Tamil Nadu government website outs mass-scale personally identifiable information
Are you one of those privacy freaks? Did you ever fret about how Facebook (or Google, perhaps) is outing your name, friends circle, public photos and other bits and pieces of your information that you care about? Well, if you are an Indian citizen, especially from Tamil Nadu, you have much more to bother about that these stupid little tidbits of information. The reason? Your government, as we speak, is gleefully outing such fundamental information about you, that Facebook and Google should look like saints or saviors.
Well, I ain’t no Fox News screaming bloody murder, but just a reasonable person who just yesterday appreciated Jon Stewart’s attempts at reasonableness. So, what I give here is just the fact.
http://www.elections.tn.gov.in/eroll/ is an open, free-for-all, searchable website which presumably the Election Commission of Tamil Nadu has put up, presumably with a novel idea: letting the residents of Tamil Nadu look up their electoral status, and see if they are eligible to vote for any upcoming elections.
The issue? This freaking web site tells all about you to all who would care to look you up: Your full name, names of your parents, siblings and other family members, your current address, your gender, age and, get this, your electronic voters id. Yes, everything. Everything that is needed to do any anti-social activity any way one likes.
The search interface provides an option to choose the district, constituency and requires you to provide one of the following four information:
1. your voters id number (secure, since only the voter himself will know it)
2. your name (unsecure since you can look up information about any random name in any random constituency and get full information)
3. your electoral ward number (ah, the beauty. Now, you can get details about all members in a particular electoral ward)
4. your street name (even better. For all bero-pulling thiefs. They can just search any street they are targeting and figure out how many people stay in a house, what is the age demographics and so on)
A sample search result with personally identifiable information masked:
Since the search results contain the exact information about a voters id, except the photograph, this is also a goldmine for any political party, which wants to create those bogus voter id cards, to put all the illegal votes it wants to. Simply get access to the card printing paper, seal and lamination machines, fill out the information that is so magnanimously presented by this web site, and affix the photographs of the impersonators and, voila, the card is ready. With a bit of luck or arm-twisting in the wards, these cards can easily perform the rigged-election magic, with perhaps just a fraction of effort that might be usually required.
These are just some of the ‘social-service’ activities I can think of. With a little bit more thinking, I am sure you can come up with much more creative ones. Of course, by writing a reasonably simple screen-scraping program, anyone can pull out all the information present in this free-f*** database and perform some sweet data mining activities, because, get this, there is no captcha that checks if the search is performed by a human or a program. And this data is infinitely much more difficult to get otherwise, in a super-closed government machine. With some more programming, I can mark every freaking house on a Tamil Nadu map and say who lives there currently (of course, assuming the data with the government is up-to-date).
You know what, I am running out of expletives. Is there something that can be done about this? I am sending a mail to the webmaster of this site and pray that he/she has the brains to understand what can be possible with outing this sort of information. If you feel this is something that more people need to know, by all means, please spread the word.
3 Comments
oh man you really got me scared(I am a big privacy freak…and this is just a lot for me to digest
)…I am just glad that my name is not on the electoral list…ought to check my mom’s and relatives’ though…why don’t you write to ‘the hindu’ or some paper which could take it further???
we have had quite a few services post our personal details online(address, name, phone number etc) and learn’t
to live with them over the years without fretting…telephone directory, 192.com, even the official UK electoral roll is available for public access(it is actually unlimited access for a very small price)…so it is very hard in todays world to TOTALLY go undergound and have complete privacy…I understand that..
But what bothers me about the TN Gov’s website is that they publish your voter ID number!!!…this is insane…what is the point in giving people unique ID’s if they can’t be kept secure??? it is more like publishing my credit card number along with the secret code online…I don’t care if they publish the rest of the info…as it is awready out there and would not make any diff…those who designed the site are complete nut pots…
I remember freaking out the same way when i realized that I had given my biometric details inadvertantly while registering for the NSR(National Skills Reistry) thingy…I was so furious that no one told/warned me of the consequence of such a thing then…but it is done neverthless and no point in cribbing about it now…i can only hope no one can get access to it and tht it stays secure forever…which i doubt sincerely…
@Anitha…I got mixed responses for this, with a some people pointing out that I might actually be spreading the news about something which is not being noticed by people, and some other people contending that they might be very comfortable with this level of ‘openness’. When I brought the question of ID being brought out, one person actually asked me whats wrong with it and what can happen with it (they were comfortable putting out even their bank account number, provided there is another key needed to complete the access circle! to each his own
).
I got in touch with my good friend who is an RTI enthusiast. Since he has seen a lot of these things practically (in so many RTI cases), I was keen to know his opinion. he told me an even more surprising bit of information: political parties are actually officially given this amount of private information during election season. He opined that our country’s notion of data privacy might not be at the same tone as that of some other countries (like US for example).
I contacted the webmaster of that nutty site, and as one would expect, I never got back any reply. I decided to leave my public record of this here and not take it further and make it known to more people, since it is very easy to build a scraper as I pointed out (there are some juicy GET URLs available in that site which our efforts even lesser to mine data).