The IT Nerd

You might recall that there was a text message scam from last year where people who booked a COVID vaccine were getting text messages asking for all sorts of personal information. It didn’t take long for two people to get charged with being behind this scheme. And one person who was arrested was an insider as they worked for the vaccine contact centre which is part of the Ontario Ministry of Government and Consumer Services. Once again proving that your organization’s biggest threat vector is your people. Well, the damage has been tallied and it’s not good. The breach resulted in the names and phone numbers of about 360,000 people being leaked. CBC has details:

Beginning Friday, some 360,000 people will receive notices that their personal information was part of the November 2021 data breach of the COVAXX system, the Ministry of Public and Business Service Delivery said in a statement Friday. 

The ministry said it had been working with the Ministry of Health, police and the Ontario’s privacy commissioner to determine the scale and impact of the breach. The ministry’s statement does not say how it occurred.

I for one would be very interested in what lessons the Ontario government learned so that this doesn’t happen again. Because 360,000 is not a small number of people to be affected by something like this. And I think that all Ontario citizens would be very interested in this information as well. People have to have trust that their information is going to be protected. And given the scale of this breach, I would be wondering if the Ontario government has the right people, tools, and controls in place to stop this from happening again.

At the moment the World Cup is just full of controversy due to the human rights record of Qatar. And this news from Politico won’t help with that. EU officials are warning that visitors should not download the official World Cup apps due to the fact that they are privacy nightmares:

European data protection regulators have been lining up to warn about the risks posed by Qatar’s World Cup apps for visitors, with Germany’s data protection commissioner being the latest. In a statement Tuesday, the Germans said data collected by two Qatari apps that visitors are being asked to download “goes much further” than the apps’ privacy notices indicate. 

“One of the apps collects data on whether and with which number a telephone call is made,” the German authority said. “The other app actively prevents the device on which it is installed from going into sleep mode. It is also obvious that the data used by the apps not only remain locally on the device, but are also transmitted to a central server.”

The Norwegian and French data protection agencies have already issued similar advice. 

The Norwegian regulator on Monday said it was “alarmed” by the extensive access the apps require. “There is a real possibility that visitors to Qatar, and especially vulnerable groups, will be monitored by the Qatari authorities,” it said. 

The French agency said fans should take “special care” with photos and videos, and recommends that travelers install the apps just before departure and delete them as soon as they return to France.

The French government — despite having close ties to Qatar — echoed the CNIL’s advice on Tuesday. “In France, thanks to the [General Data Protection Regulation], all applications must guarantee the fundamental rights of individuals and the protection of their data. This is not the case in Qatar,” tweeted Junior Minister for Digital Jean-Noël Barrot, referencing the privacy regulator’s guidelines.

Here’s the problem. Visitors have been asked by Qatar to download and install these apps. Thus this really makes Qatar look bad. And on top of that, Apple and Google are the ones serving up these apps. Did this just slip through or did they know about the issues with these apps and they simply looked the other way? I for one would love to know the answer to that question as it makes me question their app review processes.

In any case, it takes an event that really has bad vibes all around it, and amps that up to 11.

When people create apps, it’s not at all unusual for the developer to use code from someone else. After all, why reinvent the wheel if someone has done the hard work for you?

Well, maybe that practice should be rethought. I say that because it now turns out a Russian company who were pretending to be an American company has had its code show up in thousands of apps. Including an app used by the US Army. Reuters has the details:

Thousands of smartphone applications in Apple and Google’s online stores contain computer code developed by a technology company, Pushwoosh, that presents itself as based in the United States, but is actually Russian, Reuters has found.

The Centers for Disease Control and Prevention (CDC), the United States’ main agency for fighting major health threats, said it had been deceived into believing Pushwoosh was based in the U.S. capital. After learning about its Russian roots from Reuters, it removed Pushwoosh software from seven public-facing apps, citing security concerns.

