Personal data of Bangladeshis being sold online, Dismislab finds

Highlights:

• Over 600 Facebook posts found selling personal data
• 10 websites identified as selling citizens' information
• NID details, call records and location data available for sale
• Dismislab purchased verified data from three sellers
• Personal data trade has continued for at least three years

Personal information of Bangladeshi citizens, including national identity (NID) details, call records and mobile phone location data, is being sold through Facebook, websites and messaging platforms, according to an investigation by fact-checking and research platform Dismislab.

The investigation, published today (31 August), found sellers offering personal data at fixed prices and delivering some records within minutes or hours of payment.

Dismislab identified more than 600 Facebook posts advertising personal data for sale during a one-month period from 15 June to 15 July.

It also identified 10 active websites selling such information and purchased genuine data from three sellers using bKash payments.

The information being offered included NID and voter details, birth registration records, call detail records (CDRs), mobile tower locations, SMS lists, IMEI numbers, TIN certificates, passport information and mobile financial service account statements.

Sellers claimed that some of the information could be obtained simply by providing a mobile phone or NID number, according to the investigation.

In one transaction, a seller provided a copy of an NID within 17 minutes of receiving a mobile phone number and Tk500. Dismislab verified the information with the subscriber and found the name, photograph, date of birth and other details to be accurate.

In another transaction, Dismislab obtained three months of call detail records for a Grameenphone number within two and a half hours of paying Tk1,050.

The records included phone numbers contacted, call times, call duration and other technical information. Dismislab cross-checked the records against the subscriber's actual call history and found them to be accurate.

The platform also obtained recent location information for a subscriber after paying Tk1,500, according to the investigation.

The sellers operated through Facebook, Telegram, WhatsApp and dedicated websites, with some websites publishing price lists for different categories of personal information.

One such price list offered NID information based on a mobile number for Tk250, three months of call records for Tk900, six months of call records for Tk1,800 and live location information for Tk1,500.

Dismislab said the sale of personal information has been continuing for at least three years.

An information technology expert interviewed by Dismislab said real-time or up-to-date data could only be obtained if employees of relevant government agencies were involved or if someone had bypassed security systems storing the information.

A mobile operator told Dismislab that it had raised the issue with authorities and provided evidence, but the sale of such information had continued.

Call detail records and location information are generally held by mobile operators and are considered sensitive personal data. Access to such information is restricted to authorised government agencies and security forces under Bangladesh's laws and regulations for purposes including national security, criminal investigations and maintaining law and order.

Dismislab said the widespread availability of such information on the open market raises serious concerns over the protection of citizens' personal data and the security of systems holding sensitive information.