While the government continues to tout the success of its privacy-invading coronavirus contact-tracing system, the web app’s gaping technological flaws took only days to expose.
On Monday, Ministry of a Digital Economy and Society Inspector General Polawat Witoolkollachit said fraudsters already have spoofed the Thai Chana app to steal people’s personal data and expose them to identify theft.
Criminals have created fake Thai Chana apps and are sending out text messages masquerading as government SMSs to trick people into downloading them. Others, meanwhile, have set up fake websites with domains the Thai government was too short-sighted to reserve itself, such as ThaiChana.asia.
The government’s only official web addresses are ThaiChana.com and ไทยชนะ.com. However, Polawat said it is unnecessary and not advised for people to find or bookmark the sites themselves. He said people should simply scan the ThaiChana QR code at any venue they wish to enter.
Polawat stressed that the government does not send any text messages and that Thai Chana is a web-based platform that requires no application to be installed on a smartphone. He said authorities are investigating the fake messages.
That people already are exploiting the government’s weak contact-tracing system is no surprise. Rather than adapt the technologically superior apps used so successfully in South Korea, Hong Kong or Singapore – or adapt the decentralized software framework provided free by Apple and Google – the government chose to centrally warehouse petabytes of personal data, such as telephone numbers, and location data and require everyone to “check in”, leaving many feeling like the military-backed government is tracking all their whereabouts.
Pleas that the former generals who’ve spent six years suppressing opposition wouldn’t use the data for nefarious purposes has fallen on deaf ears. But, with no other alternative, Thais and expats alike overwhelmingly grudgingly have accepted the system.
Polawat said that as of Monday 106,235 busineses have registered for QR codes and that 11.8 million people have used it. It’s unknown how many have entered fake data, however, nullifying the point of having the contact-tracing app at all.
People and businesses also aren’t being serious about ensuring users check out, with the system recording 27.1 million checkins but only 19.2 million checkouts.
Tops among business types using the system were beauty clinics and salons, video studios, child and elderly care facilities, offices of governmental organizations, and museums and libraries. Oddly, shopping malls didn’t make the Top 5.
“The application of the Thai Chana platform in the past week was very successful thanks to good cooperation from Thai people who care about the protection of themselves and the society and the operators who are also highly cooperative,” Polawat crowed, quickly changing the subject from hackers.