Loophole leads to leak of celebrity photos

A technical loophole that caused the leak of more than 50 celebrity photos online has been fixed, according to the developer of Beijing’s pandemic prevention mini program, reported 21st Century Business Herald.

Photos of celebrities, including heartthrobs Wang Yuan and Wang Junkai receiving nucleic acid tests, were sold online.

The photos were obtained through a loophole in Beijing’s pandemic control mini program run on WeChat that allows users to search for nucleic acid test results using only names and ID numbers. Facial recognition is now also required after the bug was fixed.

The program’s developer, Zhongguancun Smart City Co Ltd, scrambled to fix the bug after receiving a swarm of phone calls inquiring about the issue, the report said.

In an official response, the big data department under Beijing’s Bureau of Economy and Information Technology which oversees the mini program's operation, said the issue has been resolved, according to the report.

“It was a loophole in the health system that was exploited,” said Yang Wenzhan, a partner with Zhongdun Law Office, told the newspaper.

If an individual lawfully obtains the ID number and name of another person and checks his or her health status without permission, it infringes on that person's privacy but doesn't constitute a crime, Yang said. However, it's a criminal offense if that information is packaged and resold without permission.

The function that enables people to search for others' test results was designed to help the elderly, many of whom aren't tech-savvy.

The photo leak also exposed the rampant spread and sale of celebrities' personal information in online daipai groups.

Daipai, literally meaning taking photos for others, has become a gray market where photographers sell photos of celebrities they've taken. To shoot as many private photos as possible, photographers in daipai groups buy celebrities’ personal and travel information to track them down.

Lawyers warn that selling other people's personal information carries a prison sentence of up to seven years.