Citizens’ data up for sale
The ease with which sensitive personal information of Bangladeshi citizens can reportedly be obtained and purchased online has raised serious concerns about privacy, data protection and the security of databases holding such information.
A new investigation by fact-checking and research platform Dismislab found that NID details, call records and mobile phone location data, among other personal information, are being offered for sale through Facebook, websites and messaging platforms.
Published on Monday (31 August), the investigation found sellers advertising different categories of personal data at fixed prices, with some records reportedly delivered within minutes or hours after payment.
Dismislab identified more than 600 Facebook posts offering personal information for sale during a one-month period from 15 June to 15 July. It also identified 10 active websites selling such information and purchased genuine data from three sellers using bKash payments.
The data on offer included NID and voter information, birth registration records, call detail records (CDRs), mobile tower locations, SMS lists, IMEI numbers, TIN certificates, passport information and mobile financial service account statements.
Some sellers claimed that certain information could be obtained simply by providing a mobile phone or NID number, according to the investigation.
In one transaction, Dismislab said a seller supplied a copy of an NID within 17 minutes after receiving a mobile phone number and Tk500.
The platform subsequently verified the information with the subscriber and found the name, photograph, date of birth and other details to be accurate.
In another transaction, Dismislab obtained three months of call detail records linked to a Grameenphone number within two and a half hours of paying Tk1,050.
The records contained phone numbers contacted, call times, call durations and other technical information.
Dismislab cross-checked the records against the subscriber’s actual call history and found them to be accurate.
The platform also obtained recent location information relating to a subscriber after paying Tk1,500, according to the investigation.
The findings indicate that information capable of revealing a person’s identity, communications and whereabouts may be accessible through informal online markets, raising concerns over potential misuse and unauthorised access.
The sellers identified by Dismislab operated through Facebook, Telegram, WhatsApp and dedicated websites. Some websites openly displayed price lists for different types of personal information.
One price list offered NID information based on a mobile number for Tk250, three months of call records for Tk900, six months of call records for Tk1,800 and live location information for Tk1,500.
Dismislab said the sale of personal information had been continuing for at least three years.
An information technology expert interviewed by the platform said access to real-time or up-to-date information could only be possible if employees of relevant government agencies were involved or if someone had bypassed the security systems protecting the databases where such information is stored.
A mobile operator told Dismislab that it had raised the issue with the authorities and supplied evidence, but the sale of such information had continued.
Call detail records and location information are generally held by mobile operators and are considered sensitive personal data.
Access to such information is restricted to authorised government agencies and security forces under Bangladesh’s laws and regulations for purposes including national security, criminal investigations and maintaining law and order.
The reported availability of such information for sale therefore raises questions about how sensitive records may be reaching unauthorised parties and whether existing safeguards are adequate to protect citizens’ personal information.
The issue is particularly concerning because the data reportedly available for purchase goes beyond basic identity information.
Call histories can reveal a person’s communication patterns, while location records can potentially indicate their movements and whereabouts.
Dismislab said the widespread availability of personal information on the open market raises serious concerns about the protection of citizens’ data and the security of systems holding sensitive records.
The investigation has also brought renewed attention to the need for stronger safeguards around government and private databases, tighter controls over access to sensitive information and more effective mechanisms to prevent the unauthorised use or disclosure of citizens’ data.
