Portpass app may have exposed hundreds of thousands of users' personal data

Private proof-of-vaccination app Portpass exposed personal information, including the driver's licences,of what could be as many ashundreds of thousands of users byleaving its website unsecured.

On Monday evening, CBC News received a tip that the user profiles on the app's website could be accessed by members of the public.

CBC is not sharing how to access those profiles, in order to protect users' personal information, but has verified thatemail addresses, names, blood types, phone numbers, birthdays, as well as photos of identification like driver's licences and passports can easily be viewed by reviewingdozens of users' profiles.

The information was not encrypted and could be viewed in plain text.

Earlier in the day, the Calgary-based company'sCEO Zakir Hussein had denied the app hadverification or security issues and accused those who raised concerns about it of breaking the law.

CBC called Hussein late Monday, and agreed to hold off on publishing an article on the lapse until late Tuesday morning in order to give his team time to lock down the site and protect user information.

The portpassportal.com web appwas pulled offline that evening and users of the mobile app were met with "Network error" pop-up messages if they attempted to upload or modify any information.

Hussein said Tuesday morning that the breach only lasted for minutes, and repeated that claim when CBC pointed out it had reviewed the personal information for more than an hour and it's unknown how long the information was exposed before that tip was received.

"Someone that's out there is trying to destroy us here, and we're trying to build something good for people," he said.

"There's holes, and what I'm realizing isI think there are some things that we need to fix here. And you know, we're trying toplay catch-up, I guess, and trying to figure out where these holes are."

The CEO said data hasbeen pulled from the server and his developers are investigating. He said he believes only those who were awaiting verification were affected, a claim CBC was unable to verify.

Hussein has said Portpass has more than 650,000 registered users across Canada.

Security, privacy concerns

Cybersecurity analystRitesh Kotak said he was shocked but not surprised to hear users' information was exposed.

"These were exactly the privacy and security concerns I've previously raised when it comes to using third-party apps," Kotak said. "You've gotta ask yourself, 'Where's the data housed? Who has access to it? Is it encrypted?'If this gets out to the wrong individuals it opens them up to fraud, identity theftand a whole other world of potential issues."

Earlier on Tuesday morning, Hussein spoke with 630 CHED Radio and said the servers were turned off to perform a security audit. He did not mention during that interview that users' personal information had been exposed.

The Calgary Sports and Entertainment Corporation (CSEC), which owns the NHL's Calgary Flames, hadrecommended the Calgary-based app as a way for ticket holders to prove their COVID-19 vaccination status to enter the Scotiabank Saddledome arena.

CSECsaid Monday in an emailed statement, before the security lapse was discovered,thatit's aware of concerns raised about the app and is working with the app's developer. CBC has reached out to CSEC for further comment. On Tuesday, after this article was published,CSEC pulled the recommendation for the app from the Flames' website.

"It seems like these were some really basic things that were missed. I questionwhy the Calgary Flames in the first place said go ahead and use this app you gotta do your homework," Kotak said.

Sharon Polsky, president of the Privacy and Access Council of Canada, said those who fear their information may have been compromised cannotify theOfficeof thePrivacy Commissioner. She said the company should have to answer some hard questions about how long the information was accessible and how many userssaw their data exposed.

"Will they conduct a forensic audit? Will they bring in a third-party independent auditor, not just somebody from within their company, to look it over and say, 'Yeah, we had a problem?'"Polsky said.

Hussein said his company will notifythe offices of the federal and Albertaprivacy commissioners.

The Alberta privacy commissioner's officesaid in an emailed statement thatit has not yet received a report, and said it is contacting Portpass to remind it that if "there is a real risk of significant harm to affected individuals" an incident must be reported to the commissioner and individuals must be notified.

The federal privacy commissioner also said it has not yet received a report, and said it has contacted Portpassto seekfurther information in order to determine next steps, and that it is in communication with its provincial counterpart.

Alberta does not have an official app

On Sunday, Conrad Yeung, a local web developer, had questioned onsocial mediawhether the app was accurately verifying vaccination information and CBCNewshad contacted the company to ask for a response.

Shortly after CBC contacted the company on Sunday, the app began to experience technical difficulties, but Hussein said the crash was due to an influx of users headed to that night's hockey game, overloading the server.

Alberta currently does not have an officialproof-of-vaccination app, and the province'sPDF vaccine record has been criticized for being easy to edit.

Kristi, one Portpass user, said she was scared to learn her personal information may becompromised. CBCNews agreed not to use her last name in case her information was among those exposed.

She said she only downloaded a private app because the government hasn't yet made one available a delay that frustrates her.

"It was like a kick in the gut when I got the CBC News alert I don't know if my information is out there," she said.

Yeunghad tested the Portpass appby uploadinga photo of an actor as an ID photo, and editinga fake vaccination record to display the actor's namethat the app verified as legitimate.

However, earlier on Monday, Hussein had denied that the app validatedYeung's false information, despite it appearing to do so, because he said the fakepicture would be a giveaway.

"That's not true. We saw it on the back end and we were watching it. So even if that user showed up, he wouldn't be able to utilize that picture because that's not him. So you wouldn't be able to get in. Secondly, that QR code, if someone scanned it, it would show that picture again," he said at the time.

Hussein had also said security concerns Yeung had raised about the app were false, and suggested he may contact authorities over his social media posts. He saidhe wished Yeung and others publicly posting concernsinstead had privately reached out to the company.

"Instead hedidthat malicedbehaviour. That, you know, that's not nice," he said.

Yeung said earlier on Monday he had no ill-will toward the company but simply wanted toraise the issueshe spotted.

"I was trying to warn, I guess, the general public based on the vulnerabilities that I saw. Because at the end of the day, it's personal information people are submitting," he said.