Beijing 2022: IOC under fire from research body

The International Olympic Committee (IOC) has been branded “irresponsible” for requiring participants to use an application devised to monitor the health of attendees at the 2022 Winter Olympics in Beijing “with such glaring security vulnerabilities”.

Athleten Deutschland has hit out at the IOC after a report by a watchdog group raised serious cybersecurity concerns with the “My2022” smartphone app.

Research carried out by the Citizen Lab, an interdisciplinary laboratory based at the Munk School of Global Affairs at the University of Toronto in Canada, found that My2022 has a “simple but devastating flaw” that would make users’ sensitive information at risk of being hacked.

Athletes, officials and other attendees of the Games are asked to start using the app 14 days before flying to the Chinese capital as part of Beijing 2022’s COVID-19 countermeasures.

Once downloaded on their smartphones, users are required to submit health and travel information including COVID-19 test results and vaccination certificate.

The multi-functional app also allows attendees to transfer files, find out the latest news and weather from Beijing and offers video and audio chat tools.

However, Citizen Lab examined the app and found that a “simple but devastating flaw” allows the encryption protecting users’ voice audio and file transfers to be “trivially sidestepped”.

The report raises concerns that the sensitive data could be read by any “passive eavesdropped” and claims server responses can be “spoofed” to allow a hacker to provide fake instructions to users.

Jeffrey Knockel, author of Citizen Lab, claimed the “worst-case scenario is that someone is intercepting all the traffic and recording all the passport details, all the medical details”.

The IOC insisted there are “no critical vulnerabilities” with the app, insisting it had conducted “independent third-party assessments”.