Indian government labels itself ‘evasive’ over privacy details of national COVID-19 contact-tracing app

Smacks down Information Commission by pointing to policy and data revealing the app has probably helped quite a lot


India’s Central Information Commission has warned the nation’s Ministry of Electronics and Information Technology that it could face penalties under the Right to Information Act after it was found to have been “evasive” in its response to a request for information about the Aarogya Setu contact-tracing app.

A Commission order [PDF] published earlier this week details a request for information lodged by an activist named Saurav Das who sought detailed information on how the app was conceived and created, including details of private sector involvement. Das suggested that insufficient safeguards for use of information gathered by the app means users are at risk, so sought information to better understand the app’s potential privacy impact.

That request seems reasonable given that India claimed the app has perfect security, but then open-sourced it to make scrutiny easier and even added a bug bounty program to make that effort worth developers' time and energty.

The order says that the Ministry offered “a very evasive kind of reply” and did not make sincere efforts “to trace the holder of the information in this case.”

Someone with their fingers in their ears

Much like the British on holiday, NHS COVID-19 app refuses to work with phones using unsupported languages

READ MORE

Information commissioner Vanaja N. Sarna concluded that the Ministry therefore needs to show cause as to why it should not be penalised and called on officials to appear at a November hearing to make their case.

On The Register’s reading of the relevant legislation, the penalties would be 250 rupees (US$3.36) on each day that information is not delivered.

The Ministry will almost certainly not worry about that sum. But it did worry enough to pop out a statement that says everything Das needs to know about the app is mentioned on its GitHub repo, privacy policy and data access knowledge protocol [PDF].

Also revealed was that the app has been downloaded over 162 million times and “has greatly augmented the efforts of front line health workers in the fight against COVID19.”

The Ministry makes that assertion because it says the app has helped to detect cases of COVID-19.

“It has helped identify Bluetooth contacts of COVID positive users and issued alerts for helping people to stay safe,” the statement says. “These Bluetooth contacts have been advised for caution, quarantine or testing depending on the extent of exposure to COVID19 positive user. Amongst those who have been advised testing, almost 25% have tested positive. This is much higher compared to the overall positivity rate of 7-8%.”

“Thus, the efficiency of testing has gone up with AarogyaSetu.”

The statement also says the app has helped to develop emerging hotspots of infection, further enhancing government response.

At the time of writing, India’s Ministry of Health and Family Welfare reports 7,259,509 people in the nation have recovered from COVID-10, with 610,803 active cases and 120,010 deaths. ®


Biting the hand that feeds IT © 1998–2020