The Aarogya Setu Dilemma
The Indian Government has developed an app to provide efficient COVID-19 contact tracing – Aarogya Setu. The government has made it mandatory as a way to stay safe, but is the app a technological wonder to lower the number of cases or a privacy nightmare lurking in the shadows?
Before we answer the question, we will need to answer a few questions and understand the technology used by the app, the privacy concerns raised, and much more.
Aarogya Setu – The App
Developed under the guidance of India’s National Informatics Center, Aarogya Setu is an app available on both iOS and Android. It was popularised through advertisements on television channels and newspapers. Instructions were given to have it pre-installed on new phones and banks and telecom companies were instructed to broadcast information about the app to all customers via telephone calls, emails, and text messages. The Prime Minister has also taken to Twitter among other platforms to encourage downloads of the app.
Moving away from the marketing of the app, the app was released to trace the origin of people who are diagnosed as contact cases.
Read More About Cybercrime in the time of Pandemic
The Technology
The app uses Bluetooth and GPS to find out a user’s location. The functioning of the application relies on all citizens of India to update their health status when they test positive for the case. Based on the location of people who tested positive, the app notifies users if there are users in a 500 m, 1 m, or 5m range.
Apart from the notifications about cases in the vicinity, Aarogya Setu also acts as a route map to allow the origin’s detection when it comes to contact cases. A three-way handshake is done using Bluetooth when 2 or more people coincide in a particular place.
If someone using the application tested COVID-19 positive, all their contacts who met them would be contacted by the government using the details on their Aadhar card and mobile number used during registration.
While the technology behind the app seems to be good, let us now understand the security provided by the app.
Read More About Is Whatsapp Spying you?
Arogya Setu’s Security
The security of Arogya Setu has been put into question since the initial launch. Aarogya Setu’s privacy policy claims that “user information will be used only by the government in anonymized aggregated data sets”, implying that all data collected by the app will be used only by the government and this data will be sent only after making the users anonymous.
If you have a closer nation, you can find that there is no committee overlooking the data handed over to the government. This proves to be a big breach of privacy that is concerning for Aarogya Setu users. The app asks for almost all permissions from the device and it works only when all of them are granted. In the midst of a pandemic that is strife with political tension, this seems like they’re not concerned with the privacy of their users.
Apart from the handover of data, there are other vulnerabilities related to data being stored, it can also cause concerns raising questions about the usage of the app when there are multiple security concerns. The app claims that all data stored in the app is encrypted, but since Aarogya Setu was never released as an open-source code, it is not possible for ethical hackers to check for vulnerabilities and the validity of these claims.
The worst blow for Aarogya Setu’s already downhill battle against the rising privacy concerns was setback even further by the presence of an ethical hacker who goes by the name Elliot Anderson who is known for previously finding a vulnerability within the Aadhar system. Elliot tweeted that there was a serious security vulnerability present in Aarogya Setu. With his previous issue findings, the makers of the app claim to have had discussions with the ethical hacker, but none of it is made public.
The Verdict
While Aarogya Setu has made quite a few advancements in biotechnology, the biggest concern still remains the same – is it an unavoidable privacy nightmare or worth taking risks for?
Aarogya Setu appears to be a good application if you ignore the security concerns. But in a time where security is an essential tool it is better to bid farewell to App which is not going to be there on the app stores anymore.
Best vCISO Services in the UAE for Large Enterprises
Key Takeaways: Wattlecorp: A governance-first vCISO with UAE regulatory alignment, listed first because this is our blog. CPX: On-demand executive cyber leadership with an Abu Dhabi address and board-ready direction. Crowe UAE: A vCISO service, pitched as an extension of your internal team. Intello: A vCISO covering strategy, risk governance, and board reporting, from Dubai. […]
Managed Vulnerability Scanning for Indian SaaS Companies: Continuous Security for CERT-In Compliance
Key Takeaways: Recurring vulnerability scanning helps identify weaknesses that new deployments, infrastructure changes, and emerging vulnerabilities introduce. Risk-based prioritisation helps engineering teams focus on exposures with the greatest potential business impact. Remediation tracking and retesting provide evidence that identified vulnerabilities have been appropriately addressed. Recurring vulnerability scanning supports security readiness when combined with timely remediation, […]
NCA Cloud Cybersecurity Controls: Data Residency in Saudi Arabia
Key Takeaways: The NCA cloud cybersecurity controls (CCC) framework addresses cloud providers and, within their scope, the organizations that use cloud services, so check which side you’re on. Data residency covers more than the main database. Residency usually breaks in backups, logs, support access and analytics copies. Classify your data before you choose a region, […]
Why DPDP Compliance in India Needs Continuous Security Testing
Key Takeaways: The Digital Personal Data Protection (DPDP) Act, 2023 requires data fiduciaries in its scope (the businesses that decide how personal data is processed) to take reasonable security safeguards, with obligations phasing in under the DPDP Rules. An untested safeguard is an assumption. A once-a-year Vulnerability Assessment and Penetration Testing (VAPT) report describes your […]
UAE Information Assurance Regulation Audit: What Businesses Should Prepare for in 2026 and Beyond
Key Takeaways: Information Assurance Regulation Audit UAE readiness helps identify controls and evidence gaps prior to conducting a formal audit. Approved policies are only preliminary to achieving audit readiness and need strong verifiable evidence that these are truly working in practice via implemented controls. Missing evidence can cause significant delays in customer assurance and procurement […]
Cloud Security Audit for Indian Government Digital Initiatives: MeitY Empanelment Requirements
Key Takeaways: MeitY empanelment is how MeitY approves cloud service offerings for government use. As we understand it, it applies to the cloud offering, not to an auditor. MeitY empanelment and empanelment by the Indian Computer Emergency Response Team (CERT-In) are different things with different subjects. Assessors look at security controls, data handling and evidence, […]
