Beijing Olympics organisers say app security flaws 'fixed'

BEIJING: An app that Winter Olympics attendees must use has been patched, a Chinese official told AFP Thursday (Jan 20), after cybersecurity researchers said they had found a "simple but devastating" flaw that could allow data leaks.

Next month's Games are being held in a bubble that separates participants from the rest of the population as part of China's strict zero-COVID policy.

Those taking part - from foreign athletes, delegates and media to the army of local volunteers and officials - have to download a health-tracking app called MY2022.

Users report their health status daily through the app which collects data including vaccination status and coronavirus test results, as well as travel and passport details.

Earlier this week researchers at the University of Toronto's Citizen Lab said they discovered the app's security flaws could allow data including health information and voice messages to leak, which could then be read by "eavesdroppers" such as Wi-Fi hotspot operators.

But a senior Chinese Olympic official said any bugs had now been fixed.

"There is definitely no data leakage," Beijing Olympics Organising Committee (BOCOG) tech chief Yu Hong told AFP, adding that the app's user and privacy guidelines were reviewed by the International Olympic Committee.

"The security loopholes have already been fixed. If they existed in earlier versions, they have been fixed in the latest version."

The app's developers have been in email contact with Citizen Lab since Wednesday, Yu added, promising that there will be "relevant discussions" on follow-up work.

Yu did not deny there may have been security flaws in previous versions of the app and she suggested that BOCOG had not been aware of them.

"During development we have continued to