French hacker raises concerns with Aarogya Setu app, govt responds

Days after Congress leader Rahul Gandhi spoke of the security concerns with regards to the Aarogya Setu app, french hacker Elliot Alderson took to Twitter to confirm his allegations stating that a ‘security issue’ has been found in the app. 

Hi @SetuAarogya,

A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private?

Regards,

PS: @RahulGandhi was right

— Elliot Alderson (@fs0c131y) May 5, 2020

The Aarogya Setu app, which is a coronavirus tracking application developed by the Indian Government has recently come under the scanner with the Congress leader calling it a ‘sophisticated surveillance system’.

Following Gandhi’s concerns, Alderson took to Twitter to corroborate that a breach has indeed been found. Furthermore, Alderson tweeted that The Indian Computer Emergency response team and National Informatics Centre, in fact, reached out to him to establish contact to work on the breaches in the security system. The French hacker had also announced that unless the breaches were fixed, he would reveal the fallacies within the system to the common man. However, the Centre on Wednesday, May 6, 2020, has issued a statement stating that no breach of data or security issue had been identified and thanked Alderson instead. 

Statement from Team #AarogyaSetu on data security of the App. pic.twitter.com/JS9ow82Hom

— Aarogya Setu (@SetuAarogya) May 5, 2020

However, this did not seem to go well with Elliot Alderson as he took to Twitter to further ask the government if they knew what triangulation is. He added, "This suggests an inherent flaw in the system that collects user data through the app." Although there is no evidence to solidify the claims made by Alderson, the Aarogya Setu app has been subjected to various forms of criticism having been outsourced to a private operator without any institutional scrutiny.

The app is currently the most downloaded application in India. However, groups like the Software Freedom Law Centre, India (SFLC.in) and the Internet Freedom Foundation (IFF) have criticized the nature of the app. Furthermore, while the app was voluntary in nature in the beginning, it is now mandatory for many workplaces along with government offices. Most recently, the police in Noida have been using the application as well.