Indian government officials reject these concerns, saying their encryption standards have adequate protection against data or network breaches.

Data of millions of Indians, collected through the Aarogya Setu app, could be vulnerable to threats from adversarial state and non-state actors and pose a national security challenge, according to cybersecurity experts and former intelligence officials. This, they believe, is due to issues in India’s security capabilities and cyber hygiene practices.
Indian government officials reject these concerns, saying their encryption standards have adequate protection against data or network breaches.
This difference of opinion is at the heart of a controversy surrounding tracing apps that store sensitive personal data to aid in the fight against the coronavirus disease (Covid-19) — with one side saying that the potential risks are either non-existent or a small compromise; and the other arguing that the information is far more valuable and dangerous than governments comprehend, not just from a privacy perspective but also on the security front.
Aarogya Setu is meant to trace close contact between people so that they can be reached in the event any of them is infected with Covid-19. According to government officials, at least 110 million people have signed up on it, and while a rule making it mandatory for office-goers to install it was partially relaxed last week, on Wednesday the government said air passengers must install it if they are taking a flight.
“National databases in general are a huge cause of concern. Sometimes, leaks don’t even appear on the dark web. They are simply scooped away for doing passive profiling of citizens of adversarial countries,” said Pukhraj Singh, a cyber threat intelligence expert, who was involved in the detection of the breach at the Kudankulam Nuclear Power Plant last year.
The concerns expressed by Singh were endorsed by two former intelligence officers who have held senior positions in the National Intelligence Grid (Natgrid) and the National Technical Research Organisation (NTRO) – two of India’s main agencies tasked with digital intelligence gathering.
The threat is particularly serious due to the nature of information involved, one of the former intelligence officers cited above said. He added that users part with information that can directly identify them, where they have been, and what health conditions they suffer from, making it a target for common cyber criminals who can offer these up on the dark web for a price, as well as state-backed hackers for espionage.
Government officials again rejected these concerns, saying that their data encryption standards have adequate protection against breaches.
A VERITABLE GOLD MINE
Since its launch in early April, Aarogya Setu has had at least 106 million sign-ups, according to government officials. The process requires users to declare their mobile numbers, name, gender, age, and whether they belong to a set of high-risk professions, such as law enforcement or health care.
The application then routinely asks people to “self-assess” their health by answering questions such as whether they have any of the symptoms associated with Covid-19 or if they have a history of diabetes, hypertension or obesity – factors that make people more susceptible to the disease.
The second retired intelligence official described three scenarios in which such breaches can be dangerous. “The first risk comes from any hacker who wants to profit from the data. For instance, someone can leak the data about the number of people who identified as diabetics and sell it to a company making insulin for targeted ads, or to an insurance company to deny claims.”
He said that the second is what the government itself can do. “Unfortunately, no matter what legal protocols you put in place, the sovereign can always find ways to use this data for purposes that they were not meant for.”
But it is the third use which potentially is the most hazardous, he said. “The third, and the highest risk, is from geopolitical adversaries who can use this data for a wide variety of reasons. They can misuse it to identify and target particular citizens, such as a bureaucrat or a politician, or they can simply scare people into not trusting their government with any data”, this person said, asking not to be named.
“Most state-initiated hacks are not even known to the public. What you hear about normally are amateurish attempts. The really sophisticated ones have been very hard to detect,” this person added.
Cyber criminals are known to use such data to determine multiple point of information about an individual, which can then be used to bypass identity checks for crimes such as bank account theft.
IMPENETRABLE MYTH
Fundamentally, data breaches can happen in two ways. The most common method is deceiving someone into divulging sensitive information or giving a hacker privileged access – a tactic commonly known as a phishing attack. Such tactics have been used in the past by hackers to obtain back-door access – by fooling, for instance, an IT management staff – to sensitive networks used by banks or government offices.
The other is code-based attacks on computer networks, which usually make use of flaws in software, or what are known as exploits. In some of the most sophisticated attacks, the exploit is done through a zero-day vulnerability – a backdoor that only the attacker knows about.
Both these methods have proven to work – often in combination – to compromise the more secure of systems. Zero-day hacks have been carried out by state-linked hackers and is a risk that cannot be ruled out, the second intelligence agency veteran quoted above said.
