Filterwatch Policy Monitor — March 2020
By: Melody Kazemi
Tags: Internet, Data, Censorship, Surveillance, Iran

Google Removes Iran’s Covid-19 “Diagnosis” App from The Google Play Store

Iranian COVID-19 App known as AC19

On 9 March, Google removed Iran’s COVID-19 “diagnosis” app known as AC19. The app, which claims to “diagnose” COVID-19 through a series of yes or no questions collected mobile phone numbers and real-time geo-location as well as other personal data from individuals, raising concerns about data privacy and surveillance.

To date, Google has not commented on the reasons behind the decision to remove the app. Claims made about the app containing malware or spyware have been challenged by a security expert, who commented that the collection of geo-location data was made through “legitimate permission prompt that users had to agree [to]”, similar to many other Android apps. Instead, some reports suggest that the removal of the app was due to its “misleading claims’’ about diagnosing COVID-19, as part of a wider crackdown on apps making false or misleading claims amid the pandemic.

However, Jahromi made clear that geolocation data was being collected and used when he tweeted maps on 9 March and 11 March with “hotspots” which he claimed were produced using data from 3.5 million AC19 users to identify locations with heavy footfall, seeking to minimise unnecessary travel.

Jahromi tweets a map of infection hotspots on 11 March using “data from 3.5 million AC19 users”

Concerns remain raised about the privacy and the security of the app for users given the lack of clarity from the app and the government on continued tracking of users and the collection and storing of their location data, preventing users from being able to give informed consent to the app. Given Iran’s track record on surveillance and the absence of any meaningful data protection laws and safeguards for users, there is also the increased risk from the government potentially exploiting this data for surveillance purposes, which could last beyond the duration of the pandemic.

These concerns are heightened as it has been revealed that the AC19 app was developed by Smart Land Strategy, the company behind clone Telegram apps Hotgram and Golden Telegram which have weak and unsatisfactory security practices, highlighted in the recent data leak containing information from 42 million Iranian users collected through these apps (see cybersecurity and cybercrime section). These clone apps were removed from the Google Play Store due to concerns about spyware and malware spreading through app installations. AC19 is still available on Cafe Bazaar and online.

During these unprecedented times, technology is serving as an invaluable tool to help understand and prevent the spread of the virus, and to collect crucial data about its prevalence and spread. Across the world, many countries have deployed apps or relied on other data sources to better understand the viruses symptoms and spread. This has opened up a debate around balancing issues of surveillance, privacy, and public health.

Although these questions are challenging, it is clear that any methods for surveilling users to collect data on the virus must be built with public trust and government transparency about its use at the forefront. So far, the Iranian government has failed to offer this. This is especially important given the lack of legal data protections in the country. Until such meaningful protections are in place, users and rights activists will continue to maintain a degree of scepticism about the intent and scope of these measures.

Domestic Messaging App “Soroush” Advertised for Auction

On 8 March reports based on an auction advertisement confirmed that domestic messaging app Soroush is being sold. Soroush, which is backed by the state broadcasting organisation The Islamic Republic of Iran Broadcasting (IRIB) who own majority shares in the app, was marketed as a replacement for Telegram in the aftermath of its filtering in 2018.

According to Soroush’s Managing Director Morteza Rahimi, the sale is to “increase investment” so that “services can expand”.

The use of domestic messaging apps continues to be a concern due to lack of privacy measures which can allow government surveillance. While Iranian citizens currently have a choice to use foreign messaging apps, it may be likely that domestic messaging will be pushed more aggressively by the government if new legislation is passed, limiting options for Iranian users.