Aarogya Setu safety issue: Govt denies privacy breach of '90 million Indians' after hacker raises concerns

Centre has denied any kind of data breach or security issues raised by a French ethical hacker Elliot Alderson, who had claimed that the privacy of 90 million Indians is at stake in a tweet on May 5.

French hacker Robert Baptiste, who goes by Elliot Alderson on Twitter had earlier tweeted about finding security concerns on the Aarogya Setu app after Congress leader Rahul Gandhi called it a sophisticated surveillance tool.

Baptiste did not reveal the exact issues but requested the Indian Computer Emergency Response Team (CERT-In) and the National Informatics Centre (NIC) to get in touch with him for resolving the issue. 

After being alerted, the team from Aarogya Setu contacted Baptiste who informed them about the possible issues.

The official Twitter handle of India’s coronavirus contact tracing app released a statement saying: No personal information of any user has been proven to be at risk by this ethical hacker.

Statement from Team #AarogyaSetu on data security of the App. pic.twitter.com/JS9ow82Hom

— Aarogya Setu (@SetuAarogya) May 5, 2020

It further added that the team is continuously testing and upgrading the systems.

The statement suggests that Baptiste raised concerns over the app fetching location data on a few occasions and how users can display COVID-19 stats on the home screen by changing the radius and latitude-longitude using a script. The app developers responded saying that there is no issue in the app.

“This is by design and is clearly detailed in the privacy policy,” the statement read.

The developers also detailed how the user location is fetched and the process of it being stored in a secure, encrypted government server.

According to the team, user location is accessed at the time of registration, self-assessment, and when a user submits their contact tracing data voluntarily through the app. The government also fetches the data once the user is found COVID-19 positive.

Responding to the second concern of changing COVID-19 stats, the developers stated that the information is public for all locations and hence does not compromise on any personal or sensitive data. Users can change the latitude/ longitude to get data for multiple locations.

Baptiste later tweeted that he will come back with more details.