India’s contact tracing app tops 100 million users in 41 days

As most countries across the globe scramble to build an app to trace the spread of coronavirus, India’s solution is growing at an unprecedented scale — despite being dogged by privacy concerns.

New Delhi’s contact tracing app, called Aarogya Setu, has reached 100 million users in 41 days since its release. A representative at think-tank Niti Aayog told TechCrunch that this 100 million figure represents unique users — and not just those who had merely downloaded the app.

The app, available on Android and iOS, allows people to self-assess whether they have caught the infectious disease by answering a set of questions. It then uses this information to alert users if they have come in contact with someone who might be infected. (It’s also available for feature phone users through an IVR system.)

Aarogya Setu, which means healthcare bridge in Hindi, also delivers updates on India’s testing efforts to fight the coronavirus pandemic and tips to stay safe.

But the app has also raised concerns from privacy advocates and security researchers. The app stores location data of users when they sign up and logs detail of those who have reported facing symptoms of the disease. New Delhi has dubbed this as a feature — even as this centralization approach is in stark contrast with how smartphone vendors Apple and Google are tackling this.

Aarogya Setu is also not open source, which means that independent researchers can’t audit the code and find any flaws in it.

Ajay Prakash Sawhney, secretary in the ministry of electronics and information technology, said in an interview with Indian daily Business Standard that the government has not made the source code of Aarogya Setu public because it feared many will point flaws in it and overburden the staff overseeing the app’s development.

“If I open up my source code, and say, some 50,000 people start criticizing it, raising issues every day, we will have to spend too much time reacting to those. We might do that for all in due course, but right now we are planning to open it up to some of the top cybersecurity experts in the country,” he said.

There are some other concerns, too. Singapore is relying on its contact tracing app, called TraceTogether, for disease control but not using it to enforce lockdowns. Aarogya Setu, in contrast, retains the flexibility to do just that, or to ensure compliance of legal orders and so on, according to New Delhi-based digital rights advocacy group Internet Freedom Foundation.

Additionally, Aarogya Setu, which was launched as a voluntary app, is now mandatory for those who wish to travel with Indian railways. In Noida, at the outskirts of New Delhi, those found without the app installed on their phone could be fined or sent to jail, the local authority said earlier this month.

“Aarogya Setu is an important step in our fight against COVID-19. By leveraging technology, it provides important information. As more and more people use it, its effectiveness will increase. I urge all to download it,” a quote attributed to Indian Prime Minister Narendra Modi appears on the homepage of the app.

The confirmed coronavirus caseload in India, which ordered one of the world’s most stringent lockdowns in late March, has risen steadily in recent weeks. More than 71,600 confirmed infections have been reported to date, with about 2,320 confirmed dead.

In a televised address on Tuesday, Modi unveiled a $266 billion stimulus package to help the nation’s stalled economy recover.