aziqbal
SENIOR MEMBER
- Joined
- Aug 26, 2010
- Messages
- 7,403
- Reaction score
- -10
- Country
- Location
Chinese Communist Party can access athletes' personal data through compulsory Winter Olympics app
'Simple but devastating flaw' in the encryption of the MY2022 app could allow Beijing to access attendees' private information
ByOur Foreign Staff18 January 2022 • 5:33pm
A smartphone app that is required to installed by be all attendees of the upcoming Beijing Winter Olympic Games has encryption flaws that could allow personal information to be stolen, a cyber security watchdog said on Tuesday.
The "simple but devastating flaw" in the encryption of the MY2022 app, designed to monitor the spread of Covid, is mandatory for athletes, journalists and other attendees of the Games in China's capital, could allow health information, voice messages and other data to leak, warned Jeffrey Knockel, author of the report for Citizen Lab.
MY2022's innocent-looking home screen (left) and user interface
Citizen Lab notified the Chinese Olympic organising committee of the issues in early December, giving them 15 days to respond and 45 days to fix the problem, but has so far received no reply.
"China has a history of undermining encryption technology to perform political censorship and surveillance," Mr Knockel wrote.
Advertisement
Advertisement : 9 sec
"As such, it is reasonable to ask whether the encryption in this app was intentionally sabotaged for surveillance purposes or whether the defect was born of developer negligence," he continued, adding that "the case for the Chinese government sabotaging MY2022's encryption is problematic".
According to MY2022’s description in Apple’s App Store, the app implements a wide range of communication functionalities including real-time chat, news feeds, and file transfers.
The app may violate both Google and Apple policies around smartphone software, and "also China's own laws and national standards pertaining to privacy protection, providing potential avenues for future redress," he wrote.
'Simple but devastating flaw' in the encryption of the MY2022 app could allow Beijing to access attendees' private information
ByOur Foreign Staff18 January 2022 • 5:33pm
A smartphone app that is required to installed by be all attendees of the upcoming Beijing Winter Olympic Games has encryption flaws that could allow personal information to be stolen, a cyber security watchdog said on Tuesday.
The "simple but devastating flaw" in the encryption of the MY2022 app, designed to monitor the spread of Covid, is mandatory for athletes, journalists and other attendees of the Games in China's capital, could allow health information, voice messages and other data to leak, warned Jeffrey Knockel, author of the report for Citizen Lab.
MY2022's innocent-looking home screen (left) and user interface
Citizen Lab notified the Chinese Olympic organising committee of the issues in early December, giving them 15 days to respond and 45 days to fix the problem, but has so far received no reply.
"China has a history of undermining encryption technology to perform political censorship and surveillance," Mr Knockel wrote.
Advertisement
Advertisement : 9 sec
"As such, it is reasonable to ask whether the encryption in this app was intentionally sabotaged for surveillance purposes or whether the defect was born of developer negligence," he continued, adding that "the case for the Chinese government sabotaging MY2022's encryption is problematic".
According to MY2022’s description in Apple’s App Store, the app implements a wide range of communication functionalities including real-time chat, news feeds, and file transfers.
The app may violate both Google and Apple policies around smartphone software, and "also China's own laws and national standards pertaining to privacy protection, providing potential avenues for future redress," he wrote.
Chinese Communist Party can access athletes' personal data through compulsory Winter Olympics app
'Simple but devastating flaw' in the encryption of the MY2022 app could allow Beijing to access attendees' private information
www.telegraph.co.uk