

Since the government of India launched the Aarogya Setu App to keep track of the number of Coronavirus cases in India, more than 50 million people have installed the app via Play store and App store. But critics have raised ambiguity over potential privacy breach even as the country combats a pandemic.
Complete Coverage: Coronavirus

Crux of the Matter

How does the App work?
PM Modi in a recent address to the nation asked citizens of India to use the Arogya Setu App. As case numbers of COVID-19 crossed 10,000 in India, PM Modi declared an extension of lockdown till 3rd May.

The app’s main motive is to do live monitoring and trace the travel history of the user. It also has the health record of the user. As per the Government, Aarogya Setu uses the live location and Bluetooth-based proximity to keep track of an individual. The app helps users to do a self-test of coronavirus symptoms. Users will receive an alert on entering a coronavirus hotspot zone. The app also notifies the users if they come in contact with a COVID-19 patient. The security in the app is enhanced and fortified with the help of technology shared by Google and Apple. 

+ve’s and -ve’s
Privacy-focused groups such as the Internet Freedom Foundation (IFF) have raised several doubts regarding the app. Lack of disclosure of the accountability and responsibility of data collection and its security can be dangerous for the privacy of citizens, it said. The legal framework of the app is limited only to the Privacy Policy and the Terms of Use. Using GPS for tracking the location is also against “privacy-focused global standards”. Incomplete disclosure of information and limits of the app can be molded anytime according to the convenience of the government and could be used beyond the purpose it was made, the group said. The report suggests that there should be proper disclosure of everything about the app like Singapore did when it launched one such app to track COVID-19 patients. 

India leads the way in contact tracing for COVID-19: privacy first by design, secure, robust and scalable to billion users. Glad to see Apple and Google joining hands to develop contact tracing on the lines of Aarogya Setu.

Amitabh Kant, CEO, NITI Aayog

The World Bank praised the app and innovative efforts of the Government, which has proved effective in preventing the community spread of the virus. This is for the first time that the government of India has collected health care data on an individual basis. This data has proved to be very effective for the government in taking action and in framing policies to contain the spread of COVID-19.

Going Digital Across the Globe
Countries across the world have developed Apps to keep track of Coronavirus Cases and to keep people safe from infections. China developed the “Alipay Health Code” app to keep track of people infected with COVID-19. Similarly, Singapore developed the TrackTogether App and BlueTrace online portal to keep track of the number of Coronavirus Cases. eRouška named App was launched by the Czech Republic. Ghana launched the “GH COVID-19 Tracker App”. France came up with the “Stop COVID” Application.

  • Since its launch, the app has crossed over 50 million downloads and has a rating of more than 4.5/5. The app broke Pokemon Go’s record to become the fastest to cross 50 million downloads – in 13 days
  • Since launch, the application has also gained suspicion towards privacy breaches and other privacy concerns. When compared to 2 similar apps – TraceTogether by Singapore govt and Private Kit: Safe Paths by MIT – the authority that designed the application “lacks any representation from the ministry of health and family welfare, or any independent involvement of persons with a medical or epidemiological background,” according to IFF’s (Internet Freedom Foundation) paper.
  • Other popular government apps are PMKISAN GoI app, mParivahan app, Ente Ration Card app, AwaasApp, Government eProcurement System, etc.