MIT Researchers Downgrade Aarogya Setu App to One Star in Review

The Aarogya Setu app has been developed by the government of India and uses location data to track users.

Researchers at MIT has earlier given the app a 2 out of 5 in their review. 

(Image: Erum Gour/The Quint)

Aarogya Setu app, a contact tracking application developed by the government of India suffered another setback as researchers at the MIT (Massachusetts Institue of Technology) downgraded the app rating to one star out of five in its in-house review. Researchers had earlier given it 2 out of 5 in their review.

According to a report in The Times of India, the app lost more points on the parameters of “data minimisation” which means the app is collecting more data than needed for the app to work.

As per the review, it lost points on parameters related to limitations on data usage, voluntary use, and transparency.

The review at MIT is based on an index that is used to assess the performance of various contact tracing applications developed by governments across the world.

In an earlier review a few days ago, MIT had given the app 2 stars out of five for parameters like collecting useful data and deleting the data on time.

The database for the review asks five important questions:

• Are there any limitations on how the app gets used?
• Will data be destroyed after a certain period of time?
• Is data collection minimised?
• Is the process of collection transparent?
• Is it voluntary?

A few weeks ago, a French cybersecurity expert and hacker under the alias “Elliot Alderson” on Twitter claimed that a security vulnerability in the app allows an attacker to “know who is infected, unwell, made a self-assessment in the area of his choice.”

Alderson’s claimed that the app is allegedly exposing sensitive health data of millions of Indian citizens. This sensational came a few days after Congress MP Rahul Gandhi criticised the app and described it as a “complicated surveillance system.”

In response to this, the Aarogya Setu team denied the existence of security issues on the app.

Meanwhile, American technology giants Apple and Google released their COVID-19 tracing API that can be used by contact tracing apps developed by different governments.

What makes Apple and Google’s API secure is that it does not use the phone’s location data to alert users rather works on a notification system that uses Bluetooth technology.

The biggest difference between the Aarogya Setu app and Google and Apple’s technology is that the former uses both Bluetooth and GPS location data while the later is only dependent on Bluetooth to function.