Mon, Feb 13, 2023 page2

• All messages to contact tracing hotline deleted

  DATABASE CLEARED: About 4.78 billion messages with location data have been deleted, an audit agency said, after earlier finding fault with the handling of the data

  • By Shelley Shan / Staff Reporter
  • • 
    • 
    • 

  About 4.78 billion text messages that people had sent to the Central Epidemic Command Center (CECC) as part of the nation’s COVID-19 prevention efforts have been deleted, the National Audit Office said on Friday.

  The center had asked people to send it a message with location data when entering stores and other widely frequented places from 2021 to last year, as it sought to trace the contacts of all confirmed COVID-19 cases.

  People were asked to scan a QR code at location entrances, prompting an automatically generated message containing the number that the CECC had assigned to the venue to pop up on their smartphone.

  

  A cellphone displays a text message as a person scans a contact tracing QR code in Taipei in an undated photograph.

  Photo: Chien Li-chung, Taipei Times

  Sending the messages to the center’s 1922 hotline was free of charge.

  The office said in a statementthat the National Communications Commission (NCC) and telecoms had helped set up databases of the hotline’s location data.

  The data helped local health departments trace the movements of people infected with COVID-19 and notify those who had been near them, it said.

  About 4.78 billion automatically generated messages had been sent to the hotline from May 2021 to May last year, the office said.

  However, the office said that oversight over the database had at times been insufficient.

  “In May last year, we found that the National Communications Commission did not check all data storage locations to see whether the text messages were completely deleted, including their main and backup servers,” the office said.

  “Some disease prevention agencies accessed text messages in databases using private computers and mobile devices. The messages on the non-governmental devices could still be downloaded even after the government had stopped requiring people to access the 1922 text messages,” it said.

  The Executive Yuan’s Cybersecurity Department, which in August last year became the Administration of Cybersecurity under the Ministry of Digital Affairs, at the time failed to conduct an external audit to ensure that messages were completely deleted or destroyed, exposing the data to the risk of being leaked to a third party through improper use, the office said.

  After finding the oversight lapses, the office continued to track the progress that agencies made in erasing the text messages, it said.

  As of the end of last year, the NCC had terminated its contracts with telecoms, and ensured that databases were closed and no messages were in them, it said.

  The CECC also ensured text messages downloaded by local government officials had all been destroyed, the office said.

  “The Administration of Cybersecurity has listed management systems for electronic disease prevention data as an item for cybersecurity evaluation,” the office said, adding that the evaluation would “lower the risk of personal data being leaked to third parties.”
• Most Popular

  • 1

    Taiwan to purchase 28 more HIMARS

  • 2

    Magnitude 5.5 aftershocks possible after 6.2 quake

  • 3

    Taipei tops list of cities with ‘highest staying power’

  • 4

    Tropical Storm Podul strengthens into typhoon

  • 5

    Alcaraz battles as Shelton, Zverev ease through