The government on Wednesday made the “Aarogya Setu App” mandatory for all its employees — including outsourced staff — with a directive that each one leave for work only if the coronavirus-tracking app gives a “safe” or “low risk” status.

The decision to shift gears on Aarogya Setu’s use, from appeals and encouragement to a diktat, has set alarm bells ringing among privacy advocates and cyber security experts who see it as more of a tool of mass surveillance that would in all likelihood outlive the Covid-19 pandemic.

The government’s stated rationale in making the app mandatory for all its employees — including those working in autonomous and statutory bodies besides public sector undertakings — is to break the chain of transmission of the virus.

According to the office memorandum issued by the department of personnel and training, if the app shows a message that an employee has a “moderate” or “high risk” calculated on the basis of Bluetooth proximity (recent contact with an infected person), then he or she should not go to office but self-isolate for 14 days or till the status becomes “safe” or “low risk”.

The Internet Freedom Foundation (IFF) — a collective that champions digital rights — said the office memorandum issued required mandatory use. “Hence, there is a clear inference now that Aarogya Setu is not voluntary. This undermines the autonomy of users,” it said.

“The scope of this order is not limited to Central Government offices and includes PSUs and autonomous statutory bodies. Hence, there are reasonable and foreseeable risks of Aarogya Setu being made mandatory for more classes of users beyond government employees,” the IFF added in a statement.

While recognising the larger healthcare priorities in play right now as the world battles the pandemic, the IFF is of the view that the core defects in the design and implementation of the app cannot be overlooked. “Aarogya Setu has a direct impact on the privacy, cyber security of every user. It becomes significant for government employees whose each movement will be tracked. These issues cannot be accounted for by a privacy policy. It requires significant legal & technical changes,” it said.

Apar Gupta, the IFF’s executive director, told The Telegraph it was clear now that Aarogya Setu was being used as an e-pass system, much like the Chinese system where every movement is tracked as part of the strategy to combat the virus; thereby introducing a degree of coercion into what had started out as voluntary.

First, people were encouraged to download it, then it was showcased as an essential to be a corona-warrior — introducing an element of peer pressure — and now this, he said.

One of the core defects, according to Gupta, is that the health ministry is not involved in the app that is supposedly crucial to the health of Indians in the face of the pandemic.

Gupta said the IFF had filed multiple RTI queries with the health and family welfare ministry seeking information regarding the legislative framework, guidelines and governmental committees governing the use of the Aarogya Setu app, especially with regard to the safeguards in place to ensure user data protection and privacy.

“These RTIs were transferred to the National Informatics Centre,” he said, referring to the government’s digital support arm.

“It is inherently problematic that the Health Ministry does not have the relevant information as this raises serious concerns about the intention behind the collection of data by the app which has been publicised as an app providing essential health services,” the Foundation said.