Thread by @medianama

Mega thread on #AarogyaSetu 👇

1/n The Indian government has made Aarogya Setu contact tracing app mandatory for all employees (public & private) +for people living in Containment Zones. Failure to download it might violate MHA guidelines
medianama.com/2020/05/223-co… +

2/n Even if you aren't in a situation where #AarogyaSetu is mandatory, govt has authorised state govts/local authorities to make guidelines more restrictive. CISF is already mulling making the app mandatory for passengers at airports and metro stations.
medianama.com/2020/04/223-ci…

3/n Even before the government mandated the use of #AarogyaSetu, Prasar Bharti, Central Armed Police Forces, Zomato and Urban Company directed employees/contract workers to download the app.
medianama.com/2020/04/223-zo…

4/n There around 500 mn mobile internet users, 400+ mn smartphones. The moment #AarogyaSetu crossed 75+ mn downloads, we knew that they wouldn't want to give up an opportunity to have such a large captive user base, collect data on them, and potentially build a social graph.

5/n #AarogyaSetu, launched quietly on April 2, uses Bluetooth to track if a user came into contact with another user. It uses location to track where all a user has been. It is therefore an app that violates privacy because of all the data it collects. medianama.com/2020/04/223-aa…

6/n the effectiveness of #AarogyaSetu is questionable:it relies on self certification to indicate health status. That can be faked.
It relies on bluetooth to figure out contact, but 2 people on diff floors of an apartment building can be shown as being in contact via bluetooth

7/n As per #AarogyaSetu terms of use, the govt cannot be held liable for the app’s accuracy. Thus no accountability. Personally identifiable info collected is stored centrally on govt servers.

It's not clear who is liable for data leaks or theft. medianama.com/2020/04/223-aa…

8/n #AarogyaSetu uses a static ID to anonymise your device ID, which has raised significant privacy concerns in the cybersecurity world. Apple-Google’s proposed contact tracing API for instance, will offer a dynamic ID that’ll change every 15 minutes. medianama.com/2020/04/223-ap…

9/n It's also not clear what kind of anonymisation protocols are being used here. We don't know if the data collected by the government is truly anonymous.

The government hasn't open sourced the app, so it cannot be tested by independent security researchers.

10/n #AarogyaSetu provides no option to de-register/delete your account. Doesn’t allow users to log out. “Uninstalling doesn’t necessarily lead to de-registration,” Prof. Bhaskaran Raman from IIT Bombay said during @medianama discussion on Aarogya Setu.  medianama.com/2020/04/223-na…

11/n It's possible that #AarogyaSetu isn't very effective on iPhones. French govt has urged Apple to ease restrictions that don’t allow apps to send packets of data over Bluetooth while running in background. Not clear how Aarogya Setu works around this.  medianama.com/2020/04/223-fr…

12/n #AarogyaSetu has already witnessed a vulnerability that released users’ precise location data to Google after the self-assessment process. medianama.com/2020/04/223-aa…

13/n one of our major concerns with #AarogyaSetu is that of scope creep. It plans to offer telemedicine video consultations + personalisation in terms of data collection. It might also function as the “initial building block for India Health Stack”. medianama.com/2020/04/223-aa…

14/n Scope creep (adding more services) creates allows data to be linked together for profiling, the expansion of purpose and potentially data access, and greater privacy risks for individuals. It then doesn't just remain a contact tracing app.

15/n we have compiled a list of recommendations for improving #AarogyaSetu from a privacy perspective here
medianama.com/2020/04/223-na…

16/n We also compiled a list of issues with the #AarogyaSetu app from a privacy perspective here medianama.com/2020/04/223-na…

17/n it's important to note that #aarogyasetu doesn’t have a sunset clause. An app that tracks your location and who you're in contact with violates your privacy, and even in these times, should have a limited life-span.

18/n It's this worrying that the Indian govt has mandated it for the entire working population of India AND plans to use the app for next 1-2 years, according to Information and Broadcasting Minister Prakash Javadekar.

https://twitter.com/ANI/status/1256483895073222659

This needs judicial intervention.

We, as a media publication that believes in safeguarding basic human rights, have also also endorsed @internetfreedom's joint representation to the government against making the use of Aarogya Setu mandatory for workers. You can read more about it here: internetfreedom.in/45-organizatio…