No security breach in Aarogya Setu app, govt assures after ethical hacker raises privacy concerns

The app is the government's mobile application for contact tracing and disseminating medical advisories to users in order to contain the spread of COVID-19

No security breach in Aarogya Setu app, govt assures after ethical hacker raises privacy concerns

New Delhi, May 6

The government on Wednesday said no data or security breach had been identified in Aarogya Setu after an ethical hacker raised concerns about a potential security issue in the app.

The app is the government's mobile application for contact tracing and disseminating medical advisories to users in order to contain the spread of COVID-19.

On Tuesday, a French hacker and cyber security expert Elliot Alderson had claimed that "a security issue has been found" in the app and that "privacy of 90 million Indians is at stake".

Dismissing the claims, the government said "no personal information of any user had been proven to be at risk by this ethical hacker".

"We are continuously testing and upgrading our systems. Team Aarogya Setu assures everyone that no data or security breach has been identified," the government said through the app's Twitter handle.

The tweet gave point-by-point clarification on the red flags raised by the hacker.

"We discussed with the hacker and were made aware of the following...the app fetches user location on a few occasions," it said, but added that this was by design and is clearly detailed in the privacy policy.

The app fetches users' location and stores on the server in a secure, encrypted, anonymised manner - at the time of registration, at the time of self-assessment, when users submit their contact tracing data voluntarily through the app or when it fetches the contact tracing data of users after they have turned COVID-19 positive, it said.

On another issue that users can get COVID-19 stats displayed on the home screen by changing the radius and latitude-longitude using a script, Aarogya Setu said all this information is already public for all locations and hence does not compromise on any personal or sensitive data.

"We thank the ethical hacker on engaging with us. We encourage any users who identify a vulnerability to inform us immediately...," it said.

Responding to Aarogya Setu's clarification, Alderson tweeted, "I will come back to you tomorrow". PTI

Tribune Shorts


Top News

Yasin Malik sentenced to life imprisonment in terror funding case

Yasin Malik gets life imprisonment in terror funding case

Malik had earlier pleaded guilty to all the charges

SpiceJet faces ransomware attack; flights delayed

SpiceJet faces ransomware attack; several flights delayed, cancelled

The airline is in touch with experts and cyber crime authori...

Kapil Sibal quits Congress, files RS nomination from SP

Kapil Sibal quits Congress, files nomination for Rajya Sabha with Samajwadi Party support

Will be an independent voice in RS and will continue to work...

Pakistan man visits ancestral village in India after 74 years

Pakistan man visits ancestral village in India after 74 years

Accompanies his brother who had stayed with him for two mont...

These prominent leaders quit Congress in 2022

These prominent leaders quit Congress in 2022

Kapil Sibal is the latest high profile exit from the party t...

Cities

View All