India said on Tuesday it was making public the source code of its coronavirus contact-tracing app Aarogya Setu for Google's Android smartphones, a move digital rights activists said will boost the security of users.
The bulk of India's roughly 500 million smartphone users have Android devices and the source code for the app's iOS version will be released in the next two weeks, India's tech ministry said in a statement.
"Transparency, privacy and security have been the core design principles of Aarogya Setu since its inception. And opening the source code up to the developer community signifies the government of India's continuing commitment to these principles," Amitabh Kant, CEO of the government think-tank NITI Aayog, told a news conference.
Aarogya Setu ('Health Bridge') was launched by the government in early April as a key tool in containing the spread of COVID-19. It is currently used by over 115 million Indians.
It uses Bluetooth and GPS on smartphones to record when people come in close contact with one another, so that contacts can be quickly alerted when a person is diagnosed with COVID-19.
Frequently Asked Questions
A vaccine works by mimicking a natural infection. A vaccine not only induces immune response to protect people from any future COVID-19 infection, but also helps quickly build herd immunity to put an end to the pandemic. Herd immunity occurs when a sufficient percentage of a population becomes immune to a disease, making the spread of disease from person to person unlikely. The good news is that SARS-CoV-2 virus has been fairly stable, which increases the viability of a vaccine.
There are broadly four types of vaccine — one, a vaccine based on the whole virus (this could be either inactivated, or an attenuated [weakened] virus vaccine); two, a non-replicating viral vector vaccine that uses a benign virus as vector that carries the antigen of SARS-CoV; three, nucleic-acid vaccines that have genetic material like DNA and RNA of antigens like spike protein given to a person, helping human cells decode genetic material and produce the vaccine; and four, protein subunit vaccine wherein the recombinant proteins of SARS-COV-2 along with an adjuvant (booster) is given as a vaccine.
Vaccine development is a long, complex process. Unlike drugs that are given to people with a diseased, vaccines are given to healthy people and also vulnerable sections such as children, pregnant women and the elderly. So rigorous tests are compulsory. History says that the fastest time it took to develop a vaccine is five years, but it usually takes double or sometimes triple that time.
Privacy advocates including a French hacker who called out some of Aarogya Setu's flaws on Twitter had asked the government to make the app's source code public, which would allow security researchers to inspect the system and find how it captures data.
A source code refers to programming instructions which are used to run an application.
Udbhav Tiwari, the public policy adviser for internet firm Mozilla, said the Aarogya Setu app still had some ground to cover before it could claim to be truly open source.
"This includes open sourcing the server-side code and ensuring that the app is built exclusively from its public repository," Tiwari said. On Tuesday, the government said it did plan to release the server code.
India has been encouraging a widespread use of the app including for rail and air travel, although it softened its previous demand for compulsory use by office workers, after a backlash from privacy advocates.
The app, which was initially available for only Android smartphones and Apple devices, can now also be used in cheap internet-enabled phones which run on the KaiOS mobile operating system.