Aarogya Setu source code made public days after MIT tech review downgrades app rating

A few days ago, MIT tech review reduced the rating for the app from 2 stars to 1 star, saying it collected far more data than needed.

Hyderabad: After much public debate and demands from the developer community, the union government announced it would be making the source code for Aarogya Setu public.

The source code will be made available to the general public on Github on Tuesday midnight. In essence, open-sourcing the code will allow the developer community to study the code, find bugs and vulnerabilities in it, thereby making the application more secure in the future.

The Aarogya Setu app, downloaded by more than 11.5 crore people till now, is meant for contact tracing during the Covid-19 pandemic. For several weeks, privacy activists have criticised the app’s unclear privacy policy and closed source nature.

In a rare move, the decision to open source Aarogya Setu was announced at a press conference in New Delhi. Amitabh Kant, CEO of NITI Aayog, said the government had always planned to open source the code. However, its immediate priority was contact-tracing. “So we focused on [contact-tracing]. Now we are making it open source,” he said.

Currently, only the code for the Android version of the app is being made open source. Ajay Prakash Sawhney, secretary, Meity, said 98 per cent of all users were using it on an Android device, hence it is the predominant platform. He added that over a period of time, the KaiOS (Jio phones) and iOS (Apple phones) versions would be made available too. The official press release says the server-side code too would be made public subsequently.

Sawhney dismissed reports of privacy concerns. He said, “[Aarogya Setu] is one of the finest contact-tracing apps [...] It is built with privacy in mind.”

It may be noted that only a few days ago, researchers at the Massachusetts Institute of Technology (MIT) Technology Review, who studied the app, graded it with one out of five stars, downgrading it from the earlier two stars. The researchers felt the app collected far more data than it needed.

The government has also announced a reward programme for developers who find bugs in the source code and suggest code improvement. In both cases, they stand to win Rs 1 lakh each.

The app has reportedly helped identify five lakh people who had come in contact of those who had tested positive for Covid-19. The National Health Authority has reached out to nine lakh people overall to advise about quarantine, testing or caution, said the press release.

Also, more than two-thirds of the 11.5 crore people who downloaded the app have used its ‘self-assessment’ feature.