Selangor’s SELangkah app riddled with bugs and data privacy concerns despite ‘re-launch’

A new updated version of the SELangkah application launched by authorities in Selangor recently has raised not only more questions on the quality of the contact tracing software to monitor Covid-19 infections, but also concerns over data privacy.

Checks by MalaysiaNow show that the new version of the app offers few functions that are focused on tracing infections, unlike the nationwide MySejahtera app endorsed by federal health authorities.

Despite this, the Selangor government has been insisting on the continued use of the app alongside MySejahtera.

One additional feature is the inclusion of a login for users, something MySejahtera had already implemented.

However, the SELangkah app does not make it compulsory to key in one’s MyKad number, only the name, phone number and a password.

Another new feature allows users to scan the MySejahtera QR code as well, although it was found that this would not update the data in the user’s MySejahtera account.

The app is also still riddled with bugs despite its “re-launch”, MalaysiaNow’s inhouse IT team has found.

For example, tapping on the “screening” feature returns only a string of code.

The map showing locations of infections is also not as detailed as the one offered by MySejahtera as the number of cases is not available.

As of press time, only an Android version of the app was available on Google Play.

It is believed that the app’s unresolved issues would mean that the developer has been unable to simultaneously roll out an iOS version as well.

MalaysiaNow has contacted Dr Helmi Zakariah, who previously reacted angrily to MalaysiaNow over problems found on the app he developed, but has yet to get a response.

Data privacy

Checks have also revealed serious loopholes in terms of data privacy for SELangkah users.

While the state Covid-19 task force chief Dzulkefly Ahmad has defended the app in the face of recent revelations by MalaysiaNow that it is inferior to MySejahtera, even questioning the federal government’s data privacy commitments, a careful reading of SELangkah’s terms and conditions reveals conflicting claims on data privacy.

• Selangor’s SELangkah found to be ‘inferior’ to MySejahtera, checks reveal
• Selangor to relaunch SELangkah contact tracing app
• Selangor continues to fare worst in daily virus spikes despite SELangkah app

On its website, the app developer Selangkah Ventures Sdn Bhd denies that personal data will be used for commercial purposes, saying it is only to allow the state Covid-19 task force and state health authorities “to inform you directly if you have come into contact with a person infected with Covid-19 at the same business premise you visited”.

However, terms in its privacy statement on both Google PlayStore and the SELangkah website state that personal data collected from users will be used to respond to their inquiries related to employment opportunities or other requests, as well as to send offers and promotional materials related to the company’s services and for other marketing purposes with the user’s consent.

Another clause says the app can track users’ online activities including pages visited.

“We may collect information about your online activities, over time and across third-party websites. Such information may be used to provide you with advertising about products and services tailored to your interest or to provide you with enhanced products and services,” according to the terms dated Jan 19, 2021.

It also says the company can transfer personal information to third parties in the event of a potential or actual sale or transfer of all or a portion of its business or assets, or other business transactions.

The revelation could spark a debate on the real reason for the state to insist on using SELangkah despite the availability of MySejahtera which is found to be more robust in its data interpretation and provides additional layers of security for users.

A source who has worked closely with health authorities battling the pandemic told MalaysiaNow that a contact tracing application should not commercialise the data collected from its users.

It also questioned the so-called e-commerce features that SELangkah would be dishing out, including to facilitate e-wallet transactions for small and micro businesses.

“They cannot be having a contact tracing app and now an e-commerce platform through the app,” it said, adding that there are risks involved in such features.

“Whatever scanning users do and their personal information transferred through the SELangkah QR codes could be used for commercial purposes.”