Aarogya Setu: Has the world’s most downloaded contact-tracing app actually been effective?

In July, when Radha Bedi (name changed on request) resumed work as a home tutor for children in central Mumbai, one housing society stopped her at the gates. Entry would be allowed only if she had the Aarogya Setu app on her phone, the security guard told her.

Aarogya Setu was launched in April as the Indian government’s tool for contact-tracing people infected with the Covid-19 virus. Since the app was not mandatory, and was mired in controversies about data privacy, Bedi refused to download it.

She was allowed into the building after her student’s father negotiated with the housing society, but in October, Bedi found herself blocked by another residential building. The student’s family was forced to find a cumbersome way around it: “The parents meet me outside the gates and escort me in by showing the guard the app on one of their phones.”

The arrangement has worked so far, but Bedi is still disgruntled.

“This whole app seems utterly arbitrary,” she said. “If it’s so easy to circumvent it, what is the point of it? And what about people without smartphones? Will buildings not allow them to enter?”

Is it effective?

On its website, the Aarogya Setu or Health Bridge app claims its purpose is to enable “community-driven contact tracing” to help authorities contain the Covid-19 pandemic. It uses GPS (Global Positioning System) and Bluetooth to track other Aarogya Setu-enabled phones in the vicinity of a user, and alerts users about Covid-positive cases around them. The app also has a self-assessment feature for users at risk of Covid-19 to report symptoms.

Data collected through the Aarogya Setu app is sent for analysis to the IT-enabled Integrated Hotspot Analysis System or ITIHAS, a separate platform developed by a team from the Indian Institute of Technology, Madras, to help district-level officials identify local Covid-19 hotspots.

Several Indian states have launched other decentralised contact-tracing apps for Covid-19. As the only centralised app in India, Aarogya Setu has recorded more than 16 crore installations, making it the world’s most downloaded contact-tracing app.

How effective has it been at its job? And does it still have utility value, with more than 86 lakh Covid-19 cases recorded across India and the health minister finally admitting the presence of community transmission?

Health and technology experts believe Aarogya Setu has had limitations in its ability to contact-trace from the beginning, and has little value in Covid management today.

In the midst of this, concerns about the app being misused have grown. What started out as a contact-tracing app is now being used as a tool to restrict people’s access to housing societies, gymnasiums, malls, government offices and other public or private spaces.

Data rights activists, meanwhile, remain worried about the privacy of users’ health data collected through the app, as India moves towards the creation of a controversial centralised national health database.

Problems with digital contact tracing

The efficacy of a contact-tracing app depends on how widely it is in use in the early stages of a pandemic.

“If the aim of the app is to structure an individual’s movements based on whether there are Covid-positive people around, then the app needs to be near-universal to work,” said Gautam Bhan, a senior researcher at the Indian Institute for Human Settlements in Delhi.

In a country like India, this is impossible: millions of low-income people who do not have smartphones are automatically excluded from the contact-tracing project.

Even among people who do have smartphones, the app cannot really guide an individual’s behaviour, said Bhan. “Many of the people moving around are doing it for the sake of livelihood, or for essential work.”

If the purpose of contact-tracing is to help identify emerging hotspots, then an app alone is not enough. “Any digital contact-tracing has to be supplemented with physical contact-tracing on the ground, or it will not work,” said Pallavi Bedi, a senior policy officer at the Centre for Internet and Democracy.

In most parts of the country, particularly in bigger cities, civic authorities have not been consistent with contact-tracing on the ground. In June and July itself, with cases surging across the country, most states abandoned contact tracing.

A public health specialist from Amritsar told Scroll.in that the Aarogya Setu app and Punjab’s state-level Cova app had only provided limited, auxiliary help in tracking people at risk of contracting Covid-19. “People don’t always understand how to do the self-assessment. Some choose all the symptoms listed, and when we call them up, they say that they have no symptoms, that they had made a mistake,” said the public health specialist.

Attempts at on-ground contact tracing are also derailed by the stigma associated with being Covid-positive. “There have been times when entire lanes of people have refused to cooperate with health workers, refused to get tested and even refused to let any health workers inside their galli,” the health specialist said.

‘Could not figure out the purpose of the app’

Even among people who enthusiastically embraced Aarogya Setu after its launch, the app has now lost its appeal and significance.

