Highlights
- In containment zones and for office workers, Aarogya Setu is mandatory in India.
- Government says that Aarogya Setu app stores users data for up to 60 days.
- To allay privacy concerns, the government has said that it will be make Setu app source code public.
As nations increasingly adopt digital contact tracing as part of measures to prevent a resurgence coronavirus, we give you a low-down on the technology, security and privacy issues around the tools, country-wise.
First is India.
India's Aarogya Setu, with about 9.08 crore users as of now, has been the most downloaded app on Play Store.
Enforcement Levels: As of now, Aarogya Setu is mandatory for working professionals in government and private sectors.
Technology and security: The app works by using both Bluetooth and GPS location data. Government claims that the Bluetooth interaction data automatically gets deleted after 30 days. But data of positive cases is stored for 60 days.
The location data from Aarogya Setu is stored on a centralised server in an encrypted format. It is used either through the user's consent or once a person tests positive, says the government.
At present, the tool works using static identity, which is a fixed digital ID assigned to a user. Static identity is less secure and less private than dynamic IDs, which are randomly generated through automation after regular intervals.
The government's principal scientific advisor, Prof K VijayRaghavan, has told India Today that the app will soon be equipped with dynamic-identity features.
The app's source code is not available publically as of now, which has been questioned by privacy advocates.
A source code constitutes the basic structure of a program or app which consists of all its commands. Through the source code, independent researchers can test the functioning of an app.
Prof VijayRaghavan confirmed to India Today that the Aarogya Setu source code be made public in the near future for anyone to test its functions.
Contact-tracing in China
China's level of data surveillance through contact-tracing regime is probably the highest in the world.
Unlike any other country, the Chinese app is not a stand-alone tool. It's embedded in many of the country's popular payment, messaging and search-engine apps.
Its users receive algorithm-based ratings from those hosting apps. For them, it's mandatory to furnish their names, addresses national identity, passport and phone numbers, and so forth.
The use of the Chinese app varies area-wise. It's mandatory for travel in Covid-19 zones.
Using GPS, WiFi, bluetooth and details of financial transactions, calls and messages, the app collects the user's information on physical and digital contacts, location and financial contacts in a centralised manner. A user's health data is then used to grant or reject travelling permissions.
Contact-tracing in South Korea
South Korea probably ranks next to China in terms of high data surveillance. It has adopted a tightly-regulated tracing and testing strategy. Since South Korea doesn't have a lockdown in place, the country is enforcing strict quarantine for those who are infected with coronavirus. If anyone breaks quarantine, South Korea mandatorily asks them to wear a tracking bracelet.
Apart from the government's own Corona 100m app, other private tracking and mapping tools and wristbands are also used in the country.
South Korean authorities use CCTV footage, financial transactions and GPS location to collect user data. Contact-tracing is strict on travellers, possible contacts of positive cases and quarantined people.
Once a person is tested positive, a record of their movement, travel route, age and sex is circulated to all the people in that region.
The installation of the app is part mandatory for those the authorities suspect at risk, but the alerts about a positive case are sent to everyone on a location-based warning through text messages. This raises suspicion that the government could be doing anonymized location tracking of all cell phones.
Contact-tracing in Australia
Australia's COVIDSafe app works on Bluetooth handshake and keeps record of physical contacts of the past 21 days.
The data is stored locally on the users' phones unless they test positive, in which case it is sent to centralised servers hosted by Amazon online services.
The app collects the users' name, age, phone numbers and postcodes. The installation is voluntary but the Prime Minister has urged citizens to install it, saying it will take "millions more (installations)" for the tool to be effective.
Contact-tracing in the United Kingdom
The United Kingdom's health department rolled out the first trial version of the NHS tracking app on Monday.
It works on Bluetooth handshake and randomised IDs. The data is stored on a centralised server. Users are not required to share personal data until they test positive and decide to submit their records for further contact-tracing.
These are still early days for the app and the government has said that, based on feedback, the tool will be rolled out for the rest of the population in near future.
Contact-tracing in the United States
America's federal government has not rolled out any contact-tracing app so far. But President Donald Trump has said his administration will have a look at the upcoming joint initiative by tech giants Google and Apple, which are expected to introduce an app based on Bluetooth technology to help governments contact-trace past cases.
Google and Apple are creating a system using which the governments can create effective contact tracing app for the iPhone and Android. The system mandates that only Bluetooth data is used for contact tracing, that the user ID would be dynamic and refreshed every 15 minutes, that the data will not be centrally stored and that the app will not be allowed to collect GPS location data.
Google and Apple have said they expect this project to roll out later this month and it will be available until WHO doesn't declare coronavirus pandemic over.
Contact-tracing in Singapore
Singapore's TraceTogether app works on Bluetooth handshake technology. It doesn't collect the user's location data. Once a person is tested positive, their Bluetooth contacts are alerted and advised accordingly.
Installation of the app is voluntary. But the government is now appealing everyone to install it as the country is facing a second wave of outbreak after initial success in containment.
The app stores the user's mobile phone number for communication and generates random anonymised IDs for identification. The data is stored on a centralised server and its source code is public, which allows security experts to test the app's functionality.
A user can write an email with their phone number if they wish to opt out from tracing.
Contact-tracing in Israel
After the government in Israel was told by the country's Supreme Court to either stop mass surveillance of cell-phone locations to track Covid-19 cases or seek appropriate permission from the parliament, the Israeli health ministry rolled out an app called The Shield. The use of the app is not mandatory but is encouraged by the government.
The app collects GPS and WiFi data and stores it on a user's phone. It alerts the users if any of their contacts are tested positive for Covid-19.