LeaveHomeSafe
LeaveHomeSafe was a digital contact tracing app launched by the Hong Kong Government on 16 November 2020 to conduct contact tracing in Hong Kong. It was used as a companion of the Hong Kong Health Code system for registered users.
The application could be downloaded for free, allowing users to record their whereabouts. Although it did not require GPS positioning, the user must authorize LeaveHomeSafe to use their mobile's communication network, camera lens and notification function and prevent it from going to sleep. It also captured other apps running on the phone, and the personal information collection statement of LeaveHomeSafe stated that the visit records submitted by the app to the Department of Health will be retained for seven years for confirmed COVID-19 cases only. The visit record, which by itself in isolation is not personal data, will be kept in users’ mobile phones for 31 days and will then be erased automatically.
Privacy became the most controversial issue surrounding the app, prompting the use of fake LeaveHomeSafe apps which were later banned by the Government.
On 3 May 2022, FactWire reverse-engineered the Android version of "LeaveHomeSafe" and discovered that the program has a built-in face recognition module with features including the recognition of facial features and location, which led to another controversy about the privacy of the app.
On 8 January 2023, the Hong Kong Government announced that the "LeaveHomeSafe" system would cease operation and no longer be updated. Users were still able to use other features such as the PCR Testing Registration Code. It is no longer available for download.
History
On 24 November 2020, Hong Kong's Chief Executive Carrie Lam said at a press conference that citizens will be encouraged to use it voluntarily, but it is not ruled out that citizens will be required to enter and exit designated premises. They must use the LeaveHomeSafe mobile app. On the next day, the Hong Kong government stated that more than 12,000 public and private venues have been included in the list, including shopping centres, cinemas, government agencies, parks and restaurants, among which more than 1,000 restaurants of various types have participated.The Office of the Government Chief Information Officer announced that as of 17 February 2021, LeaveHomeSafe had more than 1 million downloads.
Starting from 28 January 2021, the government stipulates that citizens entering government buildings or offices must scan the QR code on their mobiles with the LeaveHomeSafe app before they can enter.
On 2 February, the Chinese Temples Committee stated that it is necessary to scan the QR code of LeaveHomeSafe to enter the Che Kung Temple in Sha Tin. The Wong Tai Sin Temple requires that from the first day of the Lunar New Year to the 15th of the first lunar month, believers who enter the temple must scan the LeaveHomeSafe QR code before they can get an "Entry Permit".
On 10 February, the government announced that starting from 1 March, government employees and citizens must scan the QR code to record the name, contact number, and date and time of the visit when entering all government premises. On the 18th of the same month, the government required restaurants and other designated premises to force customers to use LeaveHomeSafe to record the whereabouts of citizens, otherwise they will be fined for 3 to 14 days.
On 22 February, the number of downloads of LeaveHomeSafe exceeded 2.69 million. In addition to topping the download list in Hong Kong. However, in the App Store for Apple mobile phones, LeaveHomeSafe is only downloaded by registered users in 45 countries, and only Hong Kong and Macau rank first in downloads. Some netizens said that no one around them used LeaveHomeSafe, but the number of downloads increased sharply. In addition, there were comments that were not related to LeaveHomeSafe, such as game micro-transaction advertisements. Therefore, there's doubt that through the service company, the application finds people to download a large number of relevant programs and give them five-star praise, so as to raise the download ranking list of LeaveHomeSafe. Compared with Google Play, because the App Store has stricter controls on the "Ranking list", So it is more difficult to brush high downloads. The government Facebook page "Tamar Terrace" stated that the program can be used by people who live in Hong Kong or travel on business or travel. The government did not commission any person or organization to purchase any online advertisements, but it did not answer the number of repeated downloads of LeaveHomeSafe.
On 2 August, the government released a new version of LeaveHomeSafe v2.1, which integrated privacy-preserving AI technology developed by a research team from Hong Kong Baptist University. The new AI technology enables automatic check-out when the user leaves a venue, resulting in more precise contact tracing. The team leader, Prof. Jianliang Xu, explained that it adopts a decentralized design and does not require network connectivity. He emphasized that the program's computations do not involve central servers and do not collect users' personal data or location information. This is in contrast to systems in Singapore, South Korea, and mainland China that centrally collect user data.
Starting from 1 November 2021, the government stipulates that citizens entering government buildings or offices must scan the "LeaveHomeSafe" QR code on their mobile phones before entering. Writing personal information is no longer allowed as an alternative. The policy was extended to cover all premises starting from 9 December. The Government published the Technical Specifications, Security Risk Assessment and Audit Report and the Privacy Impact Assessment Report of the app a day later.
On 22 May 2022, the government announced an official support hotline 18 months later of the app being launched.
The "LeaveHomeSafe" telephone hotline 2626 3066 will be launched tomorrow to handle public enquiries about installing or using the "LeaveHomeSafe" mobile app, from updates of the app to storing and display of the vaccine pass.
The hotline will operate from 7am to 9pm daily. They can also seek assistance from staff at the OGCIO mobile support stations at 25 MTR stations on the use of "LeaveHomeSafe".
New functions of the app was announced on 27 January 2022, including displaying vaccination record.
On 13 December 2022, the Government announced that the public would no longer have to scan the "LeaveHomeSafe" venue QR code upon entry of a premises to take effect on 14 December 2022. Furthermore, on 28 December 2022, the Government announced that the vaccine pass would no longer have to be scanned upon entry of the required premises.
Permissions
According to the permission statement of "LeaveHomeSafe" written on the Google Play, the permissions include using the camera, taking photos and videos, accessing device and application software records, capturing running application software, receiving internet data, controlling the vibration of the device, execute at startup, prevent the device from going to sleep, complete network access.According to the "Record App Activity" function at Apple IOS 15, this application will link to different websites to exchange data, including:
- www.regqr.gov.hk
- www.leavehomesafe.gov.hk
- firebaselogging-pa.googleapis.com
- device-provisioning.googleapis.com
- firebaseinstallations.googleapis.com
Reactions
According to the program development forum, this is a tool that can help hackers invade. While the travel records that LeaveHomeSafe uploads to the government will be kept for 7 years, the records in the app will only be kept for 31 days. Johnny So, barrister and a member of the Progressive Lawyers Group, thinks that it is unacceptable and dangerous for the government to force citizens to use programs. It is believed that it will set a bad precedent, and people think that the government is invading personal privacy on the grounds of fighting the epidemic.
Some restaurants indicated that they would rather only do takeaways than having customers scan the QR code at the restaurant. They were worried about whether they could protect their privacy. Some hot pot restaurants pointed out that the related arrangements would not help the business too much. Some restaurants even post a QR code that mimics LeaveHomeSafe, but after scanning it with a mobile phone, it will link to an unrelated website.
In February 2021, the Hospital Authority Employees Alliance questioned that LeaveHomeSafe is for monitoring the public, not for epidemic prevention. Subsequently, the Innovation and Technology Bureau and the Hospital Authority issued articles to refute the allegations. Patrick Nip, Civil Service Secretary, said that the LeaveHomeSafe program has no tracking function and will not reveal privacy. The Hospital Authority Employees Alliance issued a statement in response, saying that the Innovation and Technology Bureau misled the public and made it difficult for the public to feel at ease. It also criticized the government's poor performance in epidemic prevention and if the government continues to ignore public opinion, it will only further deepen public grievances. The organization stated that in the next week it will continue to appeal to citizens in different areas to boycott LeaveHomeSafe.