Till now, officials have not detected such an attempt on health data in India. “The data is fully secure; our encryption and data storage policies will ensure that there is no breach. Sensitive data of our citizens is kept in a manner where there is no unauthorised access to the data,” said Abhishek Singh, CEO of MyGov, one of the government agencies involved in the Aarogya Setu project.
RISE OF FAKE APPs
There is a third risk factor associated with the Aarogya Setu push – modified or impostor applications that look like Aarogya Setu but are spying tools. These have been spread using the same techniques as phishing, often through messaging applications or via links sent over WhatsApp. While this might not expose the entire database, it could compromise individuals who are successfully targeted.
The Union home ministry issued a warning in late April — the same month Aarogya Setu was launched — about such fake apps being sent to Indian soldiers and paramilitary personnel through WhatsApp, media reports said last month.
“In the current version of the app, there is no protection against an internal modification. So, it’s quite easy to create a modified version of the app. Of course, a modified version of Aarogya Setu can become viral. Especially now, (since) Aarogya Setu is a big topic in India,” said Baptiste Robert, a France-based cyber security researcher who is more commonly known by his nom de guerre Elliot Alderson.
Robert first found flaws in an earlier version of the Indian app that allowed access to internal programme files, which could lead to an attacker accessing the data the Aarogya Setu collects.
“The distribution of a modified app creates new threats. Depending on the modifications done, it can either kill the purpose (of Aarogya Setu) and remove the tracing functionality, (or) it can be used by attackers. By adding malicious code, they can infect victim’s phones and steal their personal info,” Robert added.
On May 14, researcher at anti-malware product developer ESET shared screenshots showing one such impostor application with the same logo and name as the real Aarogya Setu, but was actually spyware. “It’s SpyNote – RAT (remote access trojan) tool. It’s not created by IN govt… [Spynote can] log user keystrokes, steal SMS, wipe device, steal contact list, take camera pics, record audio, install additional apps, reset device PIN and make calls,” wrote Lukas Stefanko,
MyGov’s Singh said impostor applications were being spread and people were being asked to download it, “which is not right”. “These imposter apps cannot come on PlayStore and we have ensured that. People usually download top-rated apps from PlayStore and the Aarogya Setu is highly rated,” said Singh.
SECURITY IMPLICATIONS
Researcher Pukhraj Singh recounted several of the past hacks (see box) that extracted government personnel data, medical records and banking information. “It has hugely upset American intelligence collection programs, especially the ones relying on HUMINT (human intelligence). Maintaining intelligence cover has become close to impossible now,” he said.
“The problem is that we see databases in isolation. (But) they are like lobes to a nervous system. The more databases adversaries have access to, the more they are able to control the system,” Singh said, adding that India needs to “undertake a kind of cost-benefit assessment and a whole-of-government posture review to know what we are really doing with the data that is being collected”.
The second of the two former intelligence official quoted above concurred with the position. “Every country will have a certain capability to manage its database. Unfortunately, in the Indian administration, networks and systems are managed by L-1 contractors, or a service provider who offered the lowest prices. This creates a lot of inefficiency,” he said, adding that the issue has persisted for decades.
The second former intelligence official added: “We must build up an ecosystem based on very strong encryption, for both data security as well as network security. Protection of such databases depend on the capabilities in this fields. Unless you have very strong encryption frameworks made domestically, you will keep having all kinds of vulnerabilities.”
The other significant issue is cyber hygiene. In the past month, Robert brought to light open databases with details of citizens meant to be under home quarantine in three states: Gujarat, Madhya Pradesh and Karnataka. The databases contained locations of these individuals and their names in some cases. All of these were removed after the French researcher tweeted about.
The second former intelligence official said stronger efforts for data minimisation and anonymisation can be made in the interim.
Data minimisation refers to the principle of collecting only the basic information required for a tool’s purpose. In Aarogya Setu’s case, privacy activists say the collection of location records, profession details and granular demographic data does not follow this principle.
161 thoughts on “Protection or threat? Experts say Aarogya Setu poses national security risk”
Hello2. And Bye2.
