A US-based code-sharing website, Gitlab, has removed a replica version of Hong Kong’s Covid-19 contact tracing app and its developer’s contributor page from its platform. The app was taken down following a police request and its developer is now the target of an investigation, Hong Kong Police have said.
Four individuals were arrested on Monday over their alleged use of the fake version of the LeaveHomeSafe app, shortly after it became mandatory for most Hongkongers to register their visits to government premises. They were suspected of using a false document, police said.
The fake app was no longer available for download from its hosting platform when the arrests were made, as “the police cyber security and technology crime bureau took action to have the app removed,” a senior inspector of police said during a press briefing on Tuesday, although he did not name the platform.
Investigations are ongoing as the force attempts to identify the developer, he said.
He also revealed that a fifth person had been arrested for allegedly using an old screenshot from the official app to pretend that they had signed in to a building.
The replica — known as the “BackHomeSafe” app — looks visually similar to the official version. The contact-tracing app has become a subject of controversy in the city, where some fear that the community would be under de facto surveillance through an app that records places they visit.
The government has said the app would not upload user data to a server, but has declined calls to open up its source code for inspection.
The Gitlab pages containing the replica app’s code, as well as the developer’s home page, appear to have been removed on Monday.
Takedown request
A person who claimed to be its developer posted an email said to be from Gitlab on the LIHKG forum on Monday night. The email requested proof from the developer that the app did not violate Hong Kong’s laws and Gitlab’s Terms of Use, and included a copy of a takedown request from the police.
“If we do not receive sufficient information within 48 hours, we are required to take the content down and block access to your account,” the email read.
The attached notice purporting to be from the Hong Kong police said the Gitlab pages hosting the app committed “forgery,” in violation of the Crimes Ordinance of Hong Kong, and requested its removal alongside all “fork” pages.
In response to HKFP’s enquiries about the takedown request, a police spokesperson said the force would ask internet service platforms to remove any fake version of websites or apps, depending on the crime involved.
A disclaimer notice on the replica app – which remains accessible to users who downloaded it previously – stated that “it should not be used in place of the government’s LeaveHomeSafe app” and is meant merely for “academic discussion” and for the purpose of previewing app functions.
The US-based code repository platform did not respond to HKFP’s requests for comment, and attempts to reach the app’s developer were unsuccessful.
A competitor to the Microsoft-owned code repository site Github, Gitlab is valued at US$10 billion and is preparing for a US listing. The platform’s terms of service prohibit using its website for “illegal or fraudulent activities”, but its company handbook mentions no policy on responding to takedown or user data requests from law enforcement agencies.
Support HKFP | Policies & Ethics | Error/typo? | Contact Us | Newsletter | Transparency & Annual Report | Apps
Help safeguard press freedom & keep HKFP free for all readers by supporting our team
LATEST ON COVID-19 IN HONG KONG
HKFP GUIDES
