It is disturbing how easily citizens’ personal data can be breached and sold through various online platforms for a pittance. As reported in this daily, a Dismislab investigation conducted in June found an online market where citizens’ personal data are being sold through Facebook advertisements, websites, Telegram, and WhatsApp. The array of data that are up for purchase is wide and includes people’s national identity cards (NIDs), call detail records (CDRs), mobile phone location data, SMS lists, tax identification numbers (TINs), IMEI numbers, police clearance certificates, passport details, and mobile financial service statements. Besides data stored with government agencies, the cell tower-based location of a given mobile number is also identifiable, which signals the susceptibility of mobile network users’ data to sellers.
Altogether, this situation is alarming, but not new. We have seen multiple instances of such data leaks over the years. Earlier this year, during the election season, a technical flaw in an online application system introduced by the Election Commission had exposed the personal information of at least 14,000 journalists, including photographs, signatures and NID details. The portal was taken down two hours later, but there can be no guarantee that the information was not accessed before the takedown. In a related incident, the final voter list, including voters’ names, voter numbers, parents’ names, dates of birth, occupations, and permanent addresses, was also found to be sold online.
Unfortunately, in Bangladesh, the often hasty digitisation of various services and systems has always taken precedence over strengthening data security. In many cases, data being sold would have only been accessible by someone inside the organisation holding the information. Despite periodic arrests of connected individuals, there seems to be no let-up in the leaks. This is evidenced by the fact that one NID which Dismislab researchers bought online included information that had been corrected only two months prior.
Digitisation ensures convenience, accuracy, and uniformity of data. But when the agencies being trusted with people’s personal information consistently fail to safeguard it, they must be held legally accountable.
We urge the government and law enforcement agencies to broadly investigate these breaches and identify those responsible. More importantly, the public and private agencies whose systems were intercepted to steal the data must strengthen their security measures in order to regain and retain public trust.
