The Gauteng Department of e-Government says it recently identified an attempted security breach involving its e-Panic Button environment.
Gauteng’s e-Panic Button is a digital safety service designed to help residents summon emergency assistance from their mobile phones.
The initiative allows users to trigger a distress alert and share their location with emergency response services, with the aim of shortening response times when people face threats. such as crime, accidents or other emergencies.
According to the department, to date, the platform has recorded 288 307 active users, generating 114 414 emergency call-outs and assisting 27 929 citizens.
It reports that 12 051 lives have been saved, while 59 394 crimes have been reported through the platform. The average emergency response time stands at 15 minutes and 57 seconds.
The department notes the cyber incident was swiftly identified and addressed, and it has established that no citizens’ personal information was compromised as a result of the incident.
According to the department, the cyber incident involved a highly-specialised organisation with advanced cyber security expertise and capabilities in vulnerability identification and security testing.
MEC for e-Government Research and Development Bonginkosi Dhlamini notes the department’s technical teams acted decisively to address the identified vulnerabilities and strengthen the platform’s security controls.
“The security of our systems and the protection of residents’ personal information are non-negotiable. The vulnerability was identified, our technical teams implemented corrective measures promptly. This is not an ordinary incident that can simply be replicated by an average IT practitioner,” says Dhlamini.
The department says it will continue to undertake appropriate security assessments and implement measures necessary to safeguard government systems and the information entrusted to it by residents.
“We have gone further by requesting additional testing and verification to ensure all identified security requirements have been addressed and that our systems remain resilient. Cyber security is not a once-off exercise. It requires continuous testing, monitoring, strengthening and improvement,” says Dhlamini.
Serious failure
Meanwhile, the Democratic Alliance (DA) issued a statement yesterday saying it will report the data breach of the e-Panic Button app to the Information Regulator of South Africa.
“We seek an investigation into a possible violation of the Protection of Personal Information Act, the circumstances of the exposure of crime victims' sensitive information, the e-Government Department's response, and its notification to affected residents,” says Michael Waters, DA Gauteng spokesperson for e-Government.
Waters notes the exposure of highly-sensitive personal information belonging to Gauteng residents who used the provincial government's e-Panic Button app represents a serious failure by the Gauteng Department of e-Government to protect people who turned to the state for help.
“Even more concerning is that the department has never informed the Gauteng Legislature's Portfolio Committee responsible for overseeing e-government about this serious security failure. This is the second data breach in which highly-sensitive information submitted to the Gauteng Provincial Government is exposed.
“It is disturbing that this data breach was exposed in a report by GroundUp and not by the department first. The report alleges the system exposed the names and personal details of people who reported crimes, the contents of their reports, photographs, GPS locations and location histories. Reports relating to domestic violence and assault were among the information that could be accessed. The system also reportedly exposed one-time PINs used to log into the application.”
Waters adds that the DA demands that the department urgently appear before the Portfolio Committee on e-Government.
“The department needs to provide answers on how long the personal information of residents who use the e-Panic Button has been exposed, and whether the information was accessed by unauthorised persons. Have the access logs been independently examined? These are but a few of the questions that the department needs to answer.
“Given the department’s limited budget, it raises the question of whether the department should invest in e-Panic Buttons instead of focusing on improving its cyber security systems.”
According to GroundUp, these were not sophisticated vulnerabilities requiring advanced hacking skills, Waters adds.
“A tech-savvy computer user could access the information, while some of the exposed data dated back to the launch of the app in 2024. This is unacceptable.
“Residents who report domestic violence, assault and other serious crimes must be able to trust that the information they provide to the government will be protected. Instead, a person reporting an alleged abuser could potentially have had their identity, location, movements and crime report exposed.
“This revelation comes at an especially disturbing time for Gauteng. The province, and Ekurhuleni in particular, is reeling from the recent deaths of 11 women, while South Africa continues to confront an enormous gender-based violence and femicide crisis.”
Regulator still waiting
According to Nomzamo Zondi, spokesperson for the Information Regulator, the regulator has not yet received a section 22 notification from the Gauteng e-Government Department regarding the alleged security compromise of its e-Panic Button app.
Zondi tells ITWeb via e-mail that the regulator will assess the matter and determine whether further information is required from the department.
“Once a Section 22 security compromise notification has been received, we will assess the information provided and determine the appropriate regulatory action in accordance with our mandate and the provisions of POPIA.”
She adds that, given the “severity and sensitivity” of the alleged compromise, the regulator will engage the department if it does not receive the required notification.
Gauteng Provincial Government is urging residents to download and use the e-Panic Button as part of efforts to build safer, smarter and more connected communities.
Says Dhlamini: “The Gauteng e-Panic Button is ultimately about people. It is about ensuring that when a resident is confronted with danger or an emergency, technology can help them reach assistance as quickly as possible.
“We understand that residents will only use this platform if they trust it. That is why the protection of personal information and the security of the platform remain central to our work. We will continue to test, improve and strengthen the system because we have a responsibility to protect both our residents and the integrity of the technology they rely on.”
Share
