What Is Great About Open Sourcing Contact Tracing Apps?

contact tracing open source

Governments across the world have been working to deploy contact tracing apps in order to curb the spread of Covid-19. But many experts have raised concerns how such applications can potentially breach the privacy of citizens. Privacy concerns could be real, and personal data collection could be problematic. This may prevent a lot of people installing it.

So, while governments are not going to stop their efforts of deploying such applications, there are proposals being made to make contact tracing apps open-source. Some countries have already done that to serve as a way to reassure the public of any data mishandling. 

For example, countries such as Singapore have actually moved away from centralised systems to more open and decentralised systems to maintain the privacy of citizens. The contact tracing software, which is open-source, can be verified by citizens. 

In Singapore, the government has released the protocol reference documents, and reference implementation for apps such as TraceTogether, which similar to Aarogya Sets is based on a Bluetooth protocol. Singapore’s Trace Together app under the GPL-3.0 open-source licence is available on Github. 

As part of the innovation, a digital contact tracing protocol, BlueTrace, was developed, with an open-source reference implementation, OpenTrace. It has since been regarded for appropriation by many other countries, including New Zealand, and Australia.

Making Aarogya Setu Open-Source

So, should the Indian government also follow this route and make Aarogya Setu open-source? Experts say this can help maintain privacy, transparency of code, and how data is being used.

According to media reports, the government may also soon do that. Arnab Kumar, programme director, Niti Aayog, said in a media report that the government is looking to make it open-source. 

Being open-source can bring to light many vulnerabilities in the code. Despite not being open-source, Elliot Alderson, an ethical hacker on Twitter claimed he had revealed a security issue with Aarogya Setu, saying the data privacy of 90 million Indians was at stake.

The developers behind Aarogya Setu thanked the ethical hacker for engaging with the team. Now, imagine thousands of researchers and developers working on the application to ensure millions of data belonging to Indian citizens remains secure. And that could only happen if the application were made open-source. 

Benefits Of Open-Source In The Context Of Contact Tracing

There have been times when there security flaws or vulnerabilities have been found across contact tracing applications. If the contact tracing application like Arogya Setu is made open-source, this may lead to a step towards ensuring the application does not misuse data, as well as have extra eyeballs from thousands of developers, technology companies and privacy activists. 

One of the other benefits of open-source is that it gives away to a decentralised design allowing for a cooperative framework where multiple entities can contribute to and improve on software vulnerabilities. It also ensures that malicious entities do not misuse the software or find a way to gain access to data, or build a backdoor via the application. This way, open-source security researchers and bug bounty hunters can test the application to discover and report all bugs and vulnerabilities.

Also, being open-source also helps in bringing in more innovation cycles and closing the gaps in software more quickly. As software and systems are open-source, it can be audited from multiple parties making the code more robust and maintaining transparency. This is something that the Indian government can implement with their contact tracing application.

Open-source platforms like GitHub makes it easier to report vulnerabilities and having the right patches made quickly. In fact, with new features on GitHub, the platform makes keeping track of vulnerability and automating the patching. Open-source would also help build the right standards and technical specifications for contact tracing applications.

Vishal Chawla
Vishal Chawla is a senior tech journalist at Analytics India Magazine and writes about AI, data analytics, cybersecurity, cloud computing, and blockchain. Vishal also hosts AIM's video podcast called Simulated Reality- featuring tech leaders, AI experts, and innovative startups of India.

Download our Mobile App

MachineHack | AI Hackathons, Coding & Learning

Host Hackathons & Recruit Great Data Talent!

AIMResearch Pioneering advanced AI market research

With a decade of experience under our belt, we are transforming how businesses use AI & data-driven insights to succeed.

The Gold Standard for Recognizing Excellence in Data Science and Tech Workplaces

With Best Firm Certification, you can effortlessly delve into the minds of your employees, unveil invaluable perspectives, and gain distinguished acclaim for fostering an exceptional company culture.

AIM Leaders Council

World’s Biggest Community Exclusively For Senior Executives In Data Science And Analytics.

3 Ways to Join our Community

Telegram group

Discover special offers, top stories, upcoming events, and more.

Discord Server

Stay Connected with a larger ecosystem of data science and ML Professionals

Subscribe to our Daily newsletter

Get our daily awesome stories & videos in your inbox