Summer 2021: data leakages, mandatory apps and COVID-scanners


We will tell you what digital restrictions related to the coronavirus were introduced in the summer of 2021.

Together with the partners of the Pandemic Big Brother project, we continue to monitor the situation around COVID-19. Over the summer of 2021, there has been a significant increase of publications related to violations of digital rights during the pandemic in our interactive map.

The digest covers the following subjects:

·   mandatory application for foreign citizens entering the territory of Russia;

·   COVID scanners in the UAE;

·   leakage of data of vaccinated citizens in Europe;

·   privacy controversy surrounding contact tracing apps for COVID-19 patients.


In Russia, the number of daily new cases of coronavirus disease has remained at around 20 thousand for a long time. The authorities are introducing and abolishing new restrictions that affect, inter alia, the right to movement. At the same time, throughout Russia, as before, there is no centralized approach to such restrictions and each region independently makes a decision. Separately, the Department of Health of the Ivanovo region was particularly distinguished, where from the fall of this year, ambulance workers will be required to wear video recorders.

In June, QR codes were introduced in Moscow for visiting catering establishments. Vaccinated citizens who have recently had a coronavirus or who have passed a PCR test could get such a code. A few weeks later, when in Moscow, according to Mayor Sobyanin, it was possible to achieve good vaccination rates, these restrictions were lifted. Now this QR code is required only for visiting mass cultural events in the capital.

At the same time, due to QR codes and certificates on the past disease, the journalists were able to conduct an investigation, where they found out, that the register of the Ministry of Health, created to track the number of cases, contains 29 million records. These figures are 5 times higher than the official statistics published by the operational headquarters.

With the growing interest of Russians in vaccinations, scammers who offer to buy fake vaccination certificates have also intensified. At the same time, such certificates, like the original ones, are recorded in public services and have a unique QR code.

In the near future, proof of vaccination may also be required for air travel in Russia. The Ministry of Transport offered to verify passengers with a vaccination certificate when buying tickets. The agency has already sent a letter to the airline demanding to add such an opportunity to online ticket sales platforms.

Now the operational headquarters is reporting up-to-date information about the coronavirus in Russia, but the authorities decided that this was not enough and allocated 220 million rubles to ensure the operation of the contact center from Rostelecom. It is intended to inform citizens about socio-economic issues, including restrictions related to coronavirus.

In addition, the tendency to hold people accountable for allegedly false publications about the coronavirus continues

CIS countries

Kyrgyzstan has outlined a similar trend tendency towards increasing censorship in media and social networks. At the end of July, the Law "On Protection from False and Inaccurate Information" was adopted there, which will actually make it possible to block links and websites containing false or defamatory information. 

There have also been cases in Kyrgyzstan of falsified negative PCR-tests. After journalists published information about this, the Cabinet of Ministers instructed the agencies to conduct inspections.

In Kazakhstan, back in February of this year, the state application Ashyq (translated from the Kazakh language - "Open") was launched  throughout the country, it shows the status of people with/without COVID-19 and allows citizens to visit public places without having to constantly take PCR tests. The application has been tested in several regions since last year, and from mid-May 2021 it should be used, including for visiting airports. In July of this year, the authorities decided that the names of Kazakhs who have “red” status in the Ashyq application will be published in the media.

Another application that must be used by citizens living in the territory of the CIS countries is "Traveling without COVID-19”. Using this application, foreign citizens and stateless persons can enter the territory of Russia - in the application they need to show a QR code with a negative PCR test result. Since July 25, it was obligatory for all visitors from Armenia, Belarus, Kazakhstan and Kyrgyzstan, from September 1, 2021, Azerbaijan, Moldova, Tajikistan, Turkmenistan and Uzbekistan also joined them.


Several leaks of personal data were recorded in Europe this summer. In Spain, due to a computer error, the data of several thousand vaccinated citizens of Madrid leaked to the network. Among those whose data were made publicly available are also King Philip VI of Spain, Prime Minister Pedro Sánchez and a number of other politicians. This data includes information about which drug the person was vaccinated with and in which shoulder, as well as passport data, phone numbers and home addresses.

Another data leakage relates to the COVIDCert NI app used in Northern Ireland to issue vaccination passports. Users of this application, under certain circumstances, see the data of other vaccinated citizens.