The U.S. Army said it had removed an app containing Pushwoosh code in March because of the same concerns. That app was used by soldiers at one of the country’s main combat training bases.

According to company documents publicly filed in Russia and reviewed by Reuters, Pushwoosh is headquartered in the Siberian town of Novosibirsk, where it is registered as a software company that also carries out data processing. It employs around 40 people and reported revenue of 143,270,000 rubles ($2.4 mln) last year. Pushwoosh is registered with the Russian government to pay taxes in Russia.

On social media and in U.S. regulatory filings, however, it presents itself as a U.S. company, based at various times in California, Maryland and Washington, D.C., Reuters found.

Now the question is this: Is this company trying to simply evade sanctions against Russia to stay in business. Or are they collecting data from these apps and handing it over the the Russian government. The company says it didn’t hide the fact that it is Russian, though I question that based on the Reuters story. And one could argue that it really doesn’t matter as the Russian government could knock on their door asking for whatever data they had, and the company could hand it over.

I think that the take home message is as follows. If you as a developer plan to use someone else’s code in your apps, you should make sure that it’s from a trustworthy source. Clearly a lot of developers didn’t in this case. And now it’s an issue.

I have to admit that this is a new way of leaking personally identifiable information that I never considered. Advocate Aurora Health is informing 3 million people that their protected health information was leaked to via a malformed tracking pixel to Facebook or Google:

In a data breach notification on its website, the healthcare system is informing patients that an incorrectly configured tracking pixel – placed on the MyChart and LiveWell websites and applications and on some scheduling widgets – exposed some of their information.

The pixel, the company says, “transmitted certain patient information to third-party analytics vendors that provided us with the pixel technology, particularly for users concurrently logged into their Facebook or Google accounts.”

Potentially exposed information includes IP addresses, information on scheduled appointments, patient proximity to an Advocate Aurora Health location, provider data, type of appointment or procedure, MyChart communications (including names and medical record numbers), insurance details, and the names of patient proxies.

Advocate Aurora Health says it has no evidence that Social Security numbers or financial account and credit/debit card details were exposed in the incident.

“We have disabled and/or removed the pixels from our platforms and launched an internal investigation to better understand what patient information was transmitted to our vendors,” the healthcare provider says.

Advocate Aurora Health says it has found no evidence that the exposed data has been misused and also notes that the misconfiguration is unlikely to lead to identity theft or financial harm.

I’m skeptical that this screw up won’t cause identity theft or financial harm. Facebook and Google sole purposes in life is to harvest information and then find ways to make money from it. Thus I can see a scenario where someone could get access to this info and then use it to to make the lives miserable of the people who are affected by this. I guess that’s why this health care provider is offering up the advice of checking your credit report. Likely because while they don’t think anything bad has happened, they don’t know for sure.

I for one hope that there’s an external investigation into this, and punishment if warranted is handed out swiftly because companies simply need to do a much better job of protecting data like this.

Well, this is a wee bit embarrassing for the City Of Hamilton:

The City of Hamilton says it “regrets” exposing the names and email addresses of hundreds of registered voters in a privacy breach Thursday.

The breach impacted approximately 450 individuals, the city said in a statement provided Friday, all of whom had registered to use the Vote by Mail process.

“Multiple email addresses were inadvertently entered in the to: line of the email instead of the bcc: line, exposing email addresses to all recipients of the email message,” the city said.

That almost sounds to me like this was done by a human being rather than an automated mailing program like Mail Chimp or Constant Contact. Because those programs would not have done this. A human can easily screw this up and create this exact situation. But at least the city is sorry for this:

Regardless, this screw up has been reported  Information and Privacy Commissioner of Ontario, and I am sure that we’ll not only get a lot more details, but we’ll also find out what the Information and Privacy Commissioner of Ontario has in mind to remedy this situation. And by that I mean take action to make sure that it doesn’t happen again and there’s some accountability as well.