Centre orders probe into CoWIN data 'breach' as Opposition ups ante

Tribune News Service

New Delhi, June 12

The Centre on Monday said India’s online Covid-19 vaccine delivery platform CoWIN was “completely safe” with inbuilt mechanisms to guard data privacy amid reports that sensitive personal information of Covid shot recipients, including top politicians, was freely available on social media platform Telegram.

The Telegram controversy

• Sensitive personal information of Covid shot recipients ‘appears’ on Telegram on Monday
• Data-driven news portal South Asia Index is quick to report a ‘major CoWIN breach’
• Reports allege Telegram bot able to pull personal data via phone number, Aadhaar

The Ministry of Health, while asking the Indian Computer Emergency Response Team (Cert-In) to probe the issue and submit its findings, trashed reports of leaks saying only OTP authentication-based access of data was provided on CoWIN. “Certain posts on Twitter have claimed that using a Telegram (online messenger application) bot, the personal data of individuals who have been vaccinated is being accessed. These reports say that the bot has been able to pull individual data by simply passing the mobile number or Aadhaar number of a beneficiary. All such reports are baseless and mischievous. The CoWIN portal of the Health Ministry is completely safe with adequate safeguards for data privacy,” a ministry statement said. The TMC and the Congress tweeted screenshots claiming breach of data of citizens, including Rajya Sabha Deputy Chairman Harivansh, opposition leaders Derek O’Brien, P Chidambaram, Jairam Ramesh, KC Venugopal and Abhishek Singhvi.

Data stolen earlier

Info is from threat actor database populated with previously stolen data.

R Chandrasekhar, IT minister

The term bot is derived from robot and it’s a programme that behaves like a normal chat partner, performing tasks independently without the user’s involvement.

“In its Digital India frenzy, the GoI has woefully ignored citizen privacy. Personal data of every single Indian, including mine, is publicly available.... Why is the GoI sitting on a data protection law?” asked Congress MP Karti Chidambaram, tweeting screenshots of his own alleged leaked personal data, including cell number, passport number, date of birth and the hospital where he took the Covid shot.

Their info ‘leaked’

TMC and Congress alleged data of Rajya Sabha Deputy Chairman Harivansh and opposition leaders Derek O’Brien, P Chidambaram, Jairam Ramesh,

KC Venugopal and Abhishek Singhvi, among others, leaked

TMC’s Saket Gokhale tweeted similar screenshots with personal information of Brien, P Chidambaram, Jairam, Venugopal, Harivansh and Sushmita Dev. The furore began earlier today when alleged personal information of Covid shot recipients appeared on social media platform Telegram and was tweeted by data-driven news portal South Asia Index, which reported a “major CoWIN breach”.

Union Minister of State for IT and Electronics Rajeev Chandrasekhar said it did not appear that the CoWIN app or database had been directly breached. “A Telegram bot was throwing up CoWIN app details upon entry of phone numbers. The data being accessed by bot from a threat actor database, which seems to have been populated with previously breached or stolen data,” he said.

About The Author

Tribune News Service

The Tribune News Service brings you the latest news, analysis and insights from the region, India and around the world. Follow the Tribune News Service for a wide-ranging coverage of events as they unfold, with perspective and clarity.

#Congress #cowin #social media