Soccer fans traveling to Qatar for this year’s FIFA World Cup will be asked to hand over their smartphone data for the privilege.
The country is requiring that visitors install two apps – Hayya, the official World Cup app, and Ehteraz, for tracking COVID-19 – that experts have labeled as spyware, according to POLITICO.
Visitors are warned to bring only a burner phone and take “special care” with photos, videos and other data “that could place you in difficulty with” the Islamic nation’s morality laws, France’s national data protection authority, CNIL, told POLITICO.
The Ehteraz app in particular asks for access to read and edit all content on the phone, as well as its location and the ability to place calls and prevent the phone from being locked, according to Norway’s public broadcaster NRK.
“If you’re hunting the opposition, gays, or others you don’t like, an app like this will make it much easier for you,” Martin Gravåk, a developer at an IT consulting company, told NRK.
Hayya requests the ability to share personal information almost limitlessly, NRK reported. Like Etheraz, Hayya also accesses the phone’s location and prevents it from being locked.
“It’s not my job to give travel advice, but personally I would never bring my mobile phone on a visit to Qatar,” said NRK’s head of security, Øyvind Vasaasen.
A University of Oslo researcher described the apps as “very intrusive,” NRK reported.
“It allows for government surveillance, and since it is Qatar, that has to be considered as well,” said the researcher, Naomi Lintvedt. “This increases the risk that data will be used for purposes other than pure infection tracking.”
Another Norwegian security expert who analyzed the apps told NRK they are not much worse than typical apps, but collect information that has a “high potential for abuse.”
“In a way, you have to trust the people who develop or own the apps, and it is not a given that you particularly want to trust the authorities in Qatar,” the expert, Tor Erling Bjørstad, said.
NRK reported that FIFA declined a request to comment on the apps’ security.
