Official MCPS App for Android can track location and identity of users

A couple of weeks ago, MCPS announced availability of an app for Android and Apple devices.

What MCPS didn't mention is that the MCPS Android App is capable of tracking the precise locations of users of the app.

In addition, the official MCPS App peeks into your Android phone's (or tablet's) identity database.   This means that when you install and run the official MCPS App, MCPS can record exactly who you are and where you are.  But as an enduser, you can't even find out what the MCPS App knows about you.

But wait -- that's not all.   The official MCPS App is also capable of accessing the microphone and camera in your Android phone (or tablet).  Any time that the official MCPS App is running, MCPS can turn on your phone's (or tablet's) camera and microphone to record what your phone or tablet is seeing and hearing.

There are legitimate reasons that some apps track the precise location of users, query the identity database, or access the camera.  For example, mapping apps use location tracking to display the user's location on the map. Video apps use the camera and microphone to make videos.   The MCPS App, however, does not have mapping or video functions that are accessible to the user.   Any location information, photos or audio that the app collects is accessible to MCPS, but not to the owner of the phone or tablet on which the app is installed.

Why does the MCPS App track the locations of users?   What does the MCPS App do with the location information that it collects?  Why does the MCPS App have access privileges to the camera and microphone in Android phones and tablets?   We don't know.

In contrast, the MCPS Connect App from the Parents' Coalition does not track user locations, does not query the identity database, and does not access the camera or microphone.  Users of the MCPS Connect App from the Parents' Coalition are anonymous.  (The MCPS Connect App does link to the phone dialer to allow parents to call MCPS transportation services, and the phone uses the microphone but the MCPS Connect App itself does not have access to the microphone.)

The official MCPS App uses 11 MB of storage on your Android device.  Why would such a seemingly innocuous app have 11 MB of program code?  In contrast, the Parents' Coalition's MCPS Connect App consists of just 1.5 MB of program code.

You can find out exactly which privileged functions any app uses by clicking on the "View Details" link under "Permissions" for the app in play.google.com.  The list is automatically generated by the Google developers site through detailed inspection of each app's code when it is placed in the Google play store.  Check out the permissions for the official MCPS App and for the Parents' Coalition's MCPS Connect App and decide for yourself which app is safer to use.


Note:  The Parents' Coalition has not analyzed the Apple version of the MCPS app, so we don't know its under-the-covers capabilities at this time.