Year: 2020

20 Aug 2020

China’s Waterdrop nabs $230M for its crowdfunded, mutual aid insurance platform

When people in the US or Europe think of crowdfunding and medical expenses, sites like GoFundMe, where people fundraise around specific predicaments, come to mind. But today comes news of how another approach — a platform based around crowdfunding and mutual aid that pays out when its members fall into medical dire straits — is picking up some significant steam in its growth, and its financial backing.

Waterdrop, which goes by Shuidihuzhu in China (translated as “water drop mutual help”), today said that it has raised $230 million in a new round of funding jointly led by two strategic investors, the insurance giant Swiss Re and returning investor Tencent, whose WeChat platform is used to sign up users and buy products using a quick QR code scheme.

Previous investors IDG Capital and Wisdom Choice Global Fund also participated in the Series D. The startup is not disclosing its valuation, but when the round had partially closed at $200 million earlier this month, Pitchbook noted that its pre-money valuation was $1.8 billion, which puts the valuation now at just over $2 billion.

The funding will be used not just to keep growing the platform, but incorporating partnerships with others in the healthcare ecosystem, from pharmaceutical companies and insurance businesses, through to hospitals and pharmacies, and other clinical care facilities, in part by way of a new service it’s launched called Haoyaofu, to provide members with lowr-cost medications and treatments.

Waterdrop has also been looking at how it can get more involved in facilitiating more services. medical consultations, providing overeseas medical treatment, and more healthcare services like cancer screening and routine exams, cornerstones of how health insurance already operates.

“We are excited about the huge growth potential that lies ahead of us. Our long-term goal is to become a leading online healthcare platform in China with an ecosystem that includes insurers, pharmaceutical companies, hospitals and drug stores, as well as nursing institutions and rehabilitation institutions,” said Peng Shen, founder and CEO of Waterdrop, in a statement. “We are committed to not only helping users with financing issues but also providing them with integrated healthcare services along the way.”

Beijing-based Waterdrop noted that this is Swiss Re’s first investment into an insurance startup in China, and the largest private fundraise for an insurtech company so far this year in any market, which it says was spurred in part by the global surge not just in the attention that healthcare is getting as a result of the coronavirus health pandemic, but the push towards better tech-based solutions to meet a new set of demands across the ecosystem, from healthcare providers through to those working on medicines and other innovations, through to the needs of patients.

“As a leading online InsurTech company, Waterdrop is well positioned to tackle the pain points of traditional insurance and pave the way for future breakthroughs in the industry, such as the accelerated technological innovation and digitalization of the industry worldwide that we have witnessed during the COVID-19 situation,” said Ning Zhou, head of principal investment and acquisition for Asia for Swiss Re.

Indeed, the same uncertainty that COVID-19 has brought to many industries has ironically been a boost for insurance startups. Lemonade, the US-based insurance tech startup, raised more in its IPO, $319 million and is currently has a market cap of $3.5 billion.

The “water drop” reference in the startup’s name comes from the basic premise behind the business model, requiring low buy-in (ie, just a drop of water) from its customers.

One part of the Waterdrop business — which today is live only in China, with a beta version of an international site launched in April 2019 — focuses on mutual aid for medical conditions. In one part, users contribute very incremental amounts money, starting as low as half a cent, towards a mutual aid scheme, where Waterdrop then pays out up to 300,000 yuan (about $43,000) when members unexpectedly find themselves struck with a major medical setback.

Children, middle-aged and young people have a list of 106 conditions that are covered, including cancer. Other age groups (and presumably other categories of users such as those with pre-existing health conditions) have a smaller and different list of conditions that are covered.

The other part of that business focuses on mutual aid for those who suffer an accident that results in a permanent disability or death, which pays out up to 100,000 yuan ($14,500) in these cases.

Those sums may not sound like much, but in a country where some 600 million people earn as little as only 1,000 yuan ($144) each month, these can be significant sums, either in place of having other more costly insurance programs, or as a complement to these. (The average monthly per capita income, it should be noted, is much higher, at 30,000 yuan.)

Another part of the business focuses on more traditional health insurance services, with monthly payments again starting at low amounts of money, such as a long term serious health insurance that starts at 4 yuan ($0.58) per month.

