The IMO effect

During the last few weeks I have read couple of stories on Sri Lankan usage of Imo, the messaging and video calling App. They were written in dramatic style and with catchy headlines. At the core they were about disturbing criminal activity.  

There was one similarity, all of them spoke of how Imo accounts had been hacked and users blackmailed. One said how a young woman working in the garment sector had bought her first smart phone. Super excited as she was, she had wasted no time in downloading Imo to talk with her family and loved ones.  
 

Some random man calls this woman on Imo and they become quite friendly. That was till the said man started sending this lady nude pictures of her, the story does not explain how the pictures were obtained or whether they are genuine or fake

Then the story takes a turn to the lurid. Some random man calls this woman on Imo and they become quite friendly. That was till the said man started sending this lady nude pictures of her, the story does not explain how the pictures were obtained or whether they are genuine or fake, but the assumption was that they were and have been taken from the memory of the phone.  

The poor woman was blackmailed and kept paying ransoms up to Rs.30,000 and then smashed her phone with a rock and disappeared till her husband found her and took the blackmailer to Police – more or less a teledrama stuff!  

Not the first story of its kind. A colleague related how he kept getting messages with all kinds of innuendoes from a number used by an actress. He called her and was told that she was not sending the message which turned out to be a hacker, who was using the number to blackmail young men. I was not told whether this instance also ended up in a Police Station.  

She kept paying ransoms up to Rs.30,000 and then smashed her phone with a rock and disappeared till her husband found her and took the blackmailer to Police

Messaging Apps are the most popular downloads here in Sri Lanka. They make up the top four Android downloads in Sri Lanka, surprisingly Imo is number one here – the only other country in the region where this makes it to the top three is Bangladesh. There is no doubt about its popularity but as we have seen it can be quite a risky app as well.  

Last year, cyber security officials warned the public to be wary of mobile messaging apps. They had been getting a stream of steady complaints of messaging apps being either hacked or misused. The easiest trick to hack into the Imo account of another user is to get the passcode for the app. Sometimes you really don’t need to be a techie to do this, you just need to be good at duping people. One of the ways of doing this is to call the genuine holder of the number and indicate that the app would have sent the passcode inadvertently. Users with at least somewhat of an understanding on digital hygiene would know that this is almost an impossibility, but many Sri Lankan users, especially those not well versed in English don’t seem to understand this. Many of the victims that have fallen victim to hacking have given out their passcodes themselves without their knowledge. Once the code is gained, the hacker has all the access needed to use the app.  

Users with at least somewhat of an understanding on digital hygiene would know that this is almost an impossibility, but many Sri Lankan users, especially those not well versed in English don’t seem to understand this

A Youtube search will also reveal that there are a few instruction videos of Sri Lankan origin talking about more elaborate hacking techniques, two of which I watched with a combined view count of over 100,000 talk specifically of hacking into Imo.  

As digital tech becomes popular in Sri Lanka, so will the dangers rise. Not many will be up to date with the security risks and fewer will take the effort to figure out the risks and mitigation measures. Right now, there is no public information outlet that provides this vital info. Such an outlet needs to also be updated consistently, a big ask from Sri Lanka’s pubic sector. 

Not many will be up to date with the security risks and fewer will take the effort to figure out the risks and mitigation measures. Right now, there is no public information outlet that provides this vital info. 

Unless this is taken over by the private sector and monetized – you pay for the risk mitigation – like virus guards, that probably will work here.  

The author is the Asia-Pacific Coordinator for the DART Centre for Journalism and Trauma, a project of Columbia Journalism School Twitter - @amanthap