Iran Launched an App That Claimed to Diagnose Coronavirus. Instead, It Collected Location Data on Millions of People.

On Tuesday, March 3, the smartphones of tens of millions of Iranian citizens beeped in unison.

Dear compatriots, before going to the hospital or health center, install and use this software to determine if you or your loved ones have been infected with the coronavirus," said the message, which claimed to come from the Ministry of Health.

It included a link to download the app from an Iranian app store called Cafe Bazaar.

Of course, the app couldn't tell citizens if they had coronavirus. But what it could do is hoover up huge amounts of data on citizens, including names, addresses, dates of birth, and even track people's location in real time.

The government has already boasted that millions of citizens have shared this information with them at a time when most Iranians are completely in the dark about the threat from coronavirus. The government is being accused of covering up the real infection and death rates with experts claiming the real figures are exponentially higher. With confusion and fear gripping many parts of Iran, this app is looking to take advantage of that to boost Tehran's surveillance capabilities.

The regime's survival is intertwined with suppression, surveillance, espionage, and intruding in the most personal affairs of the Iranian people," Shahin Gobadi of the National Council of Resistance of Iran, base din Parid, told VICE News. It does not spare any opportunity to intensify its efforts, even at the time of such a major crisis such as coronavirus."

READ: Iran says it only has 500 coronavirus deaths. So why can you see the mass graves from space?

Iran is one of the countries hardest hit by the coronavirus outbreak. On Saturday, officials confirmed that 611 people had died in total, with the country recording 1,365 new infections in the previous 24 hours, bringing the total to more than 12,700.

But public health experts believe that the real death toll is much higher, with some predictions based on a variety of indicators suggesting that the number of infections in Iran could be as high as 2 million.

On Thursday, Gobadi's NCR group presented a report from more than 65 Iranian physicians, medical staff, and professionals in the medical field in Europe, North American and Australia to the World Health Organization, claiming that based on its research - including interviews with frontline medical workers - the death toll was over 3,000.

The report also claims Tehran covered up early cases of the coronavirus in order to boost attendance at an annual march marking the anniversary of the 1979 Revolution on Feb. 11 and local elections on Feb. 21.

READ: Iranian officials keep dying from the coronavirus

But as Iran's lawmakers and government officials began to contract the virus and in many cases die, the government sought to quell the growing sense of unease with a new app.

Real-time tracking

The app is called AC19 and it claims to be able to detect whether or not people are infected, says the coronavirus anti-virus program is designed by the Ministry of Health to detect the likelihood of people having coronavirus."

Once downloaded the app asks users to verify their phone number - even though the government has access to all phone numbers via its control of the country's cell providers. Then users are prompted to give the app permission to send precise location data to the government's servers.

Screen shots of visual prompts from Iran's tracking app AC19, which claims to diagnose coronavirus but actually collects location data.

The problem is that the prompt is part of the Android system and unless users have changed the default setting, the prompt is displayed in English, not Farsi, meaning the vast majority of users won't know what they are being asked.

READ: Iran's answer to the coronavirus outbreak: cut the internet

And for the 40% of Android users in Iran who are using an older version of Android, there will be no prompt at all, meaning their location data is shared without their knowledge.

But one expert who has looked at the app's code says that the location monitoring goes far beyond just finding out where in the country you are located:

Collecting location data is not a one-off thing," Nariman Gharib, an Iranian security researcher living in London, told VICE News, pointing out that the app uses an Android library that is typically used by fitness apps to track your movement. They can actually track you. If you move your device from location A to B, they can actually see that in real-time."

Instant results

The app itself claims to be able to detect if a user has contracted COVID-19 or not. To do this, it asks a series of YES or NO questions about the symptoms users are experiencing. Once these are answered, users click submit" to send your details to the government for assessment.

But instead of having to wait hours or days for a result, the app claims to be able to diagnose you in second, telling you if you are more or less likely to have contracted the disease and whether or not you should go to the hospital.

It is impossible to say how many of Iran's citizens have downloaded the app, but according to this tweet from the ICT minister MJ Azari Jahromi, at least 3.5 million people have now shared their precise location and intimate details with the government.

History of surveillance

Tehran has in the past shown its willingness to monitor and track the communications of its citizens including restricting and even shutting down internet access in times of crisis.

During the November 2018 uprising in Iran protesters made wide use of the encrypted communication app, Telegram. In the aftermath of the crisis, the regime built its own version of the apps, called Golden Telegram and HotGram, which had up to 30 million users inside Iran.

The apps looked like the official Telegram app, but the company soon issued a warning that the apps were unsafe and the Iranian government could be monitoring all communications.

The company that built the apps for the government back in 2018 was Smart Land Solutions, a company known today as Sarzamin Housmand - the same company that produced the coronavirus app.

The development of the app will likely only add to the confusion among citizens in Iran where the regime has kept tight control on information being shared.

On Friday Tehran moved to limit the spread of the coronavirus by announcing that security forces would be clearing all public spaces such as city streets - another decision designed to maintain control at all costs.

The regime's attitude is evident during the coronavirus crisis," Gobadi said. Instead of being transparent and alerting the public regarding the real scope of the crisis, the regime has resorted to a massive campaign of deception and concealment particularly as it pertains to the number of victims and fatalities."

Cover: A woman wears a protective mask while using a smartphone as she stands along the side of a street in the Iranian capital Tehran on February 24, 2020. (Photo by ATTA KENARE/AFP via Getty Images)