Location-based apps pose security risk for Holy See

Thursday, July 29th, 2021

The use of location-based apps within secured areas of the Vatican is posing a security risk for the Holy See, even at the diplomatic and international relations level.

At least 32 mobile devices emitted hookup or dating app data signals from areas of the Vatican ordinarily inaccessible to tourists and pilgrims.

The information came from analysis of commercially obtained signal data that was legally acquired by The Pillar. It covered a period of 26 weeks during 2108.

At least 16 mobile devices emitted signals from the hookup app Grindr on at least four days within the non-public areas of the Vatican City State. In addition, 16 other devices showed use of other location-based hookup or dating apps, both heterosexual and homosexual, on four or more days.

The data set assessed by The Pillar is commercially available. It contains location and usage information that users consent to be collected and commercialized to use the app.

The use of any hookup app within the Vatican City State’s secured areas could pose a security risk for the Holy See.

And using the Grindr app by Vatican residents and officials could present a particular diplomatic security risk for the Holy See in its dealings with China.

Grindr was launched in California but was acquired by the Chinese gaming firm Beijing Kunlun Tech in 2016.

While it was under Chinese ownership, the Committee on Foreign Investment in the United States (CFIUS) deemed the app’s ownership a national security risk. This was over concerns that data from the app’s some 27 million users could be accessed by the Chinese government and used for blackmail.

In fact, while still Chinese owned, Grindr allowed third-party engineers access to the personal data of millions of U.S.-based users. This included their personal details and HIV status, according to media reports last year.

Under intelligence and cybersecurity laws, Kunlun Tech could have been compelled to turn over the data from company servers to the Chinese government for any reason pertaining to “national security,” experts have warned.

In recent years, the Holy See has been the target of several cyber-espionage attacks appearing to originate in China and apparently linked to China’s diplomatic negotiations with the Vatican.

In the months before the renewal of the Vatican-China deal in 2020, the cybersecurity media outlet Recorded Future reported that both the Vatican and the Diocese of Hong Kong had been targeted for hacks by RedDelta, a Chinese-state sponsored hacking organization.

The impact of legally purchased app data has already been made apparent in the Vatican.

The US Conference of Catholic Bishops general secretary Monsignor Jeffrey Burrill resigned on 20 July after cell phone data appeared to show he frequently used the gay dating app Grindr.

Burrill’s resignation came after staff had learned on Monday of “impending media reports alleging possible improper behaviour.”

The Pillar published an article on Wednesday that presented evidence the priest engaged in serial sexual misconduct.

Vatican City State policy does not presently prohibit employees or residents from the use of location-based hookup apps, even within secured locations connected to diplomatic responsibilities, Vatican officials have told The Pillar.