Norwegian broadcaster issues warning for Qatar World Cup apps

Author Moonshot.news

Published on: 25/10/2022

There are worries that apps can be used to spy on its users. “It’s not my job to give travel advice, but personally I would never bring my mobile phone on a visit to Qatar”, says Norwegian public service broadcaster NRK’s head of security Øyvind Vasaasen at the broadcaster’s website after a thorough review of apps Ehteraz and Hayya. Everyone travelling to Qatar during the FIFA football World Cup will be asked to download the two apps.

Ehteraz is an covid-19 tracking app and Hayya is an official World Cup app used for match tickets and free Metro in Qatar.

“In particular, the covid-19 app Ehteraz asks for access to several rights on your mobile., like access to read, delete or change all content on the phone, as well as access to connect to WiFi and Bluetooth, override other apps and prevent the phone from switching off to sleep mode”, NRK reports.

“The Ehteraz app, which everyone over 18 coming to Qatar must download, also gets a number of other accesses such as an overview of your exact location, the ability to make direct calls via your phone and the ability to disable your screen lock.”

The Hayya app asks for access to share your personal information with almost no restrictions. In addition, the Hayya app provides access to determine the phone’s exact location, prevent the device from going into sleep mode, and view the phone’s network connections.

“They can simply change the contents of your entire phone and have full control over the information that is there”, is the conclusion of NRK’s security manager.

As part of the media house’s preparations for the Qatar WC, he has reviewed these apps.

“When you download these two apps, you accept the terms stated in the contract, and those terms are very generous. You essentially hand over all the information in your phone. You give the people who control the apps the ability to read and change things, and tweak it. They also get the opportunity to retrieve information from other apps if they have the capacity to do so, and we believe they do.”

NRK also asked Bouvet and Mnemonic, two independent IT security companies, to review the apps.

Martin Gravåk at the Bouvet company explains that the Ehteraz app tracks where you go, and the mobile phones that are near you. In this way, they can cross-link the information and find out who you are meeting and talking to.

“The consequences for individuals and groups if data from Ehteraz goes astray can be significant,” Tor Erling Bjørstad of Mnemonic told NRK.

NRK has submitted the findings about the apps’ security holes to FIFA: 

“They tell us that they do not wish to comment on the matter”, NRK reported.

Naomi Lintvedt, research fellow at the Faculty of Law at the University of Oslo, has reviewed the apps at the request of NRK.

She agrees with NRK’s head of security that there is much that is problematic, and describes the apps as «very intrusive».

– You cannot consent to parts of the use, just everything. If I understand the apps correctly, there will also be limited options to change permissions there. This means that if you want to go to the WC, you have no choice. This is a mandatory app, with no options,” she points out.

She says that if she was an employer, she would not allow employees to take their work mobile phone to Qatar.

Even as a private person, she would have been very sceptical about using her own phone in the World Cup host country.

About the apps she says:

“They go far too far in terms of what data is recorded and used. They get far too broad of access to change and take over functionality on your mobile phone, which appears to be completely unnecessary. It allows for government surveillance, and since it is Qatar, that has to be considered as well. This increases the risk that data will be used for purposes other than pure infection tracking.”