Rights group raps Qatar over tracing app flaw

A security flaw in Qatar’s controversial mandatory coronavirus contact tracing app exposed sensitive information of more than 1 million users, rights group Amnesty International warned on Tuesday.

The glitch, which was fixed on Friday after being flagged by Amnesty a day earlier, made users’ ID numbers, location and infection status vulnerable to hackers.

Privacy concerns over the app, which became mandatory for residents and citizens on pain of prison from Friday, had already prompted a rare backlash and forced officials to offer reassurance and concessions.

Users and experts had criticized the array of permissions required to install the app including access to files on Android devices, as well as allowing the software to make unprompted phone calls.

Despite insisting the unprecedented access was necessary for the system to work, officials said they would address privacy concerns and issued reworked software over the weekend. “Amnesty International’s

Security Lab was able to access sensitive information, including people’s name, health status and the GPS coordinates of a user’s designated confinement location, as the central server did not have security measures in place to protect this data,” the rights group said in a statement.

More than 47,000 of Qatar’s 2.75 million people have tested positive for the respiratory disease — 1.7 percent of the population — and 28 people have died.

The app “Etheraz,” which means “Precaution,” continues to allow real-time location tracking of users by authorities at any time, Amnesty said.

“It was a huge security weakness and a fundamental flaw in Qatar’s contact tracing app that malicious attackers could have easily exploited,” said Claudio Guarnieri, head of the group’s security lab. “The Qatari authorities must reverse the decision to make use of the app mandatory,” he said.

Amnesty International’s Security Lab was able to access sensitive information.