Context: Recently, the source code of Aarogya Setu Mobile App has been made open source for software developers. It has been uploaded on GitHub which will help in identifying any vulnerabilities or code improvement in order to make Aarogya Setu more robust and secure.
About AarogyaSetu App

• The App enables people to assess themselves the risk of their catching the Corona Virus infection.
• It is designed to keep track of other AarogyaSetu users that a person came in contact with and alert him or her if any of the contacts tests positive for COVID-19.
• It achieves this using the phone’s Bluetooth and GPS capabilities.
• Once installed in a smartphone through an easy and user-friendly process, the app detects other devices with AarogyaSetu installed that come in the proximity of that phone.
• The app can then calculate the risk of infection based on sophisticated parameters if any of these contacts have tested positive.
• The personal data collected by the App is encrypted using state-of-the-art technology and stays secure on the phone until it is needed for facilitating medical intervention.

Issues with the app

• The AarogyaSetu app faces the same issue as every other contact tracing technology that has come up during the pandemic period — it is people dependent.
• It needs widespread usage and self-reporting to be effective.
• Given that any number of total users will be a subset of smartphone owners in India, and there are bound to be variations in the levels of self-reporting, the efficacy is not bulletproof.
• The terms of use of the app also say as much, distancing the government from any failure on the part of the app incorrectly identifying COVID-19 patients.

1) Privacy concerns

• First of all, the app exists in the privacy law vacuum that is India.
• With no legislation that spells out in detail how the online privacy of Indians is to be protected, AarogyaSetu users have little choice but to accept the privacy policy provided by the government.
• The policy goes into some detail on where and how long the data will be retained, but it leaves the language around who will have access to it vague.
• As per the policy persons carrying out medical and administrative interventions necessary in relation to COVID-19” will have access to the data.
• This suggests interdepartmental exchanges of people’s personal information and is more excessive than countries like Singapore and even Israel.

2) Technical issue

• Beyond the legal loopholes, there are technical loopholes as well.
• The unique digital identity in AarogyaSetu is a static number, which increases the probability of identity breaches.
• The abundance of data collected is also potentially problematic.
• AarogyaSetu uses both Bluetooth as well as GPS reference points, which could be seen as overkill whereas other apps such as TraceTogether make do with Bluetooth.

3) Other issues

• Experts emphasise that automated contact tracing is not a panacea.
• They caution against an over-reliance on technology where a competent human-in-the-loop system with sufficient capacity exists.

What is Open Source?

• The term open source refers to something people can modify and share because its design is publicly accessible.
• The term originated in the context of software development to designate a specific approach to creating computer programs.
• Today, however, “open source” designates a broader set of values—what we call “the open source way.”
• Open source projects, products, or initiatives embrace and celebrate principles of open exchange, collaborative participation, rapid prototyping, transparency, meritocracy, and community-oriented development.

About source code

• “Source code” is the part of the software that most computer users don’t ever see; it’s the code computer programmers can manipulate to change how a piece of software—a “program” or “application”—works.
• Programmers who have access to a computer program’s source code can improve that program by adding features to it or fixing parts that don’t always work correctly.

What is Open Source Software?

• At the simplest level, open-source programming is merely writing code that other people can freely use and modify.
• Open source is a term that originally referred to open source software (OSS).
• OSS is a code that is designed to be publicly accessible—anyone can see, modify, and distribute the code as they see fit.
• An open-source development model is a process used by an open-source community project to develop open-source software.
• The software is then released under an open-source license, so anyone can view or modify the source code.

About “Bug Bounty” programme.

• Under the programme, financial rewards will be given to security researchers for finding any vulnerability in the application or suggesting improvements to the source code.
• With the release of the source code in the public domain, the government is looking to expand collaboration and leverage the expertise of top technical brains to collectively build a robust and secure technology solution to help support the work of frontline health workers in fighting this pandemic together.
• This is believed to improve transparency on how the data is used, improve security by minimising bugs and empower experts to improve the app via public contributions.
• The “Bug Bounty” programme will be open to Indian and foreign nationals, but only Indians will be eligible for rewards offered under the scheme.
• Anyone who points out a security vulnerability in the app source code will be eligible for a reward of up to Rs 3 lakh, and up to Rs 1 lakh for pointing out a suggestion or improvement in the source code.