The Luca app has recently reached 20 million users achieved. In June, nine million people are said to have downloaded the app. The news caused a shake of the head among security experts. The Chaos Computer Club (CCC), for example, demanded that the Luca app be buried in view of numerous security deficiencies. So far, 13 federal states have bought licenses for Luca. Cost point: over 20 million euros. Hessen had also struck. Now the state wanted to commission a review of the system – in vain.
As Spiegel Online first reported, the Federal Ministry of the Interior asked the one for this The Federal Office for Information Security (BSI) has prohibited the comprehensive app and system testing requested by Hessen. This is possible because the BSI reports to the Ministry of the Interior. The Ministry of the Interior confirmed the rejection to the Spiegel. The explanation: The countries are contractual partners of the Luca app. And the guarantee of IT security is the subject of the manufacturer’s service.
In plain language: Hessen would have to request such a test directly from the Luca app maker. According to Golem, such source code checks or penetration tests could be carried out by appropriately specialized companies, which can also be BSI-certified. Culture4Life, which is behind the Luca app, could commission this service. This procedure would also be used by other federal authorities.
BSI criticism of dealing with security deficiencies
However, the BSI had the Luca app under let the magnifying glass be taken. According to Golem, this was only done in connection with the agency’s app testing portal – from external providers. In May, the BSI publicly criticized the way in which the Luca app operators dealt with recurring vulnerabilities. However, the office later stated that it would continue to concentrate its resources “on the intensive and development-accompanying testing of the Corona warning app”, as Golem writes. The Corona-Warn-App received new functions with the version 2.7 presented on Monday. The app now checks whether the certificates are genuine.
