Sensitive citizen data sold openly online: Dismislab probe

An online marketplace is openly trading in highly sensitive personal data in Bangladesh, encompassing call detail records, national ID information, SMS histories, mobile phone locations, passport details, tax identification numbers and mobile financial service account data, an investigation by Dismislab has revealed. Certain vendors reportedly furnish the requested information within minutes of receiving nothing more than a mobile or NID number, with prices ranging from a few hundred to several thousand taka.

The investigation identified more than 600 advertisements for personal data on Facebook within the span of a single month, alongside ten active websites peddling services such as NID records, call histories and location data. In one test transaction, Dismislab paid Tk 1,050 and received three months of a Grameenphone number's call records within roughly two and a half hours, with the latest twenty contacts, call times and call types corresponding precisely to the customer's actual records; in another instance, a phone number's most recent location, derived from mobile tower data, was supplied within a mere sixteen minutes of payment.

Read More: Pentagon rolls out ChatGPT and Grok for staff

These findings have raised pressing questions over how sensitive citizen data is being accessed and subsequently leaked. Mobile operators maintained that customer information is disclosed exclusively to authorised parties in accordance with applicable laws and procedures, whereas a senior industry official alleged that some of the data had been obtained through an API utilised by a government law-enforcement agency. The BTRC confirmed that an investigation was underway following concerns raised by the Home Ministry, while Dismislab noted that the National Cyber Security Agency had not responded to its queries prior to publication.