A third part is a more traditional crowdfunding platform for healthcare costs.

Waterdrop has not been without bumps, as you would expect. An expose in December unveiled how employees, under pressure to meet aggressive growth targets, were cutting due diligence corners in sign-ups and in some cases lying on application forms. (The company in response said it fired the team responsible and worked to put in place better measures to block things like this from happening again.)

It has also built public black lists to name and shame those who have tried to scam others on its crowdfunding platform, which points to a persistent problem of that also getting abused.

Despite that, all together, the Waterdrop businesses have seen a lot of growth.

The Insurance Mall now has 120 million unique insurance enrollees, with a written premium of US$865 million in the first half of 2020, which is close to the total written premium for full year 2019 (essentially saying business has doubled to date). For the full year 2020, Waterdrop Insurance Mall expects to record a total written premium of $2.0 billion, or more than 100% year-on-year growth, with a total earned premium of $865 million, or 300% year-on-year growth. Waterdrop Crowdfunding, meanwhile, has raised $4.6 billion from 320 million unique users over 1 billion+ donations as of the end of July 2020. And Waterdrop Mutual has paid out $233 million to 12,819 families so far.

As a point of comparison, in April 2019, Waterdrop claimed 78.8 million users with payouts of 440 million yuan, or $65.34 million, 3,100 families so far.

The Swiss Re investment is significant not only for the funding itself, but because Waterdrop is not alone in the market, with another major competitor backed by Alibaba called Xiang Hu Bao (which translates less prosaically and simply as “mutual protection”) that is hot on its heels for growth.

“We will continue to build on our solid partnership with Waterdrop and together we will support the ongoing development of the issurance industry and promote digital innovation,” said Russell Higginbotham, CEO Reinsurance Asia and Regional President, Swiss Re, in a statement.

For investor Tencent, having a significant stake in a healthcare company that ties in its services with its WeChat messaging platform is one way to continue to have leverage in this growing area against one of its big rivals in the country.

“Amid the rapid expansion of the Chinese commercial health insurance market, Waterdrop has seized the market opportunity very well and used the power of technological innovation to help tens of millions of families,” said Yu Haiyang, MD of Tencent Investment, in a statement. “Tencent continues to be a long-term supporter of Waterdrop and will help it build an even better user experience.”

20 Aug 2020

Tokyo-based collaboration platform BeaTrust lands $2.8 million seed round

BeaTrust co-founder Masato Kume, co-founder and chief executive officer Kunio Hara and Ryo Nagaoka, vice president of engineering


Founded just four months ago, Tokyo-based BeaTrust has raised a JPY 300 million (about USD $2.83 million) seed round for its enterprise collaboration platform. The startup’s ambitious goal is to change corporate culture at large Japanese companies before expanding into other countries.

The round came from CyberAgent Capital; DNX Ventures; ITOCHU Technology Ventures; STRIVE; One Capital; Delight Ventures; PKSHA/SPARX Algorithm 1st; and Mizuho Capital, along with undisclosed individual participants.

BeaTrust’s platform allows employees at large companies to discover colleagues in different departments with similar interests and skills, and gives them tools to work together on projects.

The startup’s co-founders, Kunio Hara and Masato Kume, met while working at Google in Japan. Before Google, Hara held positions in Tokyo and Silicon Valley at Sumitomo Corporation, Softbank, Silicon Graphics and Microsoft, while Kume worked at Asatsu-DK. During their time at Google, the two focused on helping Japanese startups scale by using Google’s tools.

Hara told TechCrunch that BeaTrust was inspired by his experience working at companies in the United States and Japan, and by the co-founders’ time at Google, where they found cross-department collaboration was an intrinsic part of the culture. The two began to think about how they could bring the same qualities to large Japanese corporations.

“From the standpoint of employees at Google, working there is like a lifestyle. We work together and think about how to facilitate cross-cultural innovation among employees, and that needs a communication and digital infrastructure to support those ideas,” said Hara.

