How does Aarogya Setu work? Is it secure?

In the last few weeks, much has been said, discussed and debated on whether the Indian government's Aarogya Setu app compromises the user's data or whether it is a tool of mass surveillance. The app was developed for coronavirus contact tracing.

Most recently, a French cybersecurity expert who goes by the name Elliot Anderson on Twitter, said he had found a "security issue" in the app that could put the data of its 90 million users at risk. The Indian government responded that there was "no data or security breach" and that "no personal information of any user has been proven to be at risk by this ethical hacker".

A home ministry order has made the app mandatory for public and private sector workers. And not having the app on your phone is now a punishable offence in Noida.

But if you are wondering how Aarogya Setu works and where your data goes, this infographic breaks it down. It's based on the app's privacy policy and this interview with Lalitesh Katragadda, who has worked on the app, and Raman Jit Singh Chima, founder of the Internet Freedom Foundation.

Editor's note: The author isn't a medical professional or a software development expert, and is not affiliated with the government. This infographic makes no claims about the safety or security of using Aarogya Setu.

Also listen: Let's Talk About: Privacy