The ‘Exposure Notification’ solution developed by US tech majors Apple and Google, and launched last month, has started rolling out on iPhone and Android devices in India. The solution, which is an API, or an application program interface, enables contact-tracing apps developed by governments and public health agencies to function reliably.
Notably, India’s contact-tracing platform Aarogya Setu is not compatible with the ‘Exposure Notification’ solution.
Apple and Google have developed a set of privacy protocols, under which developers of contact-tracing apps are required to agree to the terms and conditions set by the companies, mainly pertaining to privacy, should the developers wish to add the functionality to their apps. These terms and conditions empower the users to explicitly opt-in to use the technology, prevent collection or use of location data from the device, etc.
For Aarogya Setu to be compatible with the solution, certain tweaks will be required in the app. For example, even as Exposure Notification, by design, disallows collection or use of location data from the device, the knowledge sharing protocol for the Aarogya Setu app leaves room for location and contact data to be collected to formulate or implement appropriate health responses.
“Access to the (Exposure Notification) technology will be granted only to apps from public health authorities. Their apps must meet specific criteria around privacy, security, and data use,” according to information published by Google. “All of the Exposure Notification matchings happens on your device, which means only you and your app know if you report having Covid-19 or been exposed to someone who has reported having COVID-19. Your identity is never shared with other users, Apple, or Google,” as per the information on Google’s support page.
Therefore, even as the solution has started going live on some devices of Indian users, exclusion of Aarogya Setu, in its current form, would mean users in India will not be able to use the Exposure Notification technology as of now.
Responding to a query on whether Aarogya Setu will be tweaked to meet the requirements for the solution, a spokesperson for the Ministry of Electronics and Information Technology told The Indian Express: “For Google, no decision has been taken as of now. We will check what requirements are they asking and then decide accordingly whether we want to participate.” The solution has been adopted by several countries in Europe such as Switzerland, Austria, Italy, Poland, Germany, etc with many of them developing their contact-tracing apps on the basis of the Exposure Notification protocols.
Once a user opts-in to use the Exposure Notification solution, the system will generate a random ID for the user’s device, while ensuring these random IDs change every 10-20 minutes so that they can’t be used to identify a user or their location. The user’s phone and the phones in the vicinity then work in the background to exchange these random IDs using Bluetooth without the need to have the app open for this process to take place. The phone then periodically checks all the random IDs associated with positive COVID-19 cases against its own list and if there is a match, the app notifies the user with instructions from the respective public health authority.