BeaTrust wants to transform Japanese corporate culture, which Hara described as “very siloed and top-down, with very strict rules,” making it harder for people in different teams or departments to communicate or even get to know one another. “There are a lot of initiatives to hire talented people, but it’s not an environment that helps people connect with one another and ask each other for help, which is what leads to new projects,” he added.

The platform is currently in closed beta stage, testing with three late-stage startups that have about 100 to 200 employees each. Its first feature is employee profiles that list skills and experience. Next, BeaTrust will launch tools for users to visualize how teams at their company are organized and modules to enable collaboration on different kinds of projects, including software development.

BeaTrust’s founders said as the platform grows, its target audience will be large enterprises with thousands of employees. The platform is not meant to be a replacement for Slack, which launched in Japan three years ago, or other enterprise communication tools like Microsoft Teams or ChatWork, but serve as a complement, Kume said. Slack and its competitors are meant to enable individual teams within large companies to collaborate, while BeaTrust is designed to help employees discover and strike up working relationships with colleagues they don’t know yet.

While its initial goal is to reshape corporate culture in Japan, BeaTrust founders are also eyeing expansion into European and Asian countries, and markets where large companies are continuing to mandate or encourage remote work because of the COVID-19 pandemic.

“That’s becoming imperative for us because what we hear from a lot of large enterprises is that employees are not used to working remotely, so they need to think about how to shift their lifestyle and continue employee innovation,” Kume said.

20 Aug 2020

Riff raises $1.5M seed led by Balderton for its ‘voice-first’ chat tool for remote working

Riff, a London-based startup developing what it describes as a “voice-first” chat tool for remote working, has raised $1.5 million in seed funding, prior to a full launch next year.

Leading the round is Balderton Capital, which is better known for Series A round but quite often does seed investments on the quiet. Also participating is Seedcamp and various angels, including Carlos Gonzalez-Cadenas, COO of GoCardless, Nicolas Brusson, CEO of BlaBlaCar and Tim Sadler, CEO of Tessian.

Founded by CEO Isabel Bescos, who was former head of corporate strategy at BlaBlaCar, and a former member of Balderton’s investment team, and CTO Matthew Scheybeler, who co-founded blinkx, Riff wants to solve many of the pain points felt by teams trying to communicate across different locations. While tools like Slack and Zoom are built first for text and video, respectively, Bescos and Scheybeler think audio is the missing piece of the puzzle, but used in a way that encourages the spontaneity and serendipity experienced by in-person teams.

“Instant messaging tools can be distracting, jammed with notifications and hard-to-follow threads, and on the other hand, video conferencing tools often require additional software, and tend to be used for pre-scheduled, formal meetings,” the pair tell me. “What is lacking is something that enables effortless and spontaneously collaboration throughout the day. The remote equivalent of turning to ask a colleague a quick question, or to discuss the project you are working on”.

Currently operating as a limited private beta, Riff aims to replicate the ease and spontaneity of team working but remotely. Although I haven’t seen the app for myself, I understand that it does this via a sidebar that means voice — both push to talk or left open — is always just one click away.

“With Riff, users can instantly speak to any team member while collaborating on a piece of work,” explain its founders. “For example, Riff is particularly helpful whenever several members of a team need to work together on an urgent problem, such as solving a technical bug which could take several hours. Riff allows you to be connected to your team for long periods of time without the intensity of being on camera for hours on end. People can also drop in and out as needed without the need for scheduled calls”.

More broadly, Bescos and Scheybeler say they were partly inspired by the world of video games where leaving an audio channel open amongst a social group or team of gamers is commonplace, either via in-game audio or an aoo like Discord.

“We wanted to take the speed and fluidity with which online gamers converse whilst gaming, and transpose it into the enterprise,” they add. “Rather than inundating users with notifications, Riff hopes to simplify interactions. Speaking on Riff is less distracting than Slack or Email, but faster than scheduling and waiting for a video call”.

Cue statement from Balderton general partner Suranga Chandratillake, who led on behalf of the VC firm: “We are inundated with notifications, pop-ups, chat tools and various distractions vying for our attention when trying to communicate and work with others. Yet none have managed to get to the crux of what it’s really like to be able to collaborate quickly with colleagues in an office. As more of us work remotely, there needs to be a better way. We see huge potential in Riff’s unique approach to solving this challenge, and we’re thrilled to partner with them to bring its array of benefits to more companies”.