The introduction of new digital restrictions in France in July this year was accompanied by protests and clashes with the police. Due to the increase in the number of new cases of the disease, the government has obliged catering establishments and cinemas from August to request vaccination passports or PCR tests from visitors. Recall that vaccination passports were launched throughout Europe on July 1, which we wrote about in the previous digest.

Also in July, the Information Services Group (ISG) published a report where it drew attention to the growth of cyberattacks in Switzerland, which is associated, among other things, with the COVID-19 pandemic. The report says that more and more Swiss businesses during the pandemic do not cope with the requirements of protecting their data and systems, as a result, they are turning more often to external service providers, including specializing in security services.

The rest of the world

Another major data leakage recently occurred in Indonesia, linked to an Indonesian COVID-19 contact tracing app. The leak, which the specialists of the vpnMentor company were able to detect, affects the personal data of more than 1.3 million residents of the country. The company's report says that the developer of the application was unable to establish "adequate" data privacy protocols, as a result of which personal data ended up on an open server.

Tracking app were launched in Fiji in June. It is arranged in such a way that registration in it is necessary for the owners of companies, through the application they generate a unique QR code that must be printed and placed at the entrance, and visitors of the establishments are required to scan it.

Detailed scanning of QR codes before entering establishments may again become  mandatory in New Zealand. There, the authorities are considering the possibility of introducing new restrictions due to the increase in the cases and the detection of new strains of the virus.

At the same time, the world continues to debate the effectiveness of such applications for tracking contacts with patients. In one of the recent reports of the consulting company Abt Associates, the Australian application COVIDSafe was criticized which only rarely notified citizens about contact with a sick person and was completely ineffective at mass events in the open air.

At the same time, in some states of Australia, it remains mandatory to scan QR codes when visiting stores and other public places. In addition, Australia is currently discussing anning police from using data from COVID-19 tracking apps.  In June of this year, the Queensland State Police received an order to dump data from a local contact tracing app to investigate the theft. After the incident, the State Department passed a law restricting the use of data from the app for anything other than contact tracing.

The authorities of the United Arab Emirates approached the fight against coronavirus as technologically as possible. In the Abu Dhabi, authorities have installed scanners capable of, they say, detect COVID-19 at border crossings, shopping malls and other public places in seconds. Abu Dhabi Health Department says such scanners can confirm COVID-19 infection by measuring human emissions. However, for a number of human rights defenders, such a decision still raises mistrust and concerns about confidentiality.

Controversy over the privacy of the data collected has also sparked an app in Cambodia, which launched in February this year to track contacts with patients. Experts are concerned about the fact that the government does not publish any data on the collection and protection of data and that this data can be used for other purposes than those stated by the developers.

A feature has been added to a Malaysian similar contact tracing app to display the vaccination status of users. You will need to present it whenever you visit public places.

The Saudi Arabian government has introduced mandatory vaccinations for all students and schoolchildren over the age of 12, and each time they need to show their vaccination status in the COVID Tawakkalna app. Previously, this application was used to issue digital travel passes during a general lockdown.

In Canada, individual states are launching applications that will display information about users' vaccinations. In the province of Manitoba, Canada, a new application shows the vaccination status of citizens, and in Ontario, another application should be presented when visiting public places, such as restaurants, gyms or cinemas.

Separate applications also function in different American states. The application in North Carolina was downloaded almost 1 million times by September 2021, but during its entire operation it issued only 3 thousand warnings about possible contact with a patient, which raises questions from users about its effectiveness. The Hawaii state app also has over 1 million downloads, and interest in it increased this summer following the outbreak of the delta virus strain.

Massachusetts app was automatically installed on local residents' Android smartphones without warning. This app uses tracking technology from Apple and Google, but the automatic installation did not include contact alerts. It remains unclear whether the pre-installation of this app was a bug or deliberate action by the authorities in cooperation with Google. 

Also in the United States, there is an acute problem with falsification of medical documents confirming vaccination against coronavirus. More and more educational institutions are demanding vaccination certificates from students, while you can buy a fake document even on social networks at a cost of $ 25.

Another problem that worries the authorities during the coronavirus pandemic is the spread of disinformation on social networks. The White House called Facebook the main "conductor of misinformation about COVID-19" and requires the leadership of the social network to take resolute measures to stop the spread of false information about the coronavirus.

If you have something to add or would like to tell about digital restrictions and violations of rights in your country, contact us through the feedback form.

If you are ready for cooperation or if you have information worth adding to the map - contact us!