Gauteng e-Panic App: Data Breach Exposed Sensitive User Data

• The Gauteng government's e-Panic app exposed sensitive personal details, crime reports, images, and location histories due to an unsecured database, though these problems have since been fixed.
• Accessible data included names, contact information, vehicle registrations, detailed crime descriptions, and GPS coordinates, some dating back to 2024.
• One-time pins (OTPs) for app login were also compromised, allowing potential unauthorized access to user accounts.
• The app's security claims on its website and Google Play Store (which still asserts no data collection or sharing) contradict the findings of the GroundUp investigation, which found no evidence of data obfuscation.
• This incident represents a significant POPIA compliance failure for the Gauteng government, raising concerns about user safety and potential legal liability.

This extensive Gauteng government app security failure highlights significant POPIA compliance e-Panic app shortcomings.

The Gauteng government's e-Panic application, designed to facilitate crime reporting and emergency assistance for residents, was found to harbor a critical security flaw. An investigation by GroundUp revealed that the database supporting the app was left unsecured, rendering a vast array of sensitive user information publicly accessible. GroundUp alerted the Gauteng government and the IT company to these problems, which have since been fixed. This significant Gauteng e-Panic app data breach was uncovered through a straightforward analysis of the application's connections, a process that did not involve any illegal activities or hacking and could be replicated by any tech-savvy computer user.

The exposed data encompassed a wide spectrum of personal and crime-related details. This included users' full names, gender, age, telephone numbers, email addresses, and vehicle registration numbers. Beyond basic personal identifiers, the breach also laid bare detailed crime reports, including those alleging domestic violence, assault, theft, and drug-related offenses. Critically, these reports often contained descriptions that named alleged perpetrators, and any images uploaded by users in connection with their reports were also accessible.

The security lapse extended to highly sensitive location data, which could reveal intricate movement patterns rather than just static emergency points. Every crime report lodged through the app included precise GPS coordinates. Furthermore, a separate section of the database contained comprehensive location histories, detailing coordinates, direction of movement, speed, and even battery information. This historical data stretched back to the app's inception in 2024, despite much of it ideally having been purged by now. The application itself, specifically Android version 0.0.18, extensively utilizes background location tracking, requesting permission to access a user's location even when not actively in use, a practice also endorsed by government flyers promoting the app.

Adding to the severity of the e-Panic app personal data exposed, one-time pins (OTPs) used for user registration and login were also compromised. These six-digit codes, typically sent via SMS for authentication, were stored in an exposed part of the system, indexed by users' cellphone numbers. This vulnerability meant that an individual aware of a registered user's cellphone number could potentially request a new login code and then retrieve it directly from the unsecured database, effectively bypassing the intended security measure.

The findings of the GroundUp e-Panic investigation stand in stark contrast to the security assurances provided by the Gauteng government. The ePanic website, under a section dedicated to data security, explicitly states the implementation of "administrative, technical, and physical security measures" to safeguard personal information, including the use of "end-to-end encryption and obfuscation of personally identifiable information where possible." However, the investigation found no evidence of data obfuscation, directly refuting these claims.

Further discrepancies emerged when examining the app's presence on the Google Play Store. As of the time of the investigation, the app's Google Play page asserted that no data is collected and no data is shared with third parties, information attributed to the developer. This claim is fundamentally at odds with the app's core functionality, which necessitates the processing and storage of user accounts, locations, crime reports, and photographs to deliver its advertised services. The current Android app also requests permissions for background location, camera, and microphone access, and interacts with at least three distinct services, including the chat application Discord, raising further questions about data handling and third-party interactions. It is also noted that Apple users receive different information regarding the app's data practices.

This extensive Gauteng government app security failure highlights significant POPIA compliance e-Panic app shortcomings. The Protection of Personal Information Act (POPIA) mandates stringent measures for safeguarding personal data, and the exposure of such sensitive information, including names, contact details, location histories, and detailed crime reports, represents a clear breach of these obligations. The ability to link sensitive crime reports directly to the individuals who lodged them, coupled with the accessibility of login credentials, creates substantial risks for users, including potential identity theft, harassment, and further victimization.

The incident raises serious questions about the Gauteng government's adherence to data protection principles and its responsibility to citizens. The South Africa data protection breach could lead to considerable legal and reputational consequences for the provincial government, potentially exposing it to liability under POPIA. This situation underscores the critical need for robust data protection frameworks and rigorous security audits for all public sector applications, especially those handling highly sensitive personal and emergency-related information.

This incident highlights significant POPIA compliance failures by a government entity, creating potential liability for the Gauteng government and raising concerns for citizens whose sensitive data was exposed. Lawyers and compliance officers should advise clients on the implications of government data breaches, potential avenues for redress, and the need for robust data protection measures in public sector applications.

Source: Original reporting via GroundUp