Meanwhile, Riff plans to use the seed investment get Riff to a public beta later this year ahead of a general release in 2021, and to further build out the team.

20 Aug 2020

Author and professional poker player Annie Duke on how conspiracy theories gain ground

Earlier today, Facebook said it has removed hundreds of QAnon groups from its site, and that it’s restricting many  more groups, along with hundreds of pages, and more than 10,000 Instagram accounts.

As the New York Times observed in its report about the maneuvers, four-year-old QAnon, once a fringe phenomenon, has gone mainstream in recent months despite a wide range of patently outlandish conspiracy theories, including that the world is run by pedophiles trying to damage Donald Trump and that 5G cellular networks are spreading the coronavirus.

How is this happening exactly? Because we happened to be talking this week with the famed former professional poker player turned best-selling author Annie Duke — an academic who has made a career in most recent years of writing about decision theory, including in her upcoming book “How to Decide: Simple Tools for Making Better Choices” —  we asked for her thoughts about whether and why more people than ever have grown susceptible to conspiracy theories.

She had some interesting things to say that we thought worth sharing. Stay tuned for a longer piece from our conversation about her new book and how it can help both founders and investors.

Our brains don’t like randomness. We as human beings are always trying to figure out this cause and effect that’s just kind of random, yet our brains don’t like; we try to connect dots and create causality where it doesn’t exist.

Belief in conspiracy theories isn’t correlated to intelligence. It’s kind of a different thing that’s going on with how comfortable are you with saying, ‘Shit happens. Sometimes life is random and there’s a lot of luck involved and what are you going to do?’ versus [people who] really want things to make sense and to [maintain] the illusion of control over outcomes.

If you say, ‘These random things can happen like COVID and people are dying and you’re now stuck in your home, it’s hard to think about that as luck expelling itself all over you because that has implications [regarding how much control] you have over your destiny. We’re very deterministic in how we  think . . . so we’re always connecting things together to make it feel like decisions and outcomes and things are much more deterministic than they are.

We’re also natural pattern recognizers, even where patterns don’t exist. It’s so we can partly figure out that, ‘When I went to this part the plains, there were a lot of lions, [so for safety’s sake I shouldn’t go back],’ and so we can recognize faces. It’s [hard] to understand that the world is not as you see it and that we impose things on the world all the time. [Editor’s note: here, Duke points to this visual illusion (below) of two side-by-side cubes that look to be in motion but are not.]

We shouldn’t have so much confidence that we know the truth, but we really believe that the cubes spinning. So [one solution is] don’t have so much confidence that we know the truth, and know that you’re imposing your reality on the world, as opposed to reality imposing itself on you.

Conspiracy theories are not new, in any case, they’ve been going on a long time. The bigger issue now is how easily they are amplified.

One of the heuristics we have to determine whether something is true or not is processing fluency, meaning how easy is it for us to process a message. If we hear something over and over again, it’s increases it’s truthiness, in the words of Stephen Colbert. If you add a picture — so I say giraffes are the only animal that can’t jump, and I include picture of a giraffe — that increases this truthiness.

You can see where that interacts with social media. With theories plus repetition, it’s harder to figure out fact from fiction.

20 Aug 2020

Gmail, Google Drive, Google Meet hit by outage

Having trouble accessing your Gmail, Google Drive, or Google Meet? You’re not alone. Thousands of users, mostly in India, parts of the U.S., Australia, Japan, and Malaysia are reporting that they are unable to access the aforementioned Google services.

Third-party web monitoring firm DownDetector has corroborated the reports that began pouring in at around 04:40 GMT. Google has acknowledged the existence of this outage, saying it is investing the issue.

“We will provide an update by 8/20/20, 1:30 PM (IST) detailing when we expect to resolve the problem,” it wrote.

DownDetector estimates the regions that are facing the Gmail outage

We will update the story when things change.

20 Aug 2020

Taiwan set to bar Chinese streaming services like iQiyi and Tencent’s WeTV

iQiyi and Tencent’s WeTV, two of China’s most popular streaming services, may be banned in Taiwan next month as the government prepares to close regulatory loopholes that enabled them to operate through local partnerships.

