India's Aarogya Setu contact tracing app is reportedly a privacy nightmare

India rolled out a contact tracing app called Aarogya Setu last month to help track coronavirus infection in the country. While it started as a voluntary app, the Indian government recently made it mandatory for all employees in the country. However, various privacy-focused groups have been raising concerns about the app's information collection ever since it was launched.

An independent analysis of the contact tracing app by the folks at Gizmodo has found that the app enables federal surveillance and also makes devices vulnerable to a wide range of hacks. The app requires users to provide basic information such as their age, gender, and travel history to get started. Users are also required to allow the app to access their location data and keep Bluetooth turned on at all times.

Along with using location data from the phone's GPS, the app can access users' "coarse location" as well, pulled from data such as the Wi-Fi networks that phones connects to. And since the app requires Bluetooth to be turned on at all times, it negatively impacts battery life and enables hackers to exploit Bluetooth security flaws to tap into sensitive user data. So while the app might prove helpful in reducing the spread of COVID-19 in the country to an extent, it also appears to be putting the privacy of millions of Indians at risk.

Contact tracing stirs debate in Canada