As the Covid-19 pandemic spins out of control and the lockdown is being relaxed, governments are looking at digital technology solutions to handle the disease.

What is contact tracing?

Contact tracing and exposure notifications are important and necessary tools to help us in the transition to normal life as well as manage any future outbreak of the disease. When a person is diagnosed with Covid-19, health workers interview them and track down their recent contacts. This is a Herculean task if done manually. Therefore, mobile apps are being harnessed to do this work.

How does it work?

Kavita, a housewife, goes to the local grocery store. There, she meets Satish, her neighbour, and the two spend about 10 minutes chatting. Both have a contact tracing app on their phones. While they are conversing, their phones exchange anonymous identifier beacons. Kavita and Satish go back home. Both their phones periodically download the broadcast beacon keys of everyone who has tested positive for Covid-19 in the region.

After a few days, Satish is positively diagnosed for Covid-19 and enters the test result in the app on his phone. His phone uploads the last 14 days of keys for his broadcast beacons to the cloud database. Kavita’s phone finds a match with Satish’s anonymous identifier beacon and she gets an alert on her phone that she has been exposed to someone who has tested positive for Covid-19 as well as instructions as to what she should do.

What is API?

Apple’s API

Apple and Google, working together, have released the Covid-19 exposure notification API which has been introduced to your phone, if you are an iPhone user, by the 13.5 iOS update and to all Android phones, through an update to Google Play Services. This will allow only state health agencies to produce apps to notify the public about possible Covid-19 exposure. Your phone gets a random Bluetooth identifier, which is a string of numbers and letters and which is different from anyone else’s. It does not, however, include any personal identification. Your unique identification number changes every 10 to 20 minutes.

Your phone broadcasts this unique ID over Bluetooth to every other phone it comes close to. Other phones broadcast their IDs too and each phone keeps a log. If one of those people test positive for Covid-19, they can use the app from their public health authority to upload the information to a central database, without using any personal identity.

Your phone and everybody else’s phone periodically downloads Covid-19 positive Bluetooth ID numbers from the server. Your phone compares its log of IDs with it. If there is a match, it will send you an alert that you have been exposed to someone who is Covid-19 positive, the date on which the test was done, the date you were near that person, just how close you were and for what length of time.

Aarogya Setu

Aarogya Setu, the Indian Covid-19 tracker app, was launched by the National Informatics Centre under the ministry of electronics and information technology (MeitY). It has its own API. It is not compatible with the Apple-Google API because Aarogya Setu uses location and user data to see if it has encountered a Covid-19 positive person. It needs at least 60 per cent of the population to use it for it to be effective.

Apple and Google insist on a decentralised system where no personally identifiable data is used or stored. The Indian government, on the other hand, insists on the centralised database because everyone in India does not have a smartphone. Moreover, they need more hand-holding and guidance. In the larger public interest, the government has shared the source code of this app under Apache License 2.0.

If the security or privacy of the app bothers you, send your feedback to as-bugbounty@nic.in or support.aarogyasetu@nic.in.