Tech giants Apple and Google, which are jointly developing an app for contact tracing to contain the spread of coronavirus, on Monday declared a “privacy first” approach saying the new app will not collect any location data. The plan, however, could turn out to be a party pooper for the Indian government's COVID-19 tracking app, Aarogya Setu, which has already run into rough waters with cyber security experts and privacy advocates questioning the app's security practices.
Prior to easing the lockdown restrictions from Monday, the Centre had mandated that all public and private sector employees should download the app. The app, developed by MyGovIndia, a citizen engagement platform founded by the Indian government, continuously collects data on the location of the user and cross-references it with the Central government database to understand whether the user has come into contact with an infected person.
However, the latest declaration from Google and Apple, whose operating systems fuel almost 99 per cent smartphones globally, has put the future of Aarogya Setu in a spot.
According to the new details that emerged on Monday, Apple and Google have now made it clear that only government agencies—preferably at the national level, Google and Apple say, though they note they're willing to work with state and regional authorities—will be granted permission to the feature's application programming interface. If those government-run apps want access to Apple and Google's Bluetooth-based system, they won't be allowed to collect location data, and must ask for consent before collecting information on a user's proximity to others. They will need permission to upload any information from the phones of Covid-19 positive people as well.
They also laid out some requirements for apps that use the system, including that they will not run any ads. To keep users anonymous from each other, and anyone else attempting to keep tabs on them, the data broadcast and collected via Bluetooth will be encrypted, and the phones’ identifiers will change every 15 minutes or so.
The Bluetooth system that Apple and Google are building into both Android and iOS will let health care authorities track potential encounters with Covid-19. The two rival companies are working with public health authorities and university researchers to build groundwork into mobile devices for apps that would notify people if they were recently in proximity to someone who was infected. The two companies plan to release the system in mid-May.
Explicit user consent will be required before the tool starts collecting data on one’s operating system. An individual diagnosed with COVID-19 would enter that information into a health agency app and consent to submitting a record of other phones it has been close to, which would be stored on a remote server for 14 days. Any user whose phone appears on that list will receive a notification with information from health agencies about how to self-isolate and monitor for symptoms.
On the other hand, Aarogya Setu, like most contact tracing apps, seeks continuous access to location information for its social movement graph and uses Bluetooth technology to alert people when they come in contact with a Covid-19 positive person.
According to studies, contact tracing apps could be effective only if at least 60 per cent of the population installs it. This explains why the Indian government has gone on an installation overdrive regarding the app.
However, with the new policy mandated by Google and Apple, it needs to be seen how the Centre responds to the situation and how effectively COVID tracking can be put in practise by Aarogya Setu.
