We found flaws in Gauteng’s panic button app. The province set the cops on us

The Gauteng Department of e-Government waited two weeks before reporting security flaws to the Information Regulator

Bonginkosi Dhlamini, MEC for the Department of e-Government. Photo: Gauteng government

The Gauteng Department of e-Government waited 14 days before reporting serious security flaws in its e-Panic Button app to the Information Regulator.
The department did send SMS notifications to residents, but these did not explain what personal information had been exposed.
A slide presented by the department to the Gauteng legislature indicates that a criminal complaint has been lodged with the police against GroundUp and/or the student who discovered the vulnerability: me.

In a presentation to the Gauteng legislature’s Portfolio Committees on e-Government and Community Safety, the Gauteng Department of e-Government said it had been to the police to lodge a criminal complaint against GroundUp and/or the student who discovered security flaws in its e-Panic button: me.

GroundUp reported on 23 September that the database behind the province’s emergency app was left unsecured, exposing the names, contact details, crime reports and location histories of users. Some users had reported domestic violence and assault. Uploaded images and one-time login codes were also exposed.

GroundUp informed the department and the app’s developer, Evolve Value Added Services, of the vulnerabilities at noon on 21 September.

Evolve responded promptly and fixed the issues. They also thanked GroundUp. But the department did not respond to us and only issued a statement a week later, claiming that no personal information had been compromised.

Section 22 of the Protection of Personal Information Act (POPIA) requires that when there are grounds to believe personal information has been accessed by an unauthorised person, the Information Regulator and those affected must be informed “as soon as reasonably possible”.

But it seems the department only notified the Information Regulator on 5 October, hours before officials appeared before the legislature to account for the incident.

This emerged from a joint meeting of the legislature’s Portfolio Committees on e-Government and Community Safety on 5 October.

In a statement issued on Thursday, the committees expressed concern about the delay.

The Democratic Alliance has questioned whether the department’s two-week delay complied with these obligations. In a statement on Monday, the DA’s Waters demanded an explanation for the delay, as well as the release of the original security assessments and the full investigation findings.

Users received SMS messages

The department sent SMS messages informing users about the incident on 5 October.

The SMS said the app remained operational and urged users to be alert to suspicious communications and protect their personal information. But the message did not tell recipients what information was exposed or for how long, or whether their own information was affected.

The SMS tells recipients that the department is investigating a cybersecurity incident affecting the e-Panic Button app.

According to POPIA, affected people must be given enough information to protect themselves, including information about the possible consequences of a breach, and the steps being taken to address it.

But the Gauteng department’s SMS is merely a warning and provides very little information. The department says the platform has more than 280,000 registered users and about 60,000 crimes have been reported through it. But it has not provided the number of users exposed.

The committees have demanded that the department provide the number of exposed users, records and images, proof of notification to the Regulator, and copies of communications to residents.

Police case against us

Gauteng government spokesperson Elijah Mhlanga, who has not responded to a single GroundUp query on this matter, has told The Star that a police case was being opened in connection with the incident.

Also, a slide presented to the committees by the department shows that it was trying to lodge a criminal complaint with the police. The slide states: “SAPS case” and “Affidavit has been completed – criminal case 06/10/2026”. Michael Waters, a member of the e-Government committee for the DA, confirmed to GroundUp that the case referred to GroundUp and/or me.

We are not sure what offence is alleged or whether a case has been formally registered. The department told the committees that the police advised that Evolve, as the custodians of the database, should open the case. Questions from GroundUp to the government and Evolve have gone unanswered.

GroundUp discovered the vulnerabilities by analysing the publicly available app and the services it connects to. No passwords needed to be guessed or security measures bypassed. The information was accessible because the database had not been properly secured.

The department has still not established how long the information was exposed or whether anyone else accessed it. The department has said the vulnerabilities GroundUp identified were fixed quickly after being reported. But there is no information on who may have accessed users’ information while it was exposed for all to see.

The department failed to respond to questions from GroundUp sent on Monday.

Investigation

The legislature has also called for

an independent investigation into the security failure alongside the investigation by Evolve, the company responsible for developing and hosting the app, whose report is expected on 20 October;
information on whether the department carried out proper security assessments before launching the app — the e-Panic Button is part of a contract reportedly worth R269-million, of which R131.3-million has already been paid to Evolve;
details of the contractual provisions on cybersecurity, data protection, incident reporting and liability; and
details of any consequences for officials responsible for overseeing the contract.

The Portfolio Committee on Community Safety also intends to engage SAPS about measures to protect people who reported gender-based violence through the app.

Don't miss out on the latest news

We respect your privacy, and promise we won't spam you.