Massive Aadhar Data Leaked: India’s COVID-19 Testing Information Compromised

• About: The Aadhar data leaked information was gathered from Indian Council of Medical Research’s (ICMR) database, which was collected during COVID-19 testing.

• • Aadhar data leak came to notice after a hacker known as pwn0001 advertised the breached information on Breach Forums.
  • The Aadhar data leak was notified by Resecurity, an American agency specializing in cyber-security and intelligence. 
• Source of Leak: Till now, the source of the leak is unknown. The Central Bureau of Investigation (CBI) is tasked with investigating the case.
• Nature of Information Leaked: The leaked information includes Aadhaar and passport details, names, phone numbers and temporary and permanent addresses.
• Authenticity: The authenticity of the leaked information was checked using a government portal’s “Verify Aadhaar” feature, which authenticated the Aadhaar information.
• Future Challenge: The main challenge now is to identify where the breach originated, as COVID-19 test information is scattered across bodies like the National Informatics Centre (NIC), ICMR, and the Ministry of Health.

Role and Impact of the Indian Council of Medical Research (ICMR) in Curbing Aadhar Data Leak

• Indian Council Medical Research is the premier body in India responsible for formulation, coordination and promotion of biomedical research.
• ICMR is funded by the Department of Health Research, which comes under Ministry of Health and Family Welfare.
• Currently, there are 26 national institutes that come under ICMR and are involved in research on specific health topics like tuberculosis, leprosy, malaria, cholera and diarrhoeal diseases, AIDS, nutrition, food & drug toxicology, reproduction, oncology, medical statistics, etc. 

Must Read: Moody’s Report on Aadhar: Analyzing Concerns For India’s Digital ID Programme | PWOnlyIAS 2023

The Dark Web and the Threat of Aadhaar Data Leaks: Understanding the Risks

• About Dark Web: It is the collection of internet sites which are hidden and can only be accessed by a specialized web browser. 
• Dark web keeps internet activity anonymous and private, which is useful in both legal and illegal applications.

• Applications of dark web:
  • Individuals such as whistleblowers, who would be endangered by revealing their identities online, make use of the dark web. 
  • Abuse and persecution victims, apart from political dissidents, are known to use the dark web for their activities. 
  • Dark web has also turned into a hub for illegal activities such as selling/buying private data, narcotics, arms, pornographic material etc.

Deep web: Privacy, Security, and the Risks of Aadhaar Data Leaks

• About Deep Web: It refers to all web pages that cannot be indexed by search engines.
  • Deep web sites may be hidden behind passwords or other security walls, making it inaccessible for regular internet users.
• Spread: Deep web accounts for approximately 90% of all websites.
  • Majority portion of the deep web is perfectly legal and safe.
• Anonymous: Most deep web sites are kept hidden from the open web to protect user information and privacy.
• Deep web also includes the portion that is known as the dark web.

India’s Digital Personal Data Protection Act 2023: Framework and Implications

• About Digital Personal Data Protection Act: It is India’s first act for personal data protection, which establishes a framework for processing personal data within India. 
• Features of the Act:
  • Application: The bill will be applicable for processing of digital personal data within India, with data being collected both online and offline. It will also apply to data processed outside India if it is for offering goods or services in India.
  • Consent: Personal data is processed only for a lawful purpose upon consent of an individual.  However, it does not apply to voluntary sharing of data or processing by the State for permits, licenses, benefits, and services.
  • Data Security and Deletion: Data collecting entities will have to maintain the accuracy of data, keep data secure, and delete data once its purpose has been met.
  • Individual Rights: Individuals will have the right to obtain information, seek correction and erasure, and grievance redressal.
  • Exemption: Government agencies have been exempted from the application of provisions of the Bill in the interest of security of the state, public order, and prevention of offenses.
  • Authority: Data Protection Board of India will be set up by the government to adjudicate on non-compliance with the provisions of the Bill.
  • Penalties: Data processing entities can be fined up to Rs 250 crore for non-compliance of the provisions of the act.

Also Read: UPSC Notes on Cyber Security 

Conclusion:

• Incidents of personal Aadhar data leak threaten privacy of individuals and the data can also be used for nefarious purposes, harming the security of the country.