The Indian government has said that its contact-tracing app Aarogya Setu \u201cby design\u201d fetches the location data of its 90 million users and allows them to view the concentration of people who have tested positive for the coronavirus in their vicinity.<\/p>\n\n\n\n
New Delhi issued the statement after France-based security researcher Baptiste Robert found what he argues are design flaws and privacy issues.<\/p>\n\n\n\n
The government said it has always disclosed that it fetches users\u2019 location data, a feature that critics say falls short of the privacy protections offered by similar technologies, including the joint project run by Apple and Google<\/a>.<\/p>\n\n\n\n Aarogya Setu\u2019s privacy policy says<\/a> the app \u2014 in addition to collecting location data of a user at the time of registration \u2014 also \u201ccontinuously collects your location data and stores securely on your mobile device a record of all the places you have been at 15-minute intervals.\u201d The app uploads this data to its server along with the user\u2019s digital ID if they test positive for COVID-19, or self-declare seeing symptoms that indicate that they might be infected with the infectious disease, it says.<\/p>\n\n\n\n Collecting location data is a complicated subject, regardless of the good intention of its developers and operators. On Monday, Google <\/strong><\/a> and Apple banned the use of location tracking<\/a> on their coronavirus-tracing technology.<\/p>\n\n\n\n While some developers have argued<\/a> that they need access to location data to track how outbreaks move and identify hotspots, privacy advocates have cautioned that if this data ever gets exposed, it could ostracize those who are affected.<\/p>\n\n\n\n Robert\u2019s other concern is that Aarogya Setu, which was launched early last month, allows anyone to view the concentration of people in 500 meters to up to 10 kilometers who are either suspicious they have coronavirus, or are certain that they have the disease. He told TechCrunch that he was able to develop a script and view similar data for any nook and cranny of the world\u2019s second most populous nation.<\/p>\n\n\n\n He said the government, which introduced a nationwide lockdown in late March, could have kept the radius limited to 500 meters.<\/p>\n\n\n\n In response, New Delhi\u00a0said<\/a>\u00a0that its system is designed in a way that would prevent any script from making bulk requests. Additionally, it said, \u201cgetting data for multiple latitude and longitude this way is no different from asking several people of their location\u2019s COVID-19<\/a> statistics.\u201d<\/p>\n\n\n\n \u201cAll this information is already public for all locations and hence does not compromise on any personal or sensitive data,\u201d the response said.<\/p>\n\n\n\n Some people argued today that at a crisis like this, when thousands of people are dying, these \u201cflaws\u201d were the least of their concerns and that the app served a much greater purpose. But Aarogya Setu, which has amassed 90 million monthly active people in less than 35 days, has also ruffled some feathers for the way it is being scaled up. New Delhi said<\/a> earlier this month that all government and private sector employees need to have this app installed on their smartphones.<\/p>\n\n\n\n