A major flaw in the Conservatives’ official conference mobile phone application has made the private data of senior party members – including cabinet ministers – accessible to anyone that logged in as that particular conference attendee.
The data of hundreds of attendees to the Tory conference could be viewed by second guessing attendees’ email addresses, with Boris Johnson, Michael Gove, Gavin Williamson and others among those whose personal information – including their phone numbers – was made accessible.
Once logged into the app, users were able to both amend and make the personal details of prominent MPs public. Twitter users claimed Johnson’s picture had been briefly changed to one featuring a pornographic image.
Gove’s picture was changed to Rupert Murdoch, his previous employer at the Times. Anyone could log in as any attendee by providing an email with no password. Many MPs had registered with their public parliamentary email addresses, making it simple for any member of the public to access their mobile number via the app.
Commentators said the flaw raised questions over the ability of the government to harness technology to solve issues around the Irish border and customs checks. The app may also have breached data laws. Its privacy policy states that it “complies with … the European Union’s general data protection regulation (GDPR)”.
The breach enraged senior ministers. One Whitehall source described the error as “fucking ridiculous”. Anger was immediately aimed at Brandon Lewis, the Tory party chairman whose duties include overseeing the conference.
Labour said that the mishap raised questions around national security and recommended the Tories provide computer training to their members. “How can we trust this Tory government with our country’s security when they can’t even build a conference app that keeps the data of their members, MPs and others attending safe and secure?”, said John Trickett, the shadow Cabinet Office minister.
“The Conservative party should roll out some basic computer security training to get their house in order.”
The Information Commissioner’s Office (ICO) said it would be making inquiries about the breach and added that “organisations have a legal duty to keep personal data safe and secure”.
Under GDPR, organisations must notify the ICO within 72 hours of becoming aware of a personal data breach, if it could pose a risk to people’s rights and freedoms. The app’s privacy policy states that it complies with the EU’s GDPR.
A Momentum spokesperson criticised the “staggering incompetence” of the Conservative party and cited the success of its own in-house app during the Labour party conference this week.
“This sums up the Tories, staggeringly incompetent and out of touch with the modern world,” they said. “They can’t even build a basic conference app without a huge data breach, and it’s terrifying that they’re in charge of the tech that runs our hospitals, schools and airports.
“Our conference app was built by a team of volunteers for next to no money, and I’m sure they’d be happy to give the Tories a few tips for next year.”
It's let me login as Boris Johnson, and just straight up given me all the details used for his registration pic.twitter.com/fLNC06azx7
— Dawn Foster (@DawnHFoster) September 29, 2018
The Guardian columnist Dawn Foster was among the first to notice the flaw and swiftly raised the alarm on Saturday.
“The Tory conference app allows you to log in as other people and view their contact details just with their email address, no emailed security links, and post comments as them,” she tweeted.
“They’ve essentially made every journalist, politician and attendee’s mobile number public. Fantastic.”
The app, created by an Australian firm called CrowdComms, was updated and the login function removed after concerns were raised with the party.
The Conservative party said in a statement: “The technical issue has been resolved and the app is now functioning securely. We are investigating the issue further and apologise for any concern caused.”
The prime minister, Theresa May, refused to respond to questions from reporters about the embarrassing security blunder as she arrived in Birmingham.
It follows the gaffe that unfolded last year during Theresa May’s keynote speech when a comedian managed to get to the front of the stage and pass her a P45, which she accepted.
The set behind her – featuring the slogan ‘“Building a county that works for everyone”’ – soon began to fall apart, and she lost her voice, prompting the shadow chancellor, Phillip Hammond, to offer her a cough sweet.