In Delhi, 57-year-old KV Suresh was grateful to the app when it first alerted him about the presence of a Covid-19 case in his vicinity. Since the app could not tell him the exact location of the Covid-positive person, Suresh first assumed it was the technician who had entered his home to repair a cable. Several phone calls later, he realised it was a neighbour in the flat above him. “I had no idea, because by then my housing society had stopped putting up posters about cases outside each building,” said Suresh, a retired telecom executive.

At the time, Suresh received not only a “high-risk” alert message on his Aarogya Setu app, but also daily check-in phone calls from local civic authorities, asking him to self-isolate at home and log symptoms in the app.

In September, Suresh’s app once again warned him about being at risk of Covid-19, but this time he found it less helpful. “The app sent me the message after I had visited a hospital with my wife to get some other tests done for her,” he said. “There could have been a Covid patient carrying a phone anywhere in the hospital, which my app picked up.” This time no one called him to check in, and he was not sure if there was cause for him to self-isolate.

Sharif Rangnekar, another Delhi resident, had downloaded Aarogya Setu along with his entire residential colony when it launched in April. “Initially everyone was excited to be able to see how many Covid cases were around them in a 500-metre radius,” said Rangnekar, a former journalist. “But after a point, we could not figure out the purpose of the app, because there are cases everywhere now, and the app does not give you the precise location of each case.”

Because of this, Rangnekar has been baffled by the arbitrary ways in which Aarogya Setu has been made mandatory by various establishments. “A few friends were denied entry into a Gurgaon mall without Aarogya Setu on their phones. But after they downloaded it, they were not expected to login or do anything on the app – the mall just allowed them to enter,” he said.

Evading accountability

The question of making Aarogya Setu mandatory has been controversial right from the time of its launch. Initially, the Central government made the app mandatory for air and railway travel, as well as for people in containment zones. It was also mandatory for all public and private sector employees to enter their offices.

This drew sharp criticism from many citizens: contact-tracing apps were not mandatory in most other countries, but in India, the government was trying to enforce Aarogya Setu on the public without making the app’s source code publicly available. The source code contains the foundational structure of an app and allows anyone to independently test its functioning.

In late May, after facing pressure from data rights activists demanding accountability, the Central government publicly released Aarogya Setu’s source code. It also announced that the app would not be mandatory for air and rail travel or in workplaces. This, however, has not stopped over-zealous organisations and establishments from trying to mandate Aarogya Setu.

Since India does not yet have a data protection law, releasing the app’s source code has not addressed larger concerns of users’ data rights and privacy.

In the Aarogya Setu Data Access and Knowledge Sharing Protocol – a document released in early May – the Ministry of Electronics and Information Technology claimed that the app was collecting only contact, location and self-assessment data from users. This would be stored with the National Informatics Centre only for a period of 180 days, after which it would be “permanently deleted”.

The Protocol stated that users’ data could be shared, in anonymised formats, with central and state governments, disaster management agencies, other public health institutions and local governments whenever necessary, for formulating a health response to Covid-19. But the protocol also states that the National Informatics Centre would maintain a list of the agencies with whom Aarogya Setu data has been shared only “to the extent reasonable”.

“A protocol document is not the same as having a set of rules,” said Srinivas Kodali, an independent researcher working on data, governance and the internet. Besides, sharing a user’s mobile phone number with state and district governments for contact tracing automatically indicates that the data is not anonymised. “Once the data leaves NIC’s server, the NIC has no way of knowing whether a state government has also shared it with its police, intelligence agencies or anyone else.”

In October, in response to a Right to Information request, the National Informatics Centre said that it did not have any knowledge about who had built the app. This prompted the Ministry of Electronics and Information Technology to clarify that the app had been built with “public-private collaboration”, with the names of the experts already in the public domain.

In May, the Centre released the names of more than 70 individuals from the government and the private sector who contributed to building the app. “But the affiliations of these individuals have not been made public, and they come across as a group of volunteers who built the app,” said Kodali. This enables the app-makers to evade accountability.

Scroll.in sent email queries about data privacy concerns and the efficacy of Aarogya Setu to senior officials at the National Informatics Centre and the Ministry of Electronics and Information Technology, as well as to officials at Niti Aayog. This report will be updated if they respond.

This reporting was supported by a grant from the Thakur Family Foundation. Thakur Family Foundation has not exercised any editorial control over the contents of this article.