In an announcement posted this week, Taiwan’s Ministry of Economic Affairs said Taiwanese companies and individuals will be prohibited from providing services for OTT firms based in mainland China. The proposed regulation will be open to public comment for two weeks before it takes effect on Sept. 3.

Though Taiwan, which has a population of about 24 million people, is self-governed, the Chinese government claims it as a territory. The proposed regulations means Taiwan is joining other countries, including India and the United States, in taking a harsher stance against Chinese tech companies.

iQiyi and Tencent’s WeTV set up operations in Taiwan through “illegal” partnerships, the Ministry of Economic Affairs said in its announcement, working through their Hong Kong subsidiaries to strike agreements with Taiwanese companies.

In April, the NCC declared that mainland Chinese OTT firms are not allowed to operate in Taiwan under the Act Governing Relations between People of the Taiwan Area and the Mainland Area. Cabinet spokesperson Kolas Yotaka said at the time that Chinese firms and their Taiwanese partners were operating at “the edges of the law.”

But NCC spokesperson Wong Po-Tsung said the proposed regulation isn’t targeted solely at Chinese OTT operators. According to the Taipei Times, he stated “the act was necessary because the cable television service operators have asked that the commission apply across-the-board standards to regulate all audiovisual service platforms, which should include OTT services. It was not stipulated just to address the problems caused by iQiyi and other Chinese OTT operators.”

Wong added that Taiwan is a democratic country and its government would not block people from watching content from iQiyi and other Chinese streaming services.

Once the act is passed, Taiwanese companies that break it will face fines of NTD $50,000 to NTD $5 million [about USD $1,700 to USD $170,000].

TechCrunch has contacted iQiyi and Tencent for comment.

20 Aug 2020

Taiwan set to bar Chinese streaming services like iQiyi and Tencent’s WeTV

iQiyi and Tencent’s WeTV, two of China’s most popular streaming services, may be banned in Taiwan next month as the government prepares to close regulatory loopholes that enabled them to operate through local partnerships.

In an announcement posted this week, Taiwan’s Ministry of Economic Affairs said Taiwanese companies and individuals will be prohibited from providing services for OTT firms based in mainland China. The proposed regulation will be open to public comment for two weeks before it takes effect on Sept. 3.

Though Taiwan, which has a population of about 24 million people, is self-governed, the Chinese government claims it as a territory. The proposed regulations means Taiwan is joining other countries, including India and the United States, in taking a harsher stance against Chinese tech companies.

iQiyi and Tencent’s WeTV set up operations in Taiwan through “illegal” partnerships, the Ministry of Economic Affairs said in its announcement, working through their Hong Kong subsidiaries to strike agreements with Taiwanese companies.

In April, the NCC declared that mainland Chinese OTT firms are not allowed to operate in Taiwan under the Act Governing Relations between People of the Taiwan Area and the Mainland Area. Cabinet spokesperson Kolas Yotaka said at the time that Chinese firms and their Taiwanese partners were operating at “the edges of the law.”

But NCC spokesperson Wong Po-Tsung said the proposed regulation isn’t targeted solely at Chinese OTT operators. According to the Taipei Times, he stated “the act was necessary because the cable television service operators have asked that the commission apply across-the-board standards to regulate all audiovisual service platforms, which should include OTT services. It was not stipulated just to address the problems caused by iQiyi and other Chinese OTT operators.”

Wong added that Taiwan is a democratic country and its government would not block people from watching content from iQiyi and other Chinese streaming services.

Once the act is passed, Taiwanese companies that break it will face fines of NTD $50,000 to NTD $5 million [about USD $1,700 to USD $170,000].

TechCrunch has contacted iQiyi and Tencent for comment.

19 Aug 2020

Daily Crunch: Apple hits $2 trillion market cap

Apple stock reaches a big milestone, Facebook Portal gets more work-friendly and Twitter reports progress against hate speech. This is your Daily Crunch for August 19, 2020.

