Since I wrote the article on permissions on COVID KAYA and Stay Safe and I am the one who created the analysis and blog on the first place let me answer some of the questions on the first study. We are not singling Stay Safe, and we are not even attacking Mutlisys that is why we have a parity with COVID-Kaya that is being used by WHO and DOH. The analysis on the permission is just a first step and after the blog went viral the Data Protection Exchange (DPEX) Network of Straits Interactive (Singapore based) even had a webinar on the “Comparative Review of Contact Tracing Apps in the ASEAN countries that includes an analysis of Stay Safe. The analysis of DPEX is part of the published report of the Global Privacy Enforcement Network.
The GPENs sweep were benchmarked survey parameters which conducted a global privacy sweep of mobile apps. That sweep involved the participation of 25 privacy enforcement authorities around the world.
It assessed the following:
- the types of permissions sought by a surveyed app
- whether those permissions exceeded based on the app’s functionality and privacy notice
- most importantly, how the app explained to consumers why it wanted the personal data and what it planned to do with it
Let us explain first what a “PERMISSION” in a mobile application is. A permission in an app protects the privacy of the user of the app. Every application developer must include an “app manifest” which is a list of permissions (libraries) that the app uses.
Every phone has an operating system like what we have in our laptops, tablets and PCs. In mobile the commonly used are IOS and Android and permissions are categorized into two:
- Normal permissions
- This kind of permission do not directly risk the user’s privacy
- Dangerous permissions
- This kind of permissions give the application access to the user’s personal data in their mobile phone, such as contacts and SMS messages, as well as certain system features, such as the camera and location data.
- If a dangerous permission is requested, privacy laws do not allow personal data to be collected or disclosed unless the user gives consent
- In addition, privacy laws such as the GDPR, PDPA or our RA 10173 (Data Privacy Act) generally restrict “dangerous permissions” to personal data that the app may collect, use or disclose while the user is actually using it. They do not allow apps to collect, use or disclose personal data simply because the user downloaded the app.
To illustrate we have listed the dangerous permissions:
| Permission Categories | Permissions | Stay Safe | COVID KAYA |
| Camera | Camera | Yes | Yes |
| Contacts | Read Contacts Write Contacts Delete Contacts Get Accounts | Yes | Yes |
| Location | Access Fine Location Access Coarse Location Bluetooth | Yes | Yes |
| Microphone | Record Audio | Yes – as by product of Camera | Yes |
| Phone | Read Phone State Call Phone Read Call Log Write Call Log Add voice mail Process Outgoing Calls | Yes | Yes |
| SMS | Send SMS Receive SMS Read SMS Receive WAP Push Receive MMS | Yes – even if they are not accessing it directly they have turned on Contacts and Phone Permissions that eventually using this permission | Yes |
| Calendar | Read Calendar Write Calendar | Yes | |
| Storage | Read External Storage Write External Storage | Yes | Yes |
| Settings | Write Settings | Yes |
As per DPEX and GPEN the following apps have dangerous permissions. The danger here, most of the time people just accepting the app and disregarding the privacy notice and the permissions of the app, privacy notice is really a promise of the developer to safeguard and protect the privacy of its stakeholders.
Among the ASEAN tracing apps it is good to note that Singapore’s Trace Together and Vietnam’s Blue Zone use the least permissions.
If you look at the table above the study done by DPEX only gets the direct permission and not considering the by-product of other permissions and definitely it is more than 7 for Stay Safe (11).
Below are some potential risks if these permission are abused by either its developers or threat actor (hacker):
| Permissions | If abused |
| Camera | Even if the camera permission is accessed it can also access audio or microphone permissions. So, if abused by a threat actor the app can watch the user via the camera and can eavesdrop on conversation without you knowing it. |
| Device App and History | Using this permission reads sensitive phone data, retrieve system phones state – call log, call state, information browsing and history. In addition to reading accounts and logs rom other apps, apps using this permission can store usernames and passwords. |
| Location | Apps using this permission can identify the user’s location within several feet and track their every movement. We need to note that even if users don’t open GPS and only Bluetooth the Bluetooth uses its mother Permission Library which is part of the GPS locator Access Coarse Location – access WIFI and Cell Sites and if abused can triangulate your whereabouts This can easily be used as a surveillance app to track whereabouts |
| Media Storage | Apps using this permission can read the contents of the user’s shared storage (USB device and SD card) as well as format their entire external storage device. |
| Calendar | If abused the threat actor will know your appointments and your location as well |
| SMS | If abused such on what happened on the lending apps it can easily get and you contacts and send malicious intent to users contacts |
The two tables below summarizes the finding of DPEX and GPEN.
