India releases data-use protocols for its contact-tracing app... after five weeks and 100 million downloads

India's government has released the protocol for using data gathered by its Aarogya Setu COVID-19 tracing app, weeks after its April 2nd release and after it was downloaded almost 100 million times. The protocols [PDF], released yesterday by India's Ministry of Electronics and Information Technology (Meity), state that the …

[Pascal Monett]

"may be" uploaded on to an NIC server

It will be, rest assured of that. They're getting PII and location data, there's no way they won't hoover that up and try to monetize it later in some way or another.

You don't need location data to know if people have been in contact. It doesn't matter where they were, the app is indicating contact and that is what you're supposed to be looking for.

[Raj]

Re: "may be" uploaded on to an NIC server

The NIC isn’t in the business of monetizing anything. They manage all the national data portals and are a 45 year old government agency.

Contact tracing without location data is useless . Location describes HOW the contact occurred - in a crowded plaza, a quiet street, or something else.

[Sitaram Chamarty]

Re: "may be" uploaded on to an NIC server

With a government agency, "monetise" is not the main worry. It's "discriminate", "victimise", "marginalise", and several other things.

And I don't mean just "Big Brother ((C) George Orwell) Modi". I mean any government anywhere in the world, really, because that's what our world is looking like more and more.

That said, I agree with Raj in what he said about the NIC. Not sure about the other part though... sounds plausible, but then the google+apple API expressly prohibits it. What do they do that we are missing?

[canthinkofagoodname]

Why

From the article:

"Data collected includes the user's name, mobile number, *age, gender, and profession*, as well as which users they have been in contact with, for how long, and where they were." (emphasis added)

I understand the use case for the name / Mob / and the contact variables, but how does knowing their age, gender, and profession assist in contact tracing? My first thought would be maybe something related to behavioral patterns based on those points, but why use patterns when the app itself should tell them exactly where the user has been and for how long?