In response to a significant data breach in one of its institutions, the government has taken immediate action to investigate the incident and safeguard the personal information of its citizens.
The Information Technology Department and the Home Ministry have jointly undertaken necessary measures to determine the cause of the data leakage and ensure that those responsible face appropriate consequences for their actions.
In a startling revelation, the State Minister for Information and Technology Zunaid Ahmed Palak said that sensitive personal information of over five crore citizens of Bangladesh has been leaked from one of the government institutions designated as critical information infrastructure.
According to the State Minister, out of the 29 institutions declared as critical information infrastructure under Section 15 of the Digital Security Act, the 27th institution, which was identified as the Office of the Registrar General (Registration of Births and Deaths), suffered a significant breach. It was found that the information of millions of citizens, including their names, dates of birth, and National ID (NID) numbers, was accessible through the government website.
Palak has stated that those responsible for the negligence leading to this breach will face severe consequences. The Digital Security Act of 2018 stipulates that illegal access to critical information infrastructure carries a penalty of up to seven years imprisonment or a maximum fine of Tk 25 lakh, or both. Additionally, unauthorized entry causing damage or attempting to cause damage is punishable by up to 14 years imprisonment or a maximum fine of Tk 1 crore, or both.
Meanwhile, Home Minister Asaduzzaman Khan Kamal said that cyber units have started working on the information leaking incident of National Identity Card (NID) information.
The Home Minister said, “NID service has not come under us yet. We have not started operations yet. This process is still in the hands of the Election Commission. The announcement that has been made (NID service vested in Home Ministry), there are some legal complications, it will come to our Home Ministry soon after completing them. Only after the process is completed we can work fully.”
“We have to determine exactly what happened and how much information was leaked. If we see that someone is involved with it, someone has cooperated in it - in that case, we will definitely take action according to the law. After knowing the whole matter, we will investigate and take measures,” he added.
The minister also said, “We have not got any material to start now. We're ready to find out. Our cyber units have already started working on gathering more evidences and information related to the (leaking) incident.”
The government's notification declaring 29 government institutions as critical information infrastructure includes prominent offices such as the President's Office, Prime Minister's Office, Bangladesh Bank, National Board of Revenue, and various banks, among others. The purpose of designating these institutions as critical information infrastructure is to safeguard the computer systems and networks where valuable information is stored.
The breach was initially discovered by Bitcrack Cyber Security, a renowned computer security solutions company based in South Africa. The issue was subsequently reported by the US online portal TechCrunch. Bitcrack researcher Victor Markopoulos stumbled upon the data leak on June 27 while conducting routine investigations.
The breach raises concerns about the security measures and protocols implemented within the designated government institutions. Citizens are expressing outrage and calling for stricter cyber security measures to prevent such future incidents. The government, on its part, has assured the public of its commitment to rectify the situation promptly and ensure the highest standards of data protection in the future.
As investigations into the data leak continue, citizens are urged to remain vigilant about their personal information and take necessary precautions to protect themselves from potential identity theft or fraud.
