Gauteng e-Gov: e-Panic Button Security Flaws Exposed User Data

• The Gauteng Department of e-Government falsely claimed an "attempted data breach" of its e-Panic Button app was resolved without compromising personal information.
• GroundUp's report revealed the app's database was openly accessible, exposing sensitive data like names, phone numbers, GPS coordinates, and crime reports.
• The data exposure was not a hack but a fundamental security flaw, easily discovered by downloading the app and observing its connections.
• Evolve Value Added Services, the app's developer, acknowledged and fixed the vulnerabilities on the backend after GroundUp's responsible disclosure.
• The incident highlights critical POPIA compliance failures and the need for stricter data protection in government IT projects, despite the Gauteng government's lack of direct engagement with GroundUp.

The open exposure of sensitive personal data, including location histories and crime reports, represents a clear violation of data protection principles outlined in South Africa's data protection law.

The Gauteng Department of e-Government recently issued a statement addressing significant security flaws within its e-Panic Button application, a critical tool designed for public safety. The department asserted that it had encountered an "attempted data breach" which was swiftly identified and resolved, claiming that no personal information belonging to citizens had been compromised. This official communication, released on a Monday evening, further suggested that the incident involved a "specialised organisation" possessing advanced cybersecurity testing capabilities.

MEC for e-Government, Bonginkosi Dhlamini, reinforced this narrative, stating that the purported testing was conducted by an entity with specific expertise and tools, implying that such an event could not be replicated by an average IT professional. However, this official account directly contradicted a report by GroundUp, which had earlier detailed how the Gauteng panic app data exposure had left sensitive user information openly accessible. The government's website had also erroneously claimed that user data was obfuscated, a claim unequivocally disproven by GroundUp's findings.

GroundUp's investigation into the Gauteng e-Panic Button security flaws revealed that the database was not secured, allowing direct access to a wealth of personal information. This included crime reports, users' names, phone numbers, GPS coordinates, historical location data, and even one-time PINs used for app login. The ease of access to such sensitive data raised immediate concerns regarding the application's integrity and the broader implications for public trust in government-provided digital services.

Contrary to the Gauteng Department of e-Government's portrayal of a sophisticated cyberattack by a "highly specialised organisation," GroundUp clarified that its report was the result of journalistic inquiry, not advanced hacking. Joel Cedras, a student and part-time software developer who authored the report, simply downloaded the e-Panic Button app—a publicly available action—and observed its network connections. He did not employ any obscure or advanced tools; the database was openly accessible, requiring no password guessing or circumventing of security measures. This demonstrated that the data exposure was not an "attempted breach" but rather a fundamental security oversight.

Following GroundUp's responsible disclosure, Evolve Value Added Services, the developers behind the e-Panic app, acknowledged the reported issues. In an email to GroundUp, Evolve expressed appreciation for the responsible manner in which the vulnerability was brought to their attention, confirming that the problems had been addressed on the backend. These crucial fixes were implemented without requiring users to update the application, indicating a server-side resolution to the Gauteng e-Panic Button security flaws.

Despite the Gauteng Department of e-Government's statement claiming direct engagement with the "organisation" to resolve vulnerabilities, GroundUp reported a distinct lack of communication from government officials. GroundUp's director, Nathan Geffen, made multiple attempts to contact department spokespersons over 36 hours before publishing their exposé, but received no direct response from any Gauteng government employee. This silence from the government, contrasted with the prompt and cooperative response from Evolve Value Added Services, highlights a concerning lack of transparency and accountability.

This incident underscores significant POPIA compliance risks for government entities and their IT contractors in South Africa. The open exposure of sensitive personal data, including location histories and crime reports, represents a clear violation of data protection principles outlined in South Africa's data protection law. The recurring pattern of IT incompetence in state systems, often linked to multi-million-rand contracts, necessitates rigorous data protection audits and enhanced due diligence in public sector technology procurement to prevent similar data exposure liabilities and safeguard citizens' information.

This incident highlights significant POPIA compliance risks for government entities and their IT contractors in South Africa, underscoring the need for rigorous data protection audits and due diligence in public sector technology procurement to avoid similar data exposure liabilities.

Source: Original reporting via GroundUp