HK's LeaveHomeSafe app deletes vaccine pass QR codes, government apologises

Some users of Hong Kong's contact tracing app mobile app LeaveHomeSafe have lost their vaccine records or exemption codes after updating the app due to a technical glitches caused by the service provider. 

In a statement, the Office of the Government Chief Information Officer (OGCIO) said that due to a technical error caused by LeaveHomeSafe's service contractor after a service update on 10 May, the vaccine pass QR codes of some Google and Huawei users were deleted. After learning the incident the OGCIO said it had taken immediate follow-up action and released the updated version on Google Play and Huawei AppGallery four hours after the incident.  In addition to users' vaccination records, exemption certificate QR codes, recovery record QR codes and more stored in the app would be deleted. The issue however, does not affect Apple iOS users.

Although the OGCIO apologised to the public for the inconvenience, it also issued a warning letter to the service contractor, requesting follow-up action and measures to improve the control procedures. 

The LeaveHomeSafe app also faced some chatter last week after Factwire said that after converting the source codes into readable java source files, it discovered LeaveHomeSafe's source code file comprises about 20 folders, containing a subfolder named “reactnative” which further comprises three folders titled “facedetector”, “camera”, and “maskedview” respectively. Factwire added that one of the java files may be used to detect the positions of a person’s mouth, nose tip, left and right cheeks, eyes and ears. It can also detect the person's head tilt in degrees and calculate the probability that they are smiling or has each eye open. However, after testing the app by entering debug mode, FactWire learned that the app only uses the rear camera of the device. It said the probability of the user’s face being detected is very low.

In response to the report, a spokesman for the Office of the Government Chief Information Officer (OGCIO) said the operation of the LeaveHomeSafe mobile app has never been used nor required any facial recognition function since its launch.

"After following up with the contractor responsible for the development and maintenance of the app, the OGCIO learned that the contractor had adopted a readily available module in the market for the development of app to operate the phone’s camera to perform the scanning processes required for the operation, including scanning and interpreting the venue QR code, the electronic vaccination QR code and the taxi registration mark," the spokesperson said. 

Starting 24 February, all people aged 12 and older are required to have had at least one COVID-19 vaccination in order to enter different businesses and premises as set out by the government. These include restaurants, gyms, beauty parlours, shopping malls, and supermarkets. The staff of the premises are required to be vaccinated too.

Vaccine pass requirements are also applicable to some other premises such as schools, universities, offices of the Government and public organisations, indoor venues managed by the Leisure and Cultural Services Department, public hospitals, residential care homes for the elderly, and residential care homes for persons with disabilities. However, the vaccine pass requirements of these premises may differ. For example, students are not subject to vaccine pass requirements imposed by primary and secondary schools.

Related articles
HK government confirms LeaveHomeSafe app has facial detection module, requires developer to remove
Everything you need to know about Hong Kong's 'Vaccine Pass' effective 24 February 2022