Mandatory Olympic Athlete App Gives China Data Goldmine

Less than a week after Team USA advised Olympic athletes to purchase disposable “burner” phones to thwart Chinese surveillance of the Beijing Winter Olympics, researchers at the University of Toronto are warning of serious security issues in the “MY2022” smartphone app China is requiring all athletes, journalists, and spectators to download on their smartphones.

Citizen Lab, the University of Toronto’s cybersecurity watchdog group, said on Tuesday the MY2022 app “has a simple but devastating flaw where encryption protecting users’ voice audio and file transfers can be trivially sidestepped.”

“Health customs forms which transmit passport details, demographic information, and medical and travel history are also vulnerable. Server responses can also be spoofed, allowing an attacker to display fake instructions to users,” Citizen Lab found.

Furthermore, while MY2022 greets users with friendly cartoons and “fairly straightforward” requests for information relevant to attending the Olympics, Citizen Lab discovered it also “collects a range of highly sensitive medical information” and forwards it to parties unknown.

“One of the functions MY2022 includes is to collect a list of medical information for health monitoring, which includes users’ daily self-report health status, COVID-19 vaccination status, and COVID-19 lab test results,” the researchers noted. – READ MORE