санаторий москва кисловодск официальный сайт гостиница лидер томск
санаторий заполярье сочи официальный фото купить путевки в анапу хостел дерево
санатории дерматологического профиля курорт в санкт петербурге санаторий заполярье в сочи
санаторий увильды адрес анапа мини гостиницы
санаторий нальчик цена путевки отель глория мурманск гостиницы астрахани в центре
нарзанная галерея время работы белокуриха цены на путевки 2021 хостел лира санкт петербург
вояж гостиница санкт петербург как лечат протрузии межпозвоночных дисков
отель вавилон екатеринбург санаторий для онкологических больных подмосковье санаторий хазино официальный сайт цены
санаторий галерея палас пятигорск отзывы курорт белокуриха официальный жилье новый афон абхазия у моря
пансионаты крым отдых кмв рф
голубая лагуна коктебель хостел лайк ульяновск отель гриджио анапа
пляж прометей лазаревское крым бухта мечты сочи солнышко пансионат отель
санаторий крым мо гурзуф лучшие отели
санаторий солнечный кисловодск на карте кисловодска гостиницы в зернограде ростовской области где остановиться в геленджике недорого
гостиница интер сухум абхазия отель литфонд официальный сайт помощь с выбором
недорогие пансионаты анапы фидель отель краснодар
лучшие отели крыма для отдыха с детьми калининградский военный санаторий официальный сайт аква плаза волгодонск официальный
гостиница олимпик хабаровск официальный сайт анабель отель в питере россия алтайский край
отдых семьей в подмосковье алушта перекопская 4
отдых под севастополем казань путевки кэшбэк за поездки по россии условия
горисполком ялта официальный сайт хостел в москве на чистых прудах крым саки база отдыха
вакансии мрия резорт спа отель профессорский уголок
отель во внуково аэропорт цена лазаревское все включено а фонтанка гостиница санкт петербург официальный сайт
чебоксары гостиницы цены отель арли адлер отзывы гостевой дом черное море
санаторий золотой берег в евпатории отзывы вытяжка для шеи
отели геленджика с бассейном гостевой дом петров авеню в переславль залесский архос архипо осиповка
отдых всей семьей недорого пятитысячник ессентуки адрес аквалоо в сочи
ваш отдых где отдохнуть на алтае с детьми
пансионат октябрь кабардинка официальный сайт ассоль море пансионат искра пятигорск цены на 2021 год
гостиница краснокаменск олимп дивеево гостиница гармония качканар
туры москва крым цена санаторий дюльбер крым официальный сайт
отель гранд тамбов официальный сайт крым санаторий дружба евпатория официальный сайт sputnik abkhazia ru
санаторий мо аврора санаторий орен крым евпатория эллада нижневартовск официальный
санаторий самотлор нижневартовск лучшие санатории крыма 2021
севастополь михайловская батарея приморский санаторий дивноморское рамада домодедово
новогодние каникулы в крыму гостиница престиж питер пансионат фрунзе сочи официальный сайт
авент инн невский санкт петербург гостиница на авиамоторной москва
горки гранд красная поляна гостевой дом 7я судак санаторий в петровском казань
пансионат изумруд сочи отзывы музей ессентуки официальный сайт сергиевские минеральные воды санаторий
горячий ключ путевки на новый год гостиница дилижанс клин
санаторий старица рязанская область официальный сайт сколько стоит отдых на алтае балтберег
частные гостиницы в джемете на берегу моря энгельс парк отель улан удэ гостиница прага
гранд отель абхазия отель комфорт санатории подмосковья после инсульта
магадан лоо отзывы геленджик приморье пансионат отель рада санкт петербург
нагорная 16 сочи отель тюмени карелия в апреле
санаторий исток официальный сайт
руза пансионаты и санатории и дома отдыха
парус по
военный санаторий янтарь
санатории челябинская область официальный сайт
размещение в абхазии
отель нальчик
санаторий марфино министерства обороны рф
пансионат альянс железноводск отзывы
гостевой дом хеллас витязево отзывы
гостиница комфорт кисловодск
купить путевку в сольилецк
гостиница ейск в ейске официальный сайт
краснодарский край санатории
эллада анапа на карте
отель аравана красногорск
отель жар птица
чекмагуш гостиница
гранд флер форос
во сколько рассвет в геленджике
туры в ибицу из самары в октябре
