• About Us
    • Fact Checking Policy
    • Ownership & funding information
    • Volunteer
  • Subscribe
  • Letter submission
    • Submissions Policy
  • Contact Us
The Online Citizen Asia
  • Opinion
    • Editorial
    • Commentaries
    • Letters
    • Comments
  • Current Affairs
    • Singapore
    • Malaysia
    • Indonesia
    • China
    • ASEAN
    • Asia
    • International
  • Finance
    • Economics
    • Labour
    • Property
    • Business
  • Community
    • Arts & Culture
    • Consumer Watch
    • NGO
    • Lifestyle
    • Travel
  • Politics
    • Civil Society
    • Parliament
    • Transport
    • Education
    • Environment
    • Health
    • Housing
  • Law & Order
    • Legislation
    • Court Cases
No Result
View All Result
  • Opinion
    • Editorial
    • Commentaries
    • Letters
    • Comments
  • Current Affairs
    • Singapore
    • Malaysia
    • Indonesia
    • China
    • ASEAN
    • Asia
    • International
  • Finance
    • Economics
    • Labour
    • Property
    • Business
  • Community
    • Arts & Culture
    • Consumer Watch
    • NGO
    • Lifestyle
    • Travel
  • Politics
    • Civil Society
    • Parliament
    • Transport
    • Education
    • Environment
    • Health
    • Housing
  • Law & Order
    • Legislation
    • Court Cases
No Result
View All Result
The Online Citizen Asia
No Result
View All Result

S’porean coder highlights data privacy concern in contact tracing app for sending user data to government data collection service

by The Online Citizen
03/04/2020
in Current Affairs, Tech
Reading Time: 4 mins read
0

In a blog post on 28 March, a Singaporean coder raised concern on data privacy from the recently introduced contact tracing app called TraceTogether, suggesting that the app sends user data to a government data collection service.

Recently, SGUnited, GovTech, and the Ministry of Health (MOH) introduced TraceTogether for Singaporeans to track close contacts.

The app uses Bluetooth to identify other nearby phones with the app installed. It then tracks the distance between users that are in close proximity. If the need arises, the information will be used to identify close contacts based on the proximity and duration of an encounter between users.

Upon hearing about the app, Kevin Chu, a coder and software developer, decided to satisfy his curiosity by testing the app to see how it works. However, Mr Chu noticed something was amiss regarding the data collection process of the app.

While he was going through the code, he saw that the app was using Firebase Analytics and Crashlytics. Although he hinted that “it is common for apps to use these two analytics libraries to track user engagement and app crashes”, he pointed out that the “inclusion of such libraries undermines the developers’ goal to keep data collection minimal”.

What’s more, Mr Chu also spotted another library that was included in the app called Snowplow Analytics. He said it was the first time he heard about it, and a quick Google-search showed that it is an open-sourced analytics platform with traces leading to an obscure domain “snowplow-mobile.wogaa.sg“.

Weird domain
mS.m3744(context, environment) initialises the tracking
Tracking is initialised in these files

Wogaa is a government data collection service that logs users’ IP addresses, device type, carrier, location, etc.

Interestingly, it turns out that wogaa.sg is actually a government data collection service.

“The FAQ on wogaa describes itself as ‘a centralized internet-facing government platform to analyze and improve digital services’. A quick look at wogaa’s documentation tells me that it can log user ip addresses, device type, carrier etc and deduce the user’s location based on this information. With this library packaged in the app, there’s no point in anonymising any information because your data is logged on another service anyway.” said Mr Chu in his blog post.

Wogaa’s website
Part of Wogaa’s data glossary
Checking if data from the app has been received before on wogaa’s website

Next, he used a proxy to intercept the requests to wogaa to find out what data is sent back. From what he gathered, there were 19 requests sent to wogaa – from download to setup.

A raw request can be viewed here.

Part of a request to Wogaa

“Clearly, some parts of the app’s FAQ are wrong. I went back to the press releases and tried to verify statements about the app. On data hygiene, I found that all data is uploaded even if the data is older than 21 days. There is no code to purge local data beyond a certain time,” noted Mr Chu.

After that, he contacted the team behind the app to ask them about his findings.

“Their response was that wogaa is built by the same team and it’s standard practice to include wogaa in their products. They overlooked the fact that the app is sending more data than necessary so they’re removing wogaa and working to purge local data after 21 days in the next update,” Mr Chu wrote.

He complimented the team for their effort, saying that “they are a team with great intentions”. He went on to recommend users to install the app after the update has been rolled out to ensure there are no grey areas surrounding users’ data privacy.

“Otherwise, this app is a great initiative to improve our contact tracing efforts,” Mr Chu concluded.

App’s FAQ section says data collected is anonymised and encrypted, and is used to improve the app

Referring to the app’s FAQ section, which was updated on 1 April, it is said that with users consent, TraceTogether exchanges Bluetooth proximity data with nearby phones running the same app. “However, this data is anonymised and encrypted, and does not reveal your identity or the other person’s identity. Also, this data is stored only on the user’s phone.”

Additionally, it is also stated that anonymised analytics data is used to improve the app. “TraceTogether collects anonymised analytics data about your device and app (e.g. device model, app version) to help us improve the app to work across different phone models.

TOC has reached out to the team at TraceTogether to verify if Mr Chu’s concern has been properly addressed with the removal of wogaa and purging of local data after three weeks, and have yet to receive a reply.

Meanwhile, there doesn’t seem to be any update on Mr Chu’s blog since he voiced his concern on this issue last Saturday (28 March).

For just US$7.50 a month, sign up as a subscriber on The Online Citizen Asia (and enjoy ads-free experience on our site) to support our mission to transform TOC into an alternative mainstream press.

