Gauteng government thinks we are hackers. We are not

The South African government, in the 2000s, had well-designed, easy-to-use websites. Now their IT systems are plagued with bad design and security vulnerabilities. Illustration: Lisa Nelson

The Gauteng Department of e-Government has issued a statement the security failures of its e-Panic Button app. Issued on Monday evening, the department said it “recently experienced an attempted data breach” which “was swiftly identified and resolved without compromising any citizens’ personal information”.

It said the incident “involved a specialised organisation with advanced expertise in cybersecurity testing”.

MEC for e-Government Bonginkosi Dhlamini, in the statement, said: “It is important to note that this was carried out by a highly specialised organisation with the expertise and tools required to conduct such advanced testing. This is not something that can be replicated by an average IT practitioner.”

The statement is clearly in response to GroundUp’s report by Joel Cedras How Gauteng’s new panic app exposed your data . It is misleading.

Read the Gauteng Government’s statement .

We note the Gauteng government issued a new statement on X/Twitter after their original statement was criticised.

We are not a “highly specialised” cybersecurity organisation

We are journalists. We are not a cybersecurity firm. Cedras is a student who does part-time software development for us and also writes articles for us.

He did not use advanced tools. He downloaded the app, which anyone can do, and looked at what it connects to. The database was open. There was nothing to get past. All the tools he used are standard and open source.

Many competent IT practitioners could have done it. That was the point of the article, and part of the problem. It was too easy to access data that the Gauteng government should have protected much more carefully.

It was not an “attempted” breach

No hacking took place. We did not guess passwords, run obscure dark web tools or attempt anything underhanded. The crime reports, names, phone numbers, GPS coordinates and location histories of users were just sitting there, readable for all. So were the one-time PINs used to log into the app.

The developers, Evolve Value Added Services, responded to us alerting them to the issue, confirming that it had fixed these problems.

“Thank you for bringing this to our attention and for giving us the opportunity to act before publishing. We genuinely appreciate the responsible way you handled this, and in particular your decision to put the protection of the public first. Thank you also for the time you spent walking us through the technical detail on our call”, read an email from Evolve to GroundUp. “The issues you reported have been addressed on the backend, and these changes are live now without requiring users to update the app.”

The department has still not responded to us

The statement states that, “the department’s technical teams engaged directly with the organisation to address and close the identified vulnerabilities”.

We emailed the Gauteng government and Evolve Value Added Services, the developers (and tender winners), at noon on 21 September.

Evolve responded, accepted our offer of assistance, and sent a detailed account of the fixes it had made. We credited them for that in our article.

More than 36-hours before we published, GroundUp’s director, Nathan Geffen, phoned, WhatsApped and emailed department spokesperson Elijah Mhlanga, and emailed Lunga Ngcongwane in the Gauteng e-Government department. No one responded. No employee of the Gauteng government has contacted us directly in response to the article.

Why we are exposing incompetent IT work

We have now run several exposés on IT incompetence . State IT systems are especially vulnerable to incompetence and security vulnerabilities. There are tenders for massive multi-million-rand contracts. Companies with inappropriate experience often win these tenders.

Because of the technical nature of IT systems, these companies, sometimes in collusion with state officials, pull the wool over everyone’s faces. Their incompetence or misdeeds go unexposed for years, while the public pays the price and gets unusable websites and computer systems in return.

The e-Panic Button app is a case study in wasted resources. Instead of addressing the key problem: the loss of public confidence in the emergency 10111 number, the Gauteng government implemented a parallel system that now also needs to be maintained, one that competes with a bunch of private sector panic button apps. They have done so at a reportedly outrageous cost of R131-million and counting according to MyBroadband .

We do not report every IT vulnerability we find. Small companies often don’t have the resources to hire IT implementers that follow best practices. And in large companies and government departments, even the best IT companies make mistakes, exposing systems to subtle security vulnerabilities. We have already found vulnerabilities in the websites of large companies, reported it to them and not disclosed the findings publicly. But when large companies or government departments implement systems with vulnerabilities that are grossly incompetent, we will report it. The diagram below shows the approach we take.

We use this matrix to guide our approach to reporting security vulnerabilities.

Support independent journalism Donate using Payfast

: Rail theft case: accused changes lawyers for 7th time

: Spelling star, 13, needs funds to reach national final