The Hong Kong government has admitted that the LeaveHomeSafe contact tracing app comes with a facial recognition function, but stressed that the feature has never been used.
Officials said an update will be issued to the COVID-19 tracing app to remove the feature.
This comes after Hong Kong-based news agency FactWire exposed a facial detection feature in the source code of the Android version of the app in a report on Tuesday.
Source code is the underlying set of computer instructions used to create a program or piece of software.
In a phone interview with Commercial Radio on Wednesday, Deputy Government Chief Information Officer Tony Wong said the iOS version of the app probably also has the facial recognition function, but insisted that authorities did not request such a feature to be included nor has it ever been activated.
“After receiving the [media] query, we immediately followed up with the contractor responsible for the development and maintenance of the app. We found it strange why there are codes that we did not request for in [the app],” he said.
Wong explained that readily available modules are used for the development of most apps and the modules come with different functions.
For the LeaveHomeSafe app, he said that modules related to the cameras of smartphones are used in order to perform scanning processes, such as for QR codes of venues and electronic vaccination records.
Wong said the developers only activated such functions, but not others, such as the facial recognition feature.
He added that the government has told the developers to remove functions that are not needed in all versions of the app, including the facial recognition feature, and will issue an update.
“But we will do this in a way that does not affect how the app operates on a daily basis as we have around 7 million residents using it every day,” Wong said.
As for why authorities did not realize this earlier, Wong said that they had engaged independent third parties to conduct privacy impact and security risk assessments but they might not have checked unactivated parts of the source code.
The LeaveHomeSafe app was introduced in 2020 as part of the government’s COVID-19 contact tracing efforts.
Despite the authorities’ reassurances that the app does not pose any security risks, some members of the public have raised concerns about data privacy.
Some have opted to download a fake LeaveHomeSafe app, which has since been deemed illegal; use a second smartphone solely for the app; or avoid going to venues requiring the app altogether.
