Qatar’s new coronavirus contact tracing app put more than 1 million people’s data at risk after it was unveiled with a security risk that allowed for data harvesting of the app’s users, according to Amnesty International.
Now fixed, the app is mandatory for Qatari citizens as the government tries to suppress the spread of coronavirus in the country. The country today reported 1,740 new coronavirus cases, in line with its current increasing daily case count trend.
“The vulnerability [in the app] would have allowed cyber attackers to access highly sensitive personal information, including the name, national ID, health status and location data of more than one million users,” the Amnesty International report read.
The app has so far been downloaded more than 1 million times, and those who do not use the app can face up to three years in prison.
The app relies on a color-coded QR system to alert Qataris of their health, but Amnesty reported that before authorities addressed the security issue, the QR code included personal information.
“Amnesty was able to access sensitive personal information – including names, health status and GPS coordinates of a user’s designated confinement location – as the app’s central server did not have security measures to protect such data,” the report read.
The government fixed the security flaw and added an extra layer of protection, but the watchdog group said it still had concerns about the app and its lack of privacy safeguards.
“Even now, Qatar’s app, like many being introduced, remains highly problematic due to its lack of privacy safeguards. Sensitive personal information continues to be uploaded to a central database and the authorities can enable real-time location tracking of users at any time,” the organization said.
Qatar is one of 45 countries currently using or planning to introduce contact tracing apps that are designed to help identify how coronavirus spreads, according to Amnesty.
“Contact tracing is an important component of effective pandemic response, and contact-tracing apps have the potential to support this objective. However, in order to be consistent with human rights obligations, these apps must incorporate privacy and data protection by design, meaning any data collected must be the minimum amount necessary and securely stored,” Amnesty said.
