Update (6:31 pm): The government of India issued a press release, announcing the launch of Aarogya Setu. Arnab Kumar, the Program Director of Frontier Technologies at NITI Aayog, confirmed its authenticity to MediaNama. As per the press release, the app has been developed through a public private partnership (PPP) under the guidance of National Informatics Centre. Kumar refused to tell us who the private partners for this app are. The app has “privacy-first by design and as an essential element”.
The app was developed by developed by National Informatics Centre (NIC). This might be the CoWin-20 app that NITI Aayog was developing. NITI Aayog refused to comment whether it is the same app and which companies were involved.
The government is racing to trace contacts of COVID-19 positive people, especially as the Health Ministry has identified 20 existing and 22 potential “hotspots” of the virus in the country. At the time of publication, 1,965 had been diagnosed with the virus and 50 people had died because of it, according to the Health Ministry. Authorities are prepping for Stage 3 (community transmission), even though the government has maintained that community transmission of the virus has not taken place yet.
Other countries, such as Singapore, have developed similar contact tracing apps to contain the pandemic and its spread through community transmission.
A close look at the app
MediaNama tested the app on iOS and here are our observations:
- Uses Bluetooth and location services: The app recommends that device location and Bluetooth be always switched on. For some reason, the app also wanted us to allow it to connect to Bluetooth accessories. In settings, the app says, “Accessed by GoI only to enable relevant and timely medical intervention for COVID-19”.
- Only mobile number is compulsory for contact tracing: Giving a mobile number is must for “contact tracing”, but details such as name, age, gender, profession (restricted to essential services such as healthcare workers, law enforcement, delivery, etc.), and international travel history/contact with COVID-19 positive patients are not.
- On testing positive, advisory sent to all registered user the infected person was in contact with: The mobile number will be used to trace back all the active devices that were in close radius of the person in the last 14 days. If someone tests positive, all such contacts will be sent an advisory on whether they need to self-isolate or get themselves tested. It is not clear what kind of personal information will be shared in the advisory.
- Self-assessment test can easily be manipulated: The app also allows you to take a self-assessment test through a chat bot. Apart from our phone number (to get the OTP), we did not submit any personally identifiable information and were still able to take the test. Depending on your gender, age, symptoms, medical history, and potential exposure to the virus (as a healthcare worker, or via international travel, or through proximity to a known COVID-19 patient), the app evaluates your risk and recommends if you need to isolate yourself, log temperature, or get tested immediately.
***Update (6:31 pm): Updated with press release from the government.
***Update (4:48 pm): Prashant Tandon, the co-founder of 1mg, has categorically denied the involvement of the company in the development of Aarogya Setu. The story has been edited accordingly to reflect this. The headline has also been updated. Originally published on April 2 at 3:09 pm.