Aarogya Setu not ‘open source’ in real sense, claim cybersecurity activists, say server code must be made public

On 26 May, NITI Aayog CEO Amitabh Kant announced in a press conference that the Aarogya Setu app would be made open-source from the midnight of 27 May. So, to call the Aarogya Setu app open source is a half-truth, and, in effect, a lie.” He further noted, “The Android app’s source code has been put in the public domain, but the code of the website it loads within the app is nowhere to be seen. According to Anivar Aravind, a Bengaluru-based software engineer and public interest technologist, the announcement on making Aarogya Setu ‘open source’ appears to be an attempt to counter criticism from quarters such as the MIT. The release further states, “The app has over 114 million users as on 26 May, which is more than any other contact tracing app in the world… The key pillars of Aarogya Setu have been transparency, privacy and security and in line with India’s policy on Open Source Software, the source code of Aarogya Setu has now been made open source.” While questions linger on whether the source code of Aarogya Setu has been made public in the real sense of the term, there are several other concerns as well. The Free Software Community of India — a collective of Free Software users, advocates and developers — pointed to the involvement of private players in the development of the app, and said, “Complete transparency would entail disclosure of the extent of such involvement, the processes followed in such public-private collaboration, including disclosure of tenders or contracts given to private companies for the work they contributed in the app, the guarantees available to the public about strict separation of data from the hands of private collaborators, and also details on procedures which allow more stakeholders, including civil society and rights activists, to shape the further development of the platform.” As per media reports, several individual volunteers have worked on the app, including former Google India executive Lalitesh Katragadda and MakeMyTrip founder Deep Kalra.