The Gauteng Legislature’s Portfolio Committee on e-Government and Research & Development has demanded answers from the Department of e-Government following a security flaw in the provincial e-Panic Button app that exposed sensitive personal information.
The committee says it is “deeply alarmed” by reports that an unsecured database linked to the app contained the identities and locations of people who reported crimes, the contents of their reports, images, ID numbers, driver’s licence details and medical aid information.
It says the reported exposure represents a serious failure in the department’s responsibility to protect Gauteng residents who use the platform when seeking emergency assistance.
The e-Panic Button is a digital safety service that allows residents to trigger distress alerts and share their location with emergency response services when facing threats, including crime, accidents and other emergencies.
The committee says the reported security flaw was discovered by Stellenbosch University student Joel Cendras and allegedly dates back to the launch of the app in 2024. If confirmed, this would mean some residents’ information may have been vulnerable for an extended period.
Seeking clarity
The committee is particularly concerned because the Department of e-Government has repeatedly appeared before it and submitted reports on the e-Panic Button, providing assurances about the platform’s safety and security.
It will now examine whether those assurances were accurate and whether adequate security testing, monitoring and risk controls were in place.
The committee has demanded that the department explain the measures in place to contain and fix the reported security threat and those taken since the vulnerability was identified.
It also wants confirmation on whether the exposed information was accessed or misused, and whether affected residents and relevant regulators, including the Information Regulator, have been notified.
The department has also been ordered to account for how a reported vulnerability of this nature could have gone undetected and to submit a detailed written report covering the incident timeline, security audits and measures taken to prevent a recurrence.
“The committee will not accept assurances without evidence,” it says.
The committee’s intervention comes after the Department of e-Government said it had identified an attempted security breach involving the e-Panic Button environment.
The department maintains that the incident was swiftly identified and addressed and that no citizens’ personal information was compromised.
According to the department, the incident involved a highly-specialised organisation with advanced cyber security expertise in vulnerability identification and security testing. It says its technical teams implemented corrective measures and that additional testing and verification have been requested.
The department says the e-Panic Button has 288 307 active users and has generated 114 414 emergency call-outs, assisting 27 929 citizens. It reports that 12 051 lives have been saved and 59 394 crimes have been reported through the platform, with an average response time of 15 minutes and 57 seconds.
InfoReg probe
The Democratic Alliance (DA) has separately called for an investigation into the alleged exposure and said it would report the matter to the Information Regulator.
DA Gauteng spokesperson for e-Government Michael Waters has questioned how long residents’ information may have been exposed and whether unauthorised parties accessed it. The DA has also called for the department to appear before the portfolio committee.
The Information Regulator has confirmed it has not received a section 22 security compromise notification from the Gauteng Department of e-Government regarding the alleged incident.
Nomzamo Zondi, spokesperson for the regulator, says it will assess the matter once a notification is received and determine whether further information is required from the department.
The regulator says it will engage the department if the required notification is not received, citing the “severity and sensitivity” of the alleged compromise.
The committee’s investigation will therefore focus on establishing what happened, what information was potentially exposed, whether it was accessed, how long the vulnerability existed and whether the department followed the required security and data-protection procedures.
The committee says it will monitor the department’s response and use its oversight powers to ensure the safety and privacy of Gauteng residents are protected.
Share
