‘You didn’t need to bypass any access controls’: Gauteng eGov weighs charges over e-panic button flaw

The Gauteng eGovernment department is waiting for the outcome of an investigation before deciding whether to pursue criminal charges against a student who exposed a flaw in the department’s e-panic button.

Joel Cedras, in September, revealed that while conducting a static analysis of the provincial government’s safety and security app, he was easily able to access the private information of users registered on the app.

To reassure the public that the Gauteng e-panic button remained safe to use, the department said no personal information of the 288 000 registered users had been compromised.

However, the department had earlier said the incident was carried out by someone with “advanced cybersecurity expertise” and had since taken the matter further.

“There is an investigation on this issue, and the department is awaiting a report. We are likely to get it sometime next week. We will then respond to this matter based on the report,” the department told The Citizen on Monday.

Student denies hacking

Cedras reiterated this weekend that after identifying the security flaws in the app, he contacted the department and the app’s developers.

The developers responded positively to Cedras’ notification, but the 20-year-old student claimed the department sat on the information for 14 days without reporting the matter to the Information Regulator.

The student had earlier claimed that user addresses, ID numbers, licence plate numbers, contact details, and details of the crimes reported by users were easily accessible to those who knew where to look.

“Since then, I have been accused of having illegally hacked the system, but this was simply not the case and the findings we have backed this up.

“The app wasn’t actually hacked. The app was in a state where any user could access the database. You didn’t need to bypass any access controls,” Cedras told SABC News.

Cedras and the developers were contacted on Monday morning via email by The Citizen, and any comment will be added when forthcoming.

‘Sends a concerning message’

Democratic Alliance spokesperson for education Michael Waters stated that he was informed of the department’s intention to have Cedras prosecuted in early October.

A special joint meeting of the Gauteng legislature’s portfolio committee on eGovernment and community safety heard that the department had contacted the South African Police Service with a complaint.

Waters relayed that police advised the department that the developers would need to open a case, as the app was the developer’s property.

The DA wants an explanation from eGovernment MEC Bonginkosi Dhlamini and backed the student, who Waters argues did not create the security flaws but helped identify them.

“It is absurd that instead of thanking the student for bringing the vulnerability to its attention and potentially protecting hundreds of thousands of residents, the department is determined to turn him into a criminal.

“South Africa needs young people with the skills and courage to expose government security failures. Therefore, investigating them sends a concerning message: expose a government security failure and face persecution,” stated Waters.