Advertisement
The app is the government’s mobile application for contact tracing and disseminating medical advisories to users in order to contain the spread of COVID-19.
On Tuesday, a French hacker and cybersecurity expert Elliot Alderson had claimed that “a security issue has been found” in the app and that “privacy of 90 million Indians is at stake”.
Dismissing the claims, the government said “no personal information of any user has been proven to be at risk by this ethical hacker”.
Related Articles
Advertisement
The tweet gave point-by-point clarification on the red flags raised by the hacker.
“We discussed with the hacker and were made aware of the following. the app fetches user location on a few occasions,” it said but added that this was by design and is clearly detailed in the privacy policy.
“The app fetches users’ location and stores on the server in a secure, encrypted, anonymized manner – at the time of registration, at the time of self-assessment, when users submit their contact tracing data voluntary through the app or when it fetches the contact tracing data of users after they have turned COVID-19 positive,” it said.
On another issue that users can get COVID-19 stats displayed on the home screen by changing the radius and latitude-longitude using a script, Aarogya Setu said that all this information is already public for all locations and hence does not compromise on any personal or sensitive data.
“We thank the ethical hacker on engaging with us. We encourage any users who identify any vulnerability to inform us immediately…,” it said.
Responding to Aarogya Setu’s clarification, Alderson tweeted, “I will come back to you tomorrow”.