Concern over fall in penetration in world's 'largest' contact tracing app Aarogya Setu

By Arjun Kumar, Prerna Mukharya, Rohit Mehta, Ritika Gupta, Anshula Mehta*
The coronavirus pandemic has prevailed globally for close to a year, with India living in the throes of the crisis since March. To trace, isolate and treat cases of infection, the Aarogya Setu app was developed, and launched on April 2, 2020, by the National Informatics Centre at the Ministry of Electronics and Information Technology (MeitY), Government of India.
There have been more than 10 million cases of Covid-19 in India, and the expectation was, there would be surge expected in an imminent ‘winter wave’ of the pandemic. In this light, the Center for ICT for Development (CICTD) at the Impact and Policy Research Institute (IMPRI), New Delhi, organised a panel discussion on strengthening the Aarogya Setu app to understand how it is functioning in the current scenario and how it can be improved to address in case of a spurt in Covid-19 cases.
Abhishek Singh (CEO, MyGov, president and CEO, NeGD; MD and CEO, Digital India Corporation [DIC], Government of India) claimed that the Aarogya Setu app as the largest contact tracing app in the world and outlined its functions. He said that the prediction of emerging hotspots through the app utilises data science and artificial intelligence algorithm and the information is shared with district administration and health authorities for action and prevention.
Singh, however, admitted that the number of downloads of the app, and places where it is used has come down, hence there is a need for greater awareness to ensure that complacency and laxness are avoided until the coronavirus has been overcome, and that Aarogya Setu itself promotes a communication campaign to drive behavioural change on preventive measures such as the use of masks.
He remarked that while doctors and frontline health workers’ contribution has been much more but the app has played a role in alerting people, and post-lockdown it has enabled businesses that were opening up, and enabled an open API feature for employers to check the health status of employees.
He emphasised the ‘highest standard of privacy’ of the Aarogya Setu app, citing that while other apps have faced hacks, no hacker has been able to prove that the privacy of any user has been violated through Aarogya Setu and that only the information of those who are infected is shared with the authorities.
Singh continued, the only way to tackle challenges is through collaborations and trust. It was possible to build the app in three weeks only because the government, entrepreneurs, technical minds and academia joined hands to work towards a scalable, robust and secure product, with new features being added and glitches being fixed over time.
He added that the app would succeed only if more people use it as this would help in predicting hotspots accurately, and it would emerge as a tool in ensuring that the pandemic spread is limited.
Singh contended, India’s Covid-19 fatality rates were among the lowest and tests per million among the highest in the world, and laid out the forthcoming challenges for the app-building in multiple languages, having a voice interface, and addressing the access to devices.
Ramanathan Ramanan (mission director, Atal Innovation Mission [AIM], NITI Aayog), chair for the session, appreciated the spirit of collaboration extended by various government departments, MeitY, MyGov and others in strengthening collaborations between various ministries and departments, and also private and public sectors and NGOs – the combination that brought Aarogya Setu into existence – and called it the need of the times.

He said, such apps, through the rapid convergence of communication, computing, sensor technology, and the ability to process large amounts of data through data mining, bring some sense of normalcy in times of uncertainty, and support to such apps should be ensured. He remarked that although privacy is important, the ‘greater cause’ has to take over privacy constraints, and the need for safety and protecting lives should be balanced with making the app secure and private.
Ramanan went on to call the Aarogya Setu app a ‘gamechanger’, not only for the current pandemic, praising its complex features that were implemented with simplicity. Referring to Prime Minister Narendra Modi’s call for ‘Atmanirbhar Bharat’ and its five pillars – Economy, Infrastructure, System, Demography and Demand – he highlighted the innovation surrounding the app and its ability to extend simple solution to the masses.
Stating that Aarogya Setu was developed by entrepreneurs who assisted from the private sector, Ramanan remarked that Covid-19 has been a watershed moment in bringing out the power of startups in the future of the Indian economy, and the power of innovation, and attributed the spurt in innovation in the country to the ecosystem of entrepreneurship and innovation created by government initiatives.
He suggested a possible new area for the app in being able to trace contaminating water bodies in the country; just as it traces those infected with the coronavirus, the app could similarly trace infection due to a particular source of water in the country, and highlighted that multiple directions of usage can come up for the Aarogya Setu app.
Amit Dubey (founder, India Future Foundation; National Cyber Security Expert) outlined certain issues with the app that had emerged in his own study of the same. There was an issue with identity access management wherein client side verification could be manipulated easily, location could be changed, and there were other concerns around SSL pinning, but these issues were fixed.