Related Posts

Commemorative coin, exhibitions and various activities to mark 100th anniversary of Lee Kuan Yew’s birth
Singapore

Commemorative coin, exhibitions and various activities to mark 100th anniversary of Lee Kuan Yew’s birth

07/02/2023
国会内庆妇女节 女议员获赠鲜花
Labour

15 companies barred from hiring new foreign employees after serious safety lapse found at worksite

07/02/2023
Why is Gautam Adani’s Indian empire in turmoil?
AFP

India’s Adani Enterprises shares rocket 20%, trading suspended

07/02/2023
China’s Baidu says developing AI chatbot
AFP

China’s Baidu says developing AI chatbot

07/02/2023
Thai rescuers dig to free baby trapped down well
AFP

Thai rescuers dig to free baby trapped down well

07/02/2023
Desmond Lee says 70% of BTO flats affordable for median household with income of S$8,400 but what about the 10th to 40th percentile?
Housing

Desmond Lee says 70% of BTO flats affordable for median household with income of S$8,400 but what about the 10th to 40th percentile?

07/02/2023
Subscribe
Connect withD
Login
I allow to create an account
When you login first time using a Social Login button, we collect your account public profile information shared by Social Login provider, based on your privacy settings. We also get your email address to automatically create an account for you in our website. Once your account is created, you'll be logged-in to this account.
DisagreeAgree
Notify of
Connect withD
I allow to create an account
When you login first time using a Social Login button, we collect your account public profile information shared by Social Login provider, based on your privacy settings. We also get your email address to automatically create an account for you in our website. Once your account is created, you'll be logged-in to this account.
DisagreeAgree
0 Comments
Inline Feedbacks
View all comments

Latest posts

Commemorative coin, exhibitions and various activities to mark 100th anniversary of Lee Kuan Yew’s birth

Commemorative coin, exhibitions and various activities to mark 100th anniversary of Lee Kuan Yew’s birth

07/02/2023
国会内庆妇女节 女议员获赠鲜花

15 companies barred from hiring new foreign employees after serious safety lapse found at worksite

07/02/2023
Why is Gautam Adani’s Indian empire in turmoil?

India’s Adani Enterprises shares rocket 20%, trading suspended

07/02/2023
China’s Baidu says developing AI chatbot

China’s Baidu says developing AI chatbot

07/02/2023
Thai rescuers dig to free baby trapped down well

Thai rescuers dig to free baby trapped down well

07/02/2023
Desmond Lee says 70% of BTO flats affordable for median household with income of S$8,400 but what about the 10th to 40th percentile?

Desmond Lee says 70% of BTO flats affordable for median household with income of S$8,400 but what about the 10th to 40th percentile?

07/02/2023
Returning Officer to issue corrective directions, overseas Singaporeans allowed to vote by post, among changes to laws tabled to Parliament

Returning Officer to issue corrective directions, overseas Singaporeans allowed to vote by post, among changes to laws tabled to Parliament

07/02/2023
Can Malaysia review its current practices on foreign worker management?

Can Malaysia review its current practices on foreign worker management?

07/02/2023

Trending posts

Cognizant India transfers staff to work in Singapore as recently as this year

Local IT grads can’t find jobs while engineers constantly transferred from India to work in SG under CECA

by Correspondent
05/02/2023
105

...

They have done a fine job of confusing us about the jobs situation

They have done a fine job of confusing us about the jobs situation

by Augustine Low
01/02/2023
47

...

Adani’s brother runs SG company and registers as director with local ID

Adani’s brother runs SG company and registers as director with local ID

by Correspondent
03/02/2023
26

...

No response from Josephine Teo on whether Mediacorp has been instructed to stop coverage of SMT circulation scandal

No response from Josephine Teo over alleged blackout of coverage by Mediacorp over SMT circulation scandal

by Terry Xu
06/02/2023
12

...

Former Singaporean shares change of life in Australia with annual pay of S$80,000 as a plumber

Former Singaporean shares change of life in Australia with annual pay of S$80,000 as a plumber

by Yee Loon
30/01/2023
25

...

Japanese-Canadian junior high school girl breaks national record with 3km in 9:02 mins

“I want my normal life back,” Sherry Drury withdraws from National Junior High School Tournament due to overheated public attention

by Yee Loon
06/02/2023
3

...

April 2020
M T W T F S S
 12345
6789101112
13141516171819
20212223242526
27282930  
« Mar   May »

The Online Citizen is a regional online publication based in Taiwan and formerly Singapore’s longest-running independent online media platform.

Navigation

  • Editorial
  • Commentaries
  • Opinion
  • Politics
  • Community

Support

  • Contact Us
  • Letter submission
  • Membership subscription

Follow Us

  • Facebook
  • Twitter
  • YouTube
  • Instagram
  • Fact Checking Policy
  • Privacy Policy

© 2022 - 2023 The Online Citizen Asia

No Result
View All Result
  • Opinion
    • Editorial
    • Commentaries
    • Comments
  • Current Affairs
    • Malaysia
    • Indonesia
    • China
    • ASEAN
    • Asia
    • International
  • Finance
    • Economics
    • Labour
    • Property
    • Business
  • Community
    • Civil Society
    • Arts & Culture
    • Consumer Watch
    • NGO
  • Politics
    • Parliament
    • Transport
    • Education
    • Environment
    • Health
    • Housing
  • Law & Order
    • Legislation
    • Court Cases
  • Lifestyle
    • Travel
  • Subscribers login

© 2022 - 2023 The Online Citizen Asia

wpDiscuz