Italy, April 2024. I was cruising along a highway between Alessandria and Cremona in northern Italy. It was time for the first coffee break of the afternoon. A large service station with a restaurant, fast food eateries, shops, and a cafeteria was in the right place at the right time. I parked and walked towards the cafe.
A sign at the parking zone reserved for motorhomes, campervans and trucks caught my eye. It seemed to be informing drivers about a webcam.
With a little help from Deepl.com translator I understood that an app called Chef Express provided a live camera view to the parking lot. You could monitor your vehicle while enjoying a meal or coffee at the service area. What the heck was this? My nitpicker mind refused to download the app. Instead, I identified potential risks. This could be a scheme to make me do something I might regret, but what and why?
Sure, you have to guard your property closely in Italy, and installing cameras at the service area parking zone may discourage some thieves. Thank you for the security idea for drivers Chef Express, but from technical and customer convenience point of view it doesn’t make any sense to require drivers to download an app to view a webcam. It is very easy to provide access to a webcam simply by asking users to type a short address to a phone’s web browser. Why has the business invested in the development of an entire app only to provide a simple function like viewing a webcam?
The mystery required a moment of thorough nitpicking while sipping excellent fresh coffee at the cafeteria. I opened the application store on my phone, and readily discovered the app. More than 100,000 downloads already … Mamma mia.
Examining the fine print that is available about the app in the store, the true purpose of the app became obvious. Chef Express is a tracking app. It sucks data from your phone, and conducts business with it. The permissions section in the app information lists that it requires access to the following data and functions on the phone:
- Exact location of the phone.
- Access to audio, images and video on the phone.
- Permission to take photos and videos.
- Advertising ID. (the ID connects the user to other data collected from other sources)
- C2DM messages. (Google notification system)
Data the app may share with other businesses:
- Phone’s device and other IDs.
- Financial data.
- Personal data.
- Photos and videos.
- Messages.
- Application activity.
In addition, people who installed the app have reported that it requires access to the phone user’s Facebook account.
The only technical requirement for an app that provides live webcam image is internet connection, nothing else. All the other permissions and data collection functions the Chef app requires don’t have anything to do with viewing webcam images from a parking lot.
This was enough for me. The case was closed. My nitpicker sensors had sensed a danger, and I had listened. The app was a scheme to collect personal data along with photos and videos. As the app information declared, all collected data may be shared with business partners. Now, I worry about those 100,000 Italian drivers and thousands of foreign travelers who have fallen for the camera app. Their confidential messages, potentially sensitive photos and videos are in the hands of people who will make money with the data.
This sorry scheme is not the only one in the wild world of personal data trading, but it is the first one I have seen in a carpark. The vast majority of tracking and data collection schemes are initiated on the internet by sending a message to a target that asks you to click a link, or download a document. If you follow the request, it is all downhill from there on.
For years, security experts have warned us not to follow links in unsolicited messages or download accidental files on our PCs and phones. Even on the road in Europe, it is worth paying attention to digital risks, but I’m always happy to down a cup of Italian coffee at a service station.