The big story: Apple hits $2 trillion market cap

Apple’s share price is up around 59% since the beginning of the year, despite seeing relatively modest, 11% year-over-year revenue growth in its most recent earnings report.

Alex Wilhelm argues that Apple’s strong market performance, and similar strength from other tech giants, is a good thing for startups:

Public rallies can help advance IPOs, and acquisitions. So today’s news that Apple is now sufficiently rich enough to shame Croesus means that your friendly, local startup might be able to close that next round at a price that it likes.

The tech giants

Facebook Portal gets serious about remote work with BlueJeans, GoToMeeting, Webex and Zoom apps — All of the apps will be arriving at some point in September for the Portal Mini, standard Portal and Portal+.

Twitter claims increased enforcement of hate speech and abuse policies in last half of 2019 — The company claims that its ability to “proactively” surface content violations for human review has helped it increase enforcement.

Top Facebook executive in India files criminal complaint against a journalist for sharing news report — A review of the journalist Awesh Tiwari’s post, written in Hindi, finds that it was merely summarizing a recent Wall Street Journal report.

Startups, funding and venture capital

JD.com’s 1-year-old health unicorn to get $830M from Hillhouse — When Alibaba’s rival JD.com saw an opportunity in the prescription drug market, it spun out its healthcare unit into a subsidiary called JD Health.

Hangar raises $15 million for its venture studio for government technology startups — Founded by former Bloomberg advisor Josh Mendelsohn, Hangar has already created four businesses.

India’s first Earth-imaging satellite startup raises $5 million; first launch planned for later this year — Once all of the company’s small satellites are on orbit, the Pixxel network will be able to provide globe-spanning imaging capabilities on a daily basis.

Advice and analysis from Extra Crunch

Max Levchin is looking ahead to fintech’s next big opportunities — We sat down with Levchin for a recent session of Extra Crunch Live, where he spoke at length about what he sees as some of the big opportunities in fintech.

Dear Sophie: How can I transfer my H-1B to my startup? — An H-1B status employee at a tech company asks about the implications of founding (and working for) their own startup.

Join Twilio’s Jeff Lawson for a live Q&A August 25 at 2:30 pm EDT/11:30 am PDT — Twilio has become a giant, worth more than $37 billion today after going public in 2016.

(Reminder: Extra Crunch is our subscription membership program, which aims to democratize information about startups. You can sign up here.)

Everything else

Fearing coronavirus, a Michigan college tracks its students with a flawed app — The Aura app had at least two security vulnerabilities only discovered after it was rolled out.

Scotland spaceport gets full approval, will be able to host up to 12 launches per year — This will be the future launch site for Orbex, a startup looking to develop the U.K.’s first reusable orbital launch vehicle.

At the first-ever virtual DNC, Democrats play it safe — The first all-virtual Democratic National Convention is in full swing, but don’t expect fireworks.

The Daily Crunch is TechCrunch’s roundup of our biggest and most important stories. If you’d like to get this delivered to your inbox every day at around 3pm Pacific, you can subscribe here.

19 Aug 2020

Airbnb has confidentially filed to go public

In a turn of fortune, Airbnb today announced that it has filed to go public, albeit confidentially.

The move puts the home-sharing service on a path to a public offering sooner rather than later, and comes after reports that the company was prepping an IPO filing this month. Those same reports indicated that Airbnb could go public as soon as the end of the year.

A Q3 or Q4 Airbnb offering is therefore a distinct possibility.

Airbnb has mounted a comeback since COVID-19-related shutdowns slammed the travel market, tanking its revenues at the same time. Airbnb laid off nearly 2,000 workers, and took on expensive capital from external sources.

The company promised in 2019 that it would go public in 2020, but that pledge seemed far-off in the middle of the year. Since then, Airbnb has made noise about different parts of its business coming back to life, although changed by new travel and work and vacation patterns from its users.

If Airbnb has filed, we can presume that present results are good enough to get it life, else the firm would have not filed and would have simply gone public later. The question now becomes if its Q2 numbers were good enough to get it out the door, or if the company intends to update its S-1 filing with Q3 numbers, push the filing live and go public with more recovery time in its results.

