Students from Stellenbosch University stumbled upon an unauthenticated database while analysing the e-panic button app's code.
Image for illustrative purposes. Picture: iStock
The Gauteng provincial government is still urging residents to utilise its e-panic button app, despite glaring flaws detected in its data security.
University computer science students discovered the flaws while analysing the app’s code last week.
Joel Cedras, who was also one of the two students who exposed fraud within the South African Social Security Agency database in 2024, reported that he was easily able to access the personal information of Gauteng e-panic button users.
The province’s e-government department assured users that the digital holes in its app had been patched, adding that tighter cybersecurity protocols would be implemented in the future.
“The platform is part of government’s commitment to harness technology to strengthen public safety, improve access to emergency services, and ensure that residents can summon assistance quickly during moments of crisis,” the provincial government stated on Tuesday.
‘None of the information’ encrypted
The department revealed the scale of the data it had collected since the app’s official launch in July 2024.
The Gauteng e-panic button had 288 307 active users registered on the system, who had logged 114 414 emergency call-outs, resulting in the reporting of 59 394 crimes.
Cedras told SABC News on Monday that he was conducting a static analysis of the app’s code when he noticed the database storing user information was unauthenticated and accessible to anyone with a basic understanding of the framework.
Cedras said the privacy policy on the site states that all data is encrypted, but explained he could see user addresses, ID numbers, licence plate numbers, contact details, and details of the crimes reported by users.
The department said it had “identified an attempted security breach” of the app and that an average IT professional could not have carried it out.
“The incident involved a highly specialised organisation with advanced cybersecurity expertise and capabilities in vulnerability identification and security testing. department’s technical teams acted decisively,” the department explained.
Cedras’ comments contradict the department’s view of who alerted them to the app’s security flaws.
“It is quite surprising to hear that because we alerted them via email to the compromise.
“I think we were sitting on it for a couple of days before we had done that, so I don’t think they had detected it at all. None of the information we found was encrypted,” Cedras told the broadcaster.
‘No citizens’ personal information was compromised’
The DA said it would report the matter to the Information Regulator and demanded that the department appear before the e-government portfolio committee to explain.
DA Gauteng spokesperson for e-government Michael Waters highlighted the province’s crime crisis, lamenting how the sensitive information of victims and reporters of crime was left exposed.
“Residents who report domestic violence, assault, and other serious crimes must be able to trust that the information they provide to the government will be protected.
“Government systems cannot expect vulnerable residents to come forward and trust them while failing to adequately protect the sensitive information they provide,” said Waters.
However, Gauteng’s e-Government department was confident that private information remained protected.
“The department has established that no citizens’ personal information was compromised as a result of the incident.
“The vulnerability was identified; our technical teams implemented corrective measures promptly.
“The department will continue to undertake appropriate security assessments and implement measures necessary to safeguard government systems and the information entrusted to it by residents,” it concluded.
