3 Apr 2020

Police tracking system doesn't look legitimate - IT expert

5:02 pm on 3 April 2020

The police are working to ensure the security and quality of a tracking service being used during the nationwide lockdown.

Police generic

Photo: RNZ / Richard Tindiller

Some people who have entered the country in the past fortnight have been sent a text message by police, asking them for permission to track their location on their phone.

But tech experts have raised issues with the platform's security and privacy, and some people think it looks like a scam.

The police are using the system because they do not have enough officers to physically check if each person is remaining in isolation.

They are asking travellers returning home to consent to a GPS tracking system, which is run through a link to a website.

Brad Cowie is an expert in IT security and computer science.

He was sent screenshots of the SMS messages and the website itself, and said it is not convincing.

"Initially I was very suspect of it," he said.

"All of the security training you do warns you of people trying to take advantage of situations such as Covid-19.

"It didn't seem to suggest anything that made it legitimate. The website didn't look legitimate, the message, I mean anyone could write that, it came from a strange number, so I initially thought it wasn't legitimate."

Cowie said he did some research and saw the site was created by someone who had worked for the police before, and realised it was a real tool being used.

But there were other, deeper issues he was also worried about involving privacy issues.

He said there were also basic actions someone could take to bypass the tracking technology, meaning the site might not be reliable.

The police were alerted to his concerns and are working with him to make improvements.

  • If you have symptoms of the coronavirus, call the NZ Covid-19 Healthline on 0800 358 5453 (+64 9 358 5453 for international SIMs) or call your GP - don't show up at a medical centre

There are other worries about the security of the site.

RNZ has talked to a number of tech experts who say the site does not have advanced security.

There are fears the data of people using the service could be stolen.

In a statement, the police said it has made moves to ensure the security of the platform.

"The system is delivered by a third-party provider and was established six years ago for use in search and rescue situations," the statement read.

"We have taken a range of actions to ensure the security of the platform and provided confidence in the legitimacy of the text.

"We will continue to investigate further enhancements for the platform moving forward."

The police said those receiving text messages from 4511, are asked to click on a hyperlink and share their location.

If people do not respond and give permission, the police may follow up with a personal visit.

The Privacy Commissioner, John Edwards, said he has been briefed by the police on the platform, and said he has been reassured that steps are being taken to ensure system is fit for purpose.

Get the RNZ app

for ad-free news and current affairs