санаторий виктория ессентуки процедуры
монерон гостиница
гостиница хоста в хосте официальный сайт
сан марина гагра
санта барбара крым официальный сайт
гостиницы вешенской
путевка мать и дитя
бронировать отель в крыму
арт отель белгород официальный
яровое отели
гостиницы витязево цены 2016
hotel one cancun
all included cancun
mexican inspired bathroom
resorts in mexico cancun
best all-inclusive hotels in cancun
resort vacations for families
sex games cancun 3
cancun resort for family all inclusive
moon palace playa del carmen reviews
beaches resort cancun
cancun all adults resorts
all-inclusive resorts with swim-up rooms adults-only cancun
best hotels in cancun all-inclusive
cheap cancun vacations
cancun resorts for couples
cancun all inclusive best deal
nicest all inclusive resorts in cancun
all inclusive cancun deals 2015
hoteles en cancun todo incluido
best rated resorts in cancun
new cancun resorts 2021
snorkeling club med cancun
cheap trips to cancun
resorts mexico cancun
hard rock cancun reviews
best all inclusive resorts in cancun for couples
levofloxacin 500mg cost levofloxacin 250mg ca
buy generic avodart order generic dutasteride order ondansetron 8mg
sildenafil 50mg sale estrace pills order generic estrace
purchase lamotrigine generic order prazosin 1mg retin cream brand
buy tadalis 20mg generic cheap voltaren order generic diclofenac 50mg
cost accutane 40mg zithromax sale generic zithromax 250mg
indocin 75mg drug indocin online buy order trimox 500mg generic
buy cialis online Fda approved viagra order sildenafil 100mg generic
order arimidex online cheap order arimidex 1 mg online sildenafil 20mg
tadalafil 40mg en france viagra 50mg pas cher viagra 100mg pour homme
order deltasone 20mg online cheap cheap cialis online no prescription order sildenafil
tadalafil 10mg bestellen sildenafil generika rezeptfrei kaufen sildenafil 50mg kaufen ohne rezept
generic isotretinoin 10mg accutane 10mg usa ivermectin brand name
order provigil 100mg pill acetazolamide 250 mg cost cheap acetazolamide
buy generic doxycycline 200mg order clomid 50mg pill order furosemide pills
order altace 10mg order temovate generic azelastine tablet
purchase buspirone pill cordarone 200mg us oxybutynin cost
buy terazosin 1mg pills leflunomide brand order azulfidine 500mg generic
alendronate 35mg usa generic famotidine order famotidine 40mg for sale
order benicar for sale depakote 500mg drug diamox 250 mg price
order prograf 5mg sale purchase labetalol pills order ursodiol 300mg without prescription
imdur cheap order isosorbide 20mg pills micardis 20mg cheap
zyban medication order generic cetirizine 10mg buy quetiapine generic
molnunat pill buy cefdinir generic prevacid pills
buy sertraline 100mg Cost viagra sildenafil 25mg
buy generic salbutamol 100mcg viagra 200mg for sale sildenafil 100mg brand
where to buy cialis viagra from canadian pharmacy brand sildenafil
order tadalafil 20mg pill cialis tablets order symmetrel online cheap
brand naltrexone 50mg order albendazole 400mg for sale abilify 20mg generic
oral dapsone buy dapsone 100mg online cheap aceon 8mg pills
buy medroxyprogesterone 10mg for sale order biltricide 600mg generic periactin pills
resort in cancun
cancun all inclusive resort deals
order modafinil 100mg pill modafinil 100mg canada ivermectin 6mg for humans for sale
buy cialis online canadian pharmacy Now, what is Zhao Ling is strength Bai Xuan and Zhang Feng were both extremely curious
best cancun excursions for couples
cancun aesthetic
cancun entertainment
paradisus rivera cancun
all inclusive vacations to cancun
mexico all inclusive cancun
generic isotretinoin 10mg isotretinoin 10mg cost order prednisone 20mg pill
package holiday to cancun
hyatt pool hours
cancun hotels adults only
cancun all inclusive adult resorts
order nootropil 800mg generic sildenafil brand sildenafil 100mg ca
paradisus all inclusive resort
adults only all inclusive resort cancun
zithromax oral azithromycin 500mg tablet gabapentin 100mg cheap
luxury resorts in cancun on the beach
cancun – all inclusive with flight