An IMPRI presentation said, the app may have millions of downloads, but India is digitally divided, with disparities in rate of smartphone penetration, internet access, connectivity

He emphasised on scalability, concerns over localisation, and that there shouldn’t be possibility of seeing others’ data. He complimented the app for achieving credibility. He added that while there had been many attacks on apps worldwide and data had been stolen, no such data breach on Aarogya Setu had been reported.
Dubey highlighted the triad of confidentiality, integrity and availability for information security and stated that it was important to protect the app from attacks. He explained security provisions as the security of the server and of the client, and that data should not be compromised, in a simplified manner.
He spoke of accessibility and network as challenges for the app to work upon. He shared that work is ongoing on ensuring accessibility and getting Aarogya Setu as an inbuilt app in more feature phones was one such way.
Dubey also brought up support from different operators as an issue, as well as roadblocks in WiFi solutions and electrification at airports and railway stations, and remarked that challenges will remain as there is a difference between testing and real situations, and scenarios cannot be simulated completely. 

Kazim Rizvi (founding director, The Dialogue) stated that over the past 8-9 months, there had been significant effort to improve and enhance the way the app functions, and also to ensure that security and privacy concerns were addressed. 
Comparing Aarogya Setu with other apps of its kind, he remarked that it is among the top three contact tracing apps globally, taking into account its effectiveness to trace, test and isolate, and that India could take a leadership role through the app and inform other countries on how to carry out contact tracing. He highlighted that the app was created in three weeks, was robust and had never been hacked, and complimented the fast pace of its development.

 

Rizvi stated that the app data is stored on the government servers in encrypted format, abiding to security standards and changes have been made to methods of data collection since phase 1 of the app (April 2020), and it does not collect personal data of more than 30 days. A user ID is created at registration for each user, hence duplication is minimised and since the ID is anonymised, one cannot be targeted on the basis of ID.
He said that the data access and knowledge sharing protocol specified protection of privacy of users of the app and effective means of sharing personal and non-personal data for handling the pandemic, and that there are efforts to specify granular details of modalities of transferring data between different stakeholders.
On the point of the privacy discourse, he remarked, the government had been transparent in its purpose of data sharing. He added, the app would play a critical role towards preventing the outbreak of a future pandemic through the anonymised research information that has been collected. He suggested that the government could give this anonymised data to universities, to start understanding how India responds to an outbreak
As for the winter wave, Rizvi suggested, it was important to start looking at insights from the app. He added that it was a great example of India being able to export its technical expertise, as opposed to importing it, subserving the ideas of ‘vocal for local’ and ‘local to global’.
He suggested that the app should try to work in offline areas, with a simple, basic version for low connectivity areas, as it would add to the user base, and the success of the app would depend on the number of users. He highlighted that the government should continue working on enhancing privacy and security of user data and the app, and increase user trust.
Rizvi suggested that schools and universities could study Aarogya Setu as a case of collaboration and ‘thinking on our feet’, and that it would be good case study for Atmanirbhar India.
A presentation on behalf of IMPRI outlined the context in which the app originated, highlighting that India was one of the first countries to respond through technology to the pandemic, with the app having 50 million downloads in 13 days, and over 160 million total. 
The presentation touched upon issues surrounding the app, viz. privacy concerns, accessibility, the app not being open source, and the challenge of providing pandemic relief and mitigating loss of human life through the app, highlighting that while the app may have millions of downloads, India does remain a country of the digital divide, with disparities in the rate of smartphone penetration, internet access and connectivity, and stable electricity. It was added that the app needs to look into how tracing can help towards mitigating loss of human life due to COVID-19, and how support can be better extended to those in need during the pandemic. 
The possible areas of exploration that were discussed included expanding existing functionalities of the app and making them more effective, utilising technologies like a Modular Open Source Identity Platform (MOSIP) and ways of possibly integrating National Digital Health Mission with the app for a more robust functioning and delivery. 

The app could also be utilised for educational institutions as and when they slowly open up and restore offline functions, and finally, vaccine delivery and count could also be explored through the app, for effective and targeted service, along with effective usage in smart cities.  
---
*With Impact and Policy Research Institute, New Delhi