Of course, such a course of action would put its public debut perilously close to the American election. And, Airbnb’s Q2 numbers are down not only from Q1 in revenue terms, but even more sharply from its year-ago results for the same calendar period. In short, Airbnb’s growth story may not be clear until Q3 numbers are tallied, a month and a half from now.

We’ll see, but the company’s public debut is back to being impending. Now the question becomes whether Airbnb intends to go public in an IPO, as the wording of its filing appears to suggest, or if a direct listing could still be in the cards. We think it’s more likely the former and not the latter, but, hey, in 2020 you never know.

19 Aug 2020

Fearing coronavirus, a Michigan college tracks its students with a flawed app

Schools and universities across the United States are split on whether to open for the fall semester, thanks to the ongoing pandemic.

Albion College, a small liberal arts school in Michigan, said in June it would allow its nearly 1,500 students to return to campus starting in August for the new academic year. Lectures would be limited in size and the semester would finish by Thanksgiving rather than December. The school said it would test both staff and students upon their arrival to campus and throughout the academic year.

But less than two weeks before students began arriving on campus, the school announced it would require them to download and install a contact-tracing app called Aura, which it says will help it tackle any coronavirus outbreak on campus.

There’s a catch: The app is designed to track students’ real-time locations around the clock, and there is no way to opt out.

The Aura app lets the school know when a student tests positive for COVID-19. It also comes with a contact-tracing feature that alerts students when they have come into close proximity with a person who tested positive for the virus. But the feature requires constant access to the student’s real-time location, which the college says is necessary to track the spread of any exposure.

The school’s mandatory use of the app sparked privacy concerns and prompted parents to launch a petition to make using the app optional.

Worse, the app had at least two security vulnerabilities only discovered after the app was rolled out. One of the vulnerabilities allowed access to the app’s back-end servers. The other allowed us to infer a student’s COVID-19 test results.

The vulnerabilities were fixed. But students are still expected to use the app or face suspension.

Track and trace

Exactly how Aura came to be and how Albion became its first major customer is a mystery.

Aura was developed in the months after the pandemic began by Nucleus Careers, a Pennsylvania-based recruiting firm founded in 2020 with no apparent history or experience in building or developing healthcare apps besides a brief mention in a recent press release. The app was built in partnership with Genetworx, a Virginia-based lab providing coronavirus tests. (We asked Genetworx about the app and its involvement, but we did not hear back from the company.)

The app helps students locate and schedule COVID-19 testing on campus. Once a student is tested for COVID-19, the results are fed into the app.

If the test comes back negative, the app displays a QR code which, when scanned, says the student is “certified” free of the virus. If the student tests positive or has yet to be tested, the student’s QR code will read “denied.”

Aura uses the student’s real-time location to determine if they have come into contact with another person with the virus. Most other contact-tracing apps use nearby Bluetooth signals, which experts say is more privacy-friendly.

Hundreds of academics have argued that collecting and storing location data is bad for privacy.

The Aura app generates a QR code based on the student’s COVID-19 test results. Scan the QR code to reveal the student’s test result status. (Image: TechCrunch)

In addition to having to install the app, students were told they are not allowed to leave campus for the duration of the semester without permission over fears that contact with the wider community might bring the virus back to campus.

If a student leaves campus without permission, the app will alert the school, and the student’s ID card will be locked and access to campus buildings will be revoked, according to an email to students, seen by TechCrunch.

Students are not allowed to turn off their location and can be suspended and “removed from campus” if they violate the policy, the email read.

Private universities in the U.S. like Albion can largely set and enforce their own rules and have been likened to “shadow criminal justice systems — without any of the protections or powers of a criminal court,” where students can face discipline and expulsion for almost any reason with little to no recourse. Last year, TechCrunch reported on a student at Tufts University who was expelled for alleged grade hacking, despite exculpatory evidence in her favor.

Albion said in an online Q&A that the “only time a student’s location data will be accessed is if they test positive or if they leave campus without following proper procedure.” But the school has not said how it will ensure that student location data is not improperly accessed, or who has access.

“I think it’s more creepy than anything and has caused me a lot of anxiety about going back,” one student going into their senior year, who asked not to be named, told TechCrunch.

