The Indian Railways, which had on Monday “advised” the passengers availing the special trains that started operating on Tuesday to install the government’s Aarogya Setu mobile application, has now made it “mandatory” to do so.

While the guidelines issued by the railways for the 15 pairs of special trains running between Delhi and major cities of the country did not say installing the mobile app was mandatory, a late night (12:24 am) tweet by the railway ministry made it compulsory.

“Indian Railways is going to start few passenger train services. It is mandatory for passengers to download Aarogya Setu app in their mobile phones, before commencing their journey,” the tweet said.

Sources said it was made mandatory after a Union Ministry of Home Affairs (MHA) missive, following Prime Minister Narendra Modi’s meeting with chief ministers.

Passengers, who do not have the app installed on their mobile phones, might be asked to do so after their arrival at the station, they added.

However, there is no clarity yet on if and how the app will be enforced, officials said, as the Supreme Court, in a directive, has said making it mandatory is illegal.

The Aarogya Setu app has been installed on 9.8 crore smartphones so far and is used by the government for contact-tracing and disseminating medical advisories to users in order to contain the spread of COVID-19.

The MHA has also said installing the mobile app will be a must for those living in the COVID-19 containment zones.

Aarogya Setu has come under scanner by professional hackers and technology experts for its privacy and data collection issues. A report by Massachusetts Institute of Technology (MIT) website Technology Review said, “India is currently the only democratic nation in the world that is making its coronavirus tracking app mandatory for millions of people, according to MIT Technology Review’s Covid Tracing Tracker, a database of global contact tracing apps.”

Despite calling it a voluntary decision to install the app, government has been pushing to make the app mandatory in various ways. Central government employees are required to use it, while major private employers and landlords are mandating it as well. Noida made the app mandatory by fining and even threatening to arrest anyone who fails to install the app on their phone.

Opposition leaders like Rahul Gandhi and Asaduddin Owaisi have questioned the dependability of the app.

The Arogya Setu app, is a sophisticated surveillance system, outsourced to a pvt operator, with no institutional oversight – raising serious data security & privacy concerns. Technology can help keep us safe; but fear must not be leveraged to track citizens without their consent.

— Rahul Gandhi (@RahulGandhi) May 2, 2020

Gandhi’s apprehensions regarding the app were looked into by French hacker Elliot Alderson on Twitter who also flagged the flaws in the app.  The app’s user agreement states that the data can be used in the future for purposes other than epidemic control if there is a legal requirement. The privacy policy of the app states that the data on the app may be shared with as many agencies as the government sees fit.

Hi @SetuAarogya,

A security issue has been found in your app. The privacy of 90 million Indians is at stake. Can you contact me in private?

Regards,

PS: @RahulGandhi was right

— Elliot Alderson (@fs0c131y) May 5, 2020

Organisations like Internet Freedom Foundation have filed Right to Information queries seeking information regarding the legislative framework, guidelines and governmental committees governing the use of the app. However the ministry replied that they do not hold any such information.

@MoHFW_INDIA has replied to the RTI stating that they do not hold any such information and RTI request is being transferred to the National Informatics Centre. An RTI filed with the @GoI_MeitY received a similar response.
(2/6) pic.twitter.com/OkC9FF2gio

— Internet Freedom Foundation (IFF) (@internetfreedom) April 27, 2020

Experts have said that the app does not meet international standard of similar COVID-19 tracing apps like that in the UK, Singapore, South Korea.