SmartPlay loophole fixed amid testy words for launch

Stacy Shi

The Leisure and Cultural Services Department has plugged a loophole in its latest venue booking system SmartPlay that has led to leakage of users' personal information and an IT expert to criticize authorities for its sloppy and flawed design.

Users of the system, which came into operation on Thursday, could see the full Chinese names of people who have booked a LCSD sports venue after typing in a random English name.

Hong Kong Information Technology Federation honorary president Francis Fong Po-kiu said the function was deleted by noon yesterday.

Users on Monday night found that when booking a football pitch and adding fellow players, their Chinese full names automatically popped up when entering an English name into the "alias" search box.

In response to media inquiries, the LCSD said it has since asked the contractor to stop SmartPlay from showing full Chinese names, remove the search function, and let users add fellow players only after they have accepted a friend request.

Fong said authorities should have conducted a public user test before launching the system.

He said such personal information could be used for scams as fraudsters only needed to match user names with other leaked information on the dark web to obtain their contact details.

"They can send a phishing link to [the users] asking them, for example, to pay HK$10 for the football field. Of course, they will enter the phishing site, and it will ask you to fill in credit card numbers or even a one-time password," said Fong, "but when you do that, you are not paying HK$10, but maybe HK$5,000."

Legislative Council member Doreen Kong Yuk-foon agreed that a public user test should have been conducted first, with, for example, some 100 coaches, athletes and occasional users trialing the system.

Privacy Commissioner for Personal Data Ada Chung Lai-ling said an email had been received from LCSD about the incident and their follow-up measures.

Chung added that her office had not received any complaints but reached out to LCSD yesterday and would actively monitor the situation.

"The PCPD received 119 reports on data leakage in the first 10 months this year. We have also proposed to the government to increase the penalties, such as introducing an administrative fine mechanism to deal with untimely reports."