23 September 2026
We expose yet another South African government IT fiasco. Illustration: Lisa Nelson
The Gauteng government’s e-Panic app allows residents to report crimes as well as request emergency assistance. We found that the database used by the app was not secured.
The app exposed users’ personal details, crime reports, their uploaded images and location information. GroundUp found this by analysing the app, and what it connects to. We broke no laws and did no hacking. A tech-savvy computer user could easily have replicated what we did.
The exposed reports alleged domestic violence, assault, theft and drug-related crimes. Accessible information included the names, gender, age, phone numbers, email addresses and vehicle registration numbers of users.
Images related to crime reports that users uploaded were also accessible, as were descriptions of crimes, which sometimes named the alleged perpetrators.
To be clear: this means that sensitive crime reports could be connected to the people who lodge them.
Every crime report includes GPS coordinates. The app records more than a single location at the moment a crime was reported. Another exposed section of the database contained location histories, including coordinates, direction, speed and battery information. This could reveal where a person had been moving rather than simply where they pressed an emergency button.
Location is of course important to an emergency response service. An armed response or medical team cannot assist someone if it does not know where that person is. But there is a big difference between collecting location information for an emergency service and leaving that information accessible to all.
Much of the data should have been destroyed by now. Instead the location data goes back to the app’s birth in 2024.
The app itself makes extensive use of background location. The current Android app (as of Monday), version 0.0.18, requests permission to access a user’s location even while the app is running in the background. This is also what is recommended by the government on the flyers for the app.
Step 3 asks users to agree to sharing their live location.
Another exposed part of the system contained the one-time pins (OTPs) used to register or log into the app. The records were named using users’ cellphone numbers. Recent records contained the cellphone number, the six-digit OTP, when the OTP was created and whether it had been used.
This defeats the point of sending the code by SMS. Someone who knows a registered user’s cellphone number could have requested a new login code and then retrieved that code from the exposed database.
On the ePanic website under a section titled “Security of Your Personal Data” it says: “We use administrative, technical, and physical security measures to help protect your personal information. We work hard to protect your information from unauthorised access, disclosure or destruction, for example, by making use of end-to-end encryption and obfuscation of personally identifiable information where possible.”
This is nonsense. We saw no evidence that personal data is obfuscated.
There is a contradiction between what the app does and what users are told (at least as of Monday). The app’s Google Play page states that no data is collected and that no data is shared with third parties. Google says this information is provided by the developer.
Yet the app cannot provide its advertised service without processing information about its users. It stores user accounts, locations, crime reports and photographs. The current Android app asks for background location, camera and microphone permissions. Also, the app interacts with at least three different services, including Discord, a chat app for gamers. (It’s unclear to us why this app needs to communicate with Discord.)
Apple users are told something different. The privacy declaration in the App Store says that location, physical address, email address, name and phone number may be collected and linked to a user’s identity. It also says location and contact information may be used to track users across apps and websites owned by other companies. Apple notes that this information was provided by the developer.
The Gauteng government markets the e-Panic Button as a way for residents to access private armed response and medical emergency services. Google Play shows more than 100,000 Android downloads.
In August, the Department of e-Government said the service had recorded more than 180,000 downloads. The Google Play page identifies the Gauteng Department of e-Government as the developer and provides an Evolve VAS email address for app support.
We emailed the Gauteng government and Evolve at noon on 21 September. We gave them 24 hours to take action to fix the security vulnerabilities or take the app down. We also offered assistance, which, to their credit, Evolve accepted. Evolve sent us a detailed email explaining every action they had taken. The problems identified in this article appear now to have been rectified. Evolve thanked us for bringing the problems to their attention. To their credit they acted swiftly to fix the vulnerabilities.
But it must be said these were not sophisticated security vulnerabilities; they should not have occurred.
We gave the Gauteng government 24 hours to comment. A GroundUp staff member tried, unsuccessfully, to phone Elijah Mhlanga, the provincial spokesperson. He also sent Mhlanga a WhatsApp. We received no response at all.
We also emailed the Information Regulator. We got an automated response telling us that we had to log in to a system on the regulator’s site to lodge an enquiry. Despite having the skills to identify security vulnerabilities, we did not have the skill to navigate this aspect of the regulator’s website.
The government’s e-tender website is hard to navigate. It appears from this page that Evolve was one of four bidders for the e-Panic contract, and from this unofficial page that Evolve was awarded the bid on 6 March 2024. The contract is worth R10-million. We could find no telephone number on the company’s website, only a contact form and email address.
Company records show the directors are Mahesh Pillay and Latisha Singh. There is very little about them online. The company is based in Midrand.
According to a MyBroadBand article published last month, “Aura, the security network operator behind Namola, Samsung SOS, MiWay MyGuard, Sayf for Tracker and FNB GuardMe, is no longer supporting the Gauteng e-Panic button platform.”
MyBroadBand quotes an Aura spokesperson saying: “Aura provided the backend infrastructure for this initiative when it first launched; however, it has not been involved in the programme for over a year.”
In the US and Canada every child knows that in an emergency you call 911. In the UK it’s 999. In South Africa, there is 10111 for the police and 10177 for medical emergencies. But these numbers are so poorly responded to that the public has lost confidence in them. There is now also 112 for cellphone users. In case of fire you have to call your local fire department, each with a different number. If you need to be rescued off Table Mountain, there’s another number. It goes on and on.
The state’s failure to have one properly working central emergency number led to a proliferation of private services such as those involving Aura.
The e-Panic button is a state service set up also effectively as an alternative to a central emergency number. It raises the question: why put a considerable amount of money into yet another emergency contact mechanism instead of fixing one central national emergency line?
The Protection of Personal Information Act (POPIA) requires organisations to take appropriate measures to protect personal information against unauthorised access.
The Information Regulator describes a security compromise as including unauthorised access or disclosure of personal information. It says all security compromises must be reported, irrespective of the level of risk, and affected people must also be notified. The regulator’s guidance says organisations must identify what personal information was accessed, how many people were affected and the possible consequences of the compromise.