purchase cialis without prescription cialis 10mg cheap sildenafil 100mg over the counter
cialis 10mg pill order betnovate online clomipramine 25mg cheap
order chloroquine buy cenforce order olumiant 2mg sale
oral itraconazole 100 mg purchase progesterone online cheap tinidazole 500mg sale
top all inclusive resorts cancun
couples only resorts cancun
buy metformin 1000mg online buy tadalafil tadalafil pill
all inclusive holidays cancun
is cancun good for families
buy zyprexa 10mg sale valsartan 80mg tablet buy valsartan online cheap
hyatt cancun tripadvisor
hoteles me cancun
order norvasc 10mg for sale viagra next day delivery usa buy cialis 20mg sale
package all inclusive cancun
all inclusive cancun vacations with air
cancun topless resort
grand palladium costa mujeres resort & spa – all-inclusive
clozaril 50mg uk order dexamethasone 0,0,5 mg online cheap decadron medication
nicest hotels in cancun
best all inclusive resorts in cancun
sildenafil without prescription us viagra sales lisinopril 5mg over the counter
best resort near cancun
https://red-viajes.com/11-cosas-culturales-que-hacer-en-goa-mas-alla-de-las-playas-y-bares/
all invlusive cancun
https://nolier.com/article/north-goa-vs-south-goa-the-never-ending-dilemma-of-visiting-the-hippest-city-in-2022
resorts in cancun mexico on the beach
https://www.allaboutcuisines.com/cooking-school-classes/india/in/india
buy generic omeprazole 20mg eassy help poker online for fun
best hotel in cancun for adults
https://redviajess.com/11-cosas-culturales-que-hacer-en-goa-mas-alla-de-las-playas-y-bares/
golf review and reviews reputation
https://www.alebiba.pl/?d=user&id=141075
purchase zyvox without prescription zyvox 600 mg us real money casino games
order lopressor 100mg online cheap order metoprolol buy levitra 20mg generic
professional letter writing services free spins no deposit required online casino no deposit bonus
levitra 20mg over the counter vardenafil 10mg cheap buy oral methylprednisolone
college essay assistance cheap viagra buy sildenafil 50mg pill
clomid 50mg tablet empire casino online free poker games
cialis 5mg canada viagra tablet usa viagra sales
oral aristocort 10mg clarinex without prescription clarinex 5mg cost
order priligy 30mg generic levothyroxine over the counter synthroid 100mcg price
cialis mail order us female viagra cvs buy viagra 100mg for sale
generic orlistat 120mg brand diltiazem acyclovir 800mg drug
cheap generic tadalafil propranolol over the counter clopidogrel price
cialis 10mg without prescription tadalafil 5mg for sale buy clopidogrel online
purchase allopurinol pills ezetimibe online zetia over the counter
methotrexate price methotrexate 10mg over the counter buy reglan online cheap
order domperidone 10mg pills generic cyclobenzaprine 15mg cyclobenzaprine 15mg ca
oral losartan 25mg cheap esomeprazole 40mg topiramate tablet
sumatriptan 25mg sale levofloxacin 250mg tablet dutasteride sale
colchicine buy online legal online blackjack casinos online
slot games online gambling for real money real online blackjack
order tadalafil 5mg without prescription buy ciprofloxacin 500mg online cipro for sale
zocor 20mg oral brand finasteride 1mg buy finasteride 5mg pills
buy metronidazole 400mg without prescription flagyl over the counter bactrim 480mg price
diflucan for sale buy generic viagra buy sildenafil 100mg for sale
order cephalexin 250mg sale buy cleocin 150mg online order erythromycin 250mg generic
buy sildenafil pills brand sildenafil cost cialis 10mg
buy cefuroxime online careprost canada robaxin cost
gambling game best poker online real money online cialis
buy generic trazodone trazodone over the counter sildenafil 50mg cost
pay for essay purchase stromectol sale stromectol buy
sildenafil 100mg price sildenafil over the counter order lamictal 200mg pill
order deltasone 10mg prednisone over the counter brand amoxicillin
buy sildenafil 50mg buy cialis pill buy cialis 10mg sale
best online casino usa best ed drugs tadalafil 20mg drug
buy azithromycin generic buy zithromax for sale neurontin pill