On the table above DPEX assessed Stay Safe to have permission that are excessive along with Indonesia, Thailand and Malaysia’s Contact Tracing apps. But, let us go back for a while and look at how Stay Safe works:
- User downloads the app and register his or her mobile phone number.
- App uses OTP to authenticate user registration.
- User provides name, age, location, gender, photo, company name.
- The user is assigned a QR code as an ID
- Optional:
- Users can turn on mobile phone Bluetooth signals (option).
- User’s ‘can turn on location (option).
The privacy statement and privacy notice of Stay Safe is a little bit confusing because on the splash screen they mentioned they are not getting any personal identification information and on the privacy notice they also mentioned that
“When you create an account with StaySafe.PH, we ask only for your nickname/alias, mobile number, age, gender, photo (optional), company name (optional), location (if enabled), and signs and symptoms being experienced if any.
Although not required, you may also provide nicknames and symptoms experienced by family members living with you who do not have access to StaySafe.PH.”
These information are PII in context and some may be categorized as sensitive personal information by the National Privacy Commission and in fact they are collecting personal data of the users.
Another confusing statement…
“If you provide some information and health condition of your family members to us, we will construe that you have obtained the necessary consent from them to both the disclosure and the processing of his personal information in accordance with our policy.”
These means that they mandating its users to be processors of data that bypasses consent of the user that is being nominated.
And on the retention of data…
“For as long as necessary unless you request the deletion of your information, after which these will be securely deleted. However, we may retain your information when required by law”.
This only means that opt out are not enforceable and users are not really sure if there is an evidence of erasure on the right to be forgotten. And there is no assurance that once you delete this application on your phone your personal data is deleted on the servers as well.
On Location, based on the privacy notice:
- Your location, when enabled by you, is collected to facilitate the Government in contact tracing.
- StaySafe.ph privacy statement does not say anything specific how it use device Bluetooth feature
The statement about location is inconsistent with the permissions listed (for which consent is sought by the app when downloading it.
- approximate location (network-based)
- precise location (GPS and network-based)
- Bluetooth and GPS is turned on at startup even if you turn it off it will it turn back on the background
Also, based privacy statement
When you use the StaySafe.PH website and/or the StaySafe.PH mobile app, the following information may also be obtained:
- Geolocation (if enabled), browser information (type, version, plug-ins), connection details (date, time, length of visit to pages, IP address), device information (device, operating system), activity (pages viewed, searches, scrolling, clicks, mouse-overs, page response time, platforms and referrers), page interaction information (e.g., scrolling, clicks, and mouse-overs), other technical details (downloads, errors) may be collected automatically;
- Information contained in any communication or report that you submit to StaySafe.PH, including metadata associated with such communication; and
- Information that you post to StaySafe.PH or submit for publication on the internet, including your nickname/alias, photo, and the content of your post/s.
On Camera.
The statement is lacking and with the permissions listed the manifest file :
- To generate and use of the QR code
- To upload photo
Based also on some interviews of Multisys that camera / QR Code is being used for a quarantine pass which in return tracks movement of a person.
To conclude we are not really saying that Contact Tracing apps are bad and are being used as a surveillance app but these dangerous permissions can be abused by threat actors / hackers and these kind of applications / systems need to employ secure coding as a best practice and if they have a privacy office they needs to brush up on their knowledge and skill due to the inconsistencies that of what is being implemented by their development team and their Data Privacy / Information Security Teams.
It is also good to note that the Philippines is unique in its strategy since they are the only one who outsourced the development to a 3rd party while other countries the government did it on their own. So, privacy notices are very important to establish the relationship of the stakeholders because people will ask:
- Who owns the data
- Who is the Controller? Who decides on the collection?
- Is Multisys really a controller since the app is really deciding on the manner of collection?
- As Processor has not personality on decision making, who is giving the instruction to teh processor? DICT? IATF?
- Are data secured at rest and at motion
- Are they using cloud? We presume they are because there is a database tracer from Google Firebase? Are they compliant to cross border data transfers since they have a cloud provider?
- If they are using cloud services – is the source code escrowed? Is DICT the owner of the application and controller? If this really donated to DICT why is it that it is not being hosted in on a data center in the Philippines?
- We need to understand that Privacy Principles must be implemented – Transparency, Legitimate Purpose and Proportionality (Not Excessive, Use Data Minimization)
- And a Privacy Impact Assessment is crucial on identifying privacy and security risk
- PIA must have Organizational, Physical and Technical Measures on the risk identified on Confidentiality, Integrity and Availability