Chennai Corp’s Privacy Disaster Continues | TechTree.com

Chennai Corp’s Privacy Disaster Continues

The city’s birth certificates since 1910 remain available, bizarrely, for public view and unrestricted download on the corporation website

 
Chennai Corp’s Privacy Disaster Continues

So you’re a hacker trying to reset someone’s banking password. You already know her date of birth, but wait, the bank website now wants her place of birth, mother’s name, and permanent address.

Easy peasy, if your victim was born in Chennai. Just go to the Chennai Corporation website and enter her date of birth. You get the full list of those born that day. Click the name, and you get her actual birth certificate, with all these and more details. You’re home and dry.

Chennai was among the first cities to make all birth and death certificates available online since, evidently, circa 2008. And they have listed births since 1910.

Great boon to Indians living outside Chennai, as they can now download and print their birth certificates without having to travel to Chennai. Great boon to hackers too, as there are no are no barriers to this information, barring (yawn) a captcha code.

What do other cities in India and the world do? Barring Hyderabad, which seems to have copied Chennai’s ‘openness’, they ask you to prove your identity. Just as with India’s Aadhaar card, which you can download online—but with the registration number and exact date and time of registration.

It’s been a fortnight since this was discussed and criticised in Indian social media, but not a blink or a squeak out of Chennai corporation. The site is still wide open.

First pointed out in December by Twitter user @St_Hill last month, the Chennai Corporation website still lets you download birth certificates freely

On the other hand there doesn’t seem to be much sanctity either of the correctness of the birth certificate information. An official was quoted in a newspaper report as saying that where records were missing or damaged, they would be “recreated based on information provided by the applicant.” Maybe he was joking, but it wasn’t April 1.

(At the time of writing, we were unable to get a response on the issue from Chennai Corporation, and will update this story if and when we do.)

Meera Srikant is a consultant to Trivone, publishers of TechTree.


Tags : Chennai Corporation