#back-end code

Contact tracing app Aarogya Setu is facing renewed criticism for lack of transparency, with many security experts pointing out that what the government released as the app’s ‘back-end code’ was not what it was claimed to be. “What they’ve released right now is some non-functional code snippets. It is client-side code loaded onto the app from a web address and not the server functions or the data-handling part. The back-end code, which handles the data, including the data schemas, has still been kept secret," said Anivar Aravind, an advisory board member at the Software Freedom Law Center (SFLC), who had challenged the mandatory imposition of the app in the Karnataka high court, highlighting its implications on privacy.

Aarogya Setu has quickly become the world’s most-downloaded contact-tracing app. With over 100 million downloads on Android devices, it is expected to become part of the government’s future e-health related initiatives as well. Many have questioned the privacy implications associated with the app, which is capable of tracking users continuously. Open sourcing the app’s code is one of the things security experts have been asking for, but many say true open sourcing isn’t achieved unless the back-end code is also made available. The Central Information Commission (CIC) recently sought an explanation from the National Informatics Center (NIC) for evasive replies to a right to information request about who had made the app. The ministry of electronics and information technology (MeitY) later clarified the app had been developed by the NIC in collaboration with volunteers from industry and academia.