A ‘rush job’

One Albion student was not convinced the app was safe or private.

The student, who asked to go by her Twitter handle @Q3w3e3, decompiles and analyzes apps on the side. “I just like knowing what apps are doing,” she told TechCrunch.

Buried in the app’s source code, she found hardcoded secret keys for the app’s backend servers, hosted on Amazon Web Services. She tweeted her findings — with careful redactions to prevent misuse — and reported the problems to Nucleus, but did not hear back.

A security researcher, who asked to go by her handle Gilda, was watching the tweets about Aura roll in. Gilda also dug into the app and found and tested the keys.

“The keys were practically ‘full access’,” Gilda told TechCrunch. She said the keys — since changed — gave her access to the app’s databases and cloud storage in which she found patient data, including COVID-19 test results with names, addresses and dates of birth.

Nucleus pushed out an updated version of the app on the same day with the keys removed, but did not acknowledge the vulnerability.

TechCrunch also wanted to look under the hood to see how Aura works. We used a network analysis tool, Burp Suite, to understand the network data going in and out of the app. (We’ve done this a few times before.) Using our spare iPhone, we registered an Aura account and logged in. The app normally pulls in recent COVID-19 tests. In our case, we didn’t have any and so the scannable QR code, generated by the app, declared that I had been “denied” clearance to enter campus — as to be expected.

But our network analysis tool showed that the QR code was not generated on the device but on a hidden part of Aura’s website. The web address that generated the QR code included the Aura user’s account number, which isn’t visible from the app. If we increased or decreased the account number in the web address by a single digit, it generated a QR code for that user’s Aura account.

In other words, because we could see another user’s QR code, we could also see the student’s full name, their COVID-19 test result status, and what date the student was certified or denied.

TechCrunch did not enumerate each QR code, but through limited testing found that the bug may have exposed about 15,000 QR codes.

We described the app’s vulnerabilities to Will Strafach, a security researcher and chief executive at Guardian Firewall. Strafach said the app sounded like a “rush job,” and that the enumeration bug could be easily caught during a security review. “The fact that they were unaware tells me they did not even bother to do this,” he said. And, the keys left in the source code, said Strafach, suggested “a ‘just-ship-it’ attitude to a worrisome extreme.”

An email sent by Albion president Matthew Johnson, dated August 18 and shared with TechCrunch, confirmed that the school has since launched a security review of the app.

We sent Nucleus several questions — including about the vulnerabilities and if the app had gone through a security audit. Nucleus fixed the QR code vulnerability after TechCrunch detailed the bug. But a spokesperson for the company, Tony Defazio, did not provide comment. “I advised the company of your inquiry,” he said. The spokesperson did not return follow-up emails.

In response to the student’s findings, Albion said that the app was compliant with the Health Insurance Portability and Accountability Act, or HIPAA, which governs the privacy of health data and medical records. HIPAA also holds companies — including universities — accountable for security lapses involving health data. That can mean heavy fines or, in some cases, prosecution.

Albion spokesperson Chuck Carlson did not respond to our emails requesting comment.

At least two other schools, Bucknell University and Temple University, are reopening for the fall semester by requiring students to present two negative COVID-19 tests through Genetworx. The schools are not using Aura, but their own in-house student app to deliver the test results.

Albion students, meanwhile, are split on whether to comply, or refuse and face the consequences. @Q3w3e3 said she will not use the app. “I’m trying to work with the college to find an alternative way to be tested,” she told TechCrunch.

Parents have also expressed their anger at the policy.

“I absolutely hate it. I think it’s a violation of her privacy and civil liberties,” said Elizabeth Burbank, a parent of an Albion student, who signed the petition against the school’s tracking effort.

“I do want to keep my daughter safe, of course, and help keep others safe as well. We are more than happy to do our part. I do not believe however, a GPS tracker is the way to go,” she said. “Wash our hands. Eat healthy. And keep researching treatments and vaccines. That should be our focus.

“I do intend to do all I can to protect my daughter’s right to privacy and challenge her right to free movement in her community,” she said.


Send tips securely over Signal and WhatsApp to +1 646-755-8849 or send an encrypted email to: zack.whittaker@protonmail.com