Bangladeshi police brokers accused of promoting residents’ private data on Telegram

Two senior officers working for anti-terror police in Bangladesh allegedly collected and bought labeled and private data of residents to criminals on Telegram, TechCrunch has discovered. 

The information allegedly bought included nationwide id particulars of residents, mobile phone name information and different “labeled secret data,” in response to a letter signed by a senior Bangladeshi intelligence official, seen by TechCrunch.

The letter, dated April 28, was written by Brigadier Common Mohammad Baker, who serves as a director of Bangladesh’s Nationwide Telecommunications Monitoring Middle, or NTMC, the nation’s digital eavesdropping company. Baker confirmed the legitimacy of the letter and its contents in an interview with TechCrunch. 

“Departmental investigation is ongoing for each the instances,” Baker stated in an internet chat, including that the Bangladeshi Ministry of Dwelling Affairs ordered the affected police organizations to take “obligatory motion in opposition to these officers.” 

The letter, which was initially written in Bengali and addressed to the senior secretary of the Ministry of Dwelling Affairs Public Safety Division, alleges the 2 police brokers accessed and handed “extraordinarily delicate data” of personal residents on Telegram in trade for cash.

In line with the letter, the police brokers had been caught after investigators analyzed logs of the NTMC’s methods and the way usually the 2 accessed it.

The letter reveals the id of the officers. One of many accused is a police superintendent serving with the Anti-Terrorism Unit (ATU). The opposite is an assistant police superintendent deputy on the Fast Motion Battalion, also called RAB 6, a controversial paramilitary unit that the U.S. authorities sanctioned in 2021 over allegations that the unit is linked to lots of of disappearances and extrajudicial killings. TechCrunch will not be naming the 2 individuals who had been accused because it’s unclear if they’ve been charged beneath the nation’s authorized system.

The NTMC is a authorities intelligence company established beneath Bangladesh’s Ministry of Dwelling Affairs. The company’s core activity is to observe all telecommunications visitors and intercept cellphone and net communications to detect and stop threats to nationwide safety. 

Organizations like Human Rights Watch and Freedom Home have criticized the NTMC for missing safeguards in opposition to abuses, each in opposition to free speech in addition to privateness. Over time, NTMC procured refined know-how from firms in Israel, which Bangladesh doesn’t formally acknowledge, in addition to different Western international locations, to conduct mass surveillance largely on opposition social gathering members, journalists, civil society members and activists.  

As a part of its mission, the NTMC runs the Nationwide Intelligence Platform, or NIP, an inside authorities net portal that holds labeled citizen data, like nationwide identification particulars, mobile phone registration and cell information information, legal profiles and different data. 

Numerous regulation enforcement and intelligence companies have person accounts on the NIP portal offered by the NTMC. 

NTMC’s personal investigation concluded that the brokers used the NIP platform extra regularly than others, and accessed and picked up data that was not related to them.

“Contemplating the context, such irrelevant entry and illegal handover of extraordinarily delicate labeled information ought to be investigated to establish everybody concerned on this and we additionally request for applicable motion in opposition to all these recognized/concerned,” the letter learn.  

Baker informed TechCrunch that there have been a “variety of Telegram channels,” including that considered one of them was referred to as BD CYBER GANG.

TechCrunch couldn’t establish the particular channel on Telegram. 

Baker informed TechCrunch that it seems that the 2 brokers despatched the knowledge to the administrator of a minimum of one Telegram group, who then tried to promote it. 

Baker stated that the 2 brokers have been notified of the investigation. 

Due to the investigation, all NIP customers from ATU and RAB 6 have had their entry suspended “till the concerned officers are recognized, and correct motion is taken,” in response to the letter.

Baker confirmed the suspended entry, saying that if brokers “want any data for investigation functions they will acquire by way of Police and RAB HQ.”

Spokespeople for Bangladesh’s Ministry of Dwelling Affairs and ATU didn’t reply to a number of requests for remark. An individual figuring out solely as an “operations officer” at RAB 6 informed TechCrunch that the company had no remark. 

Final yr, a safety researcher discovered that the NTMC was leaking folks’s private data on an unsecured server. The leaked information included real-world names, cellphone numbers, e-mail addresses, places and examination outcomes, in response to Wired. One other Bangladeshi authorities company, the Workplace of the Registrar Common, Delivery & Loss of life Registration, additionally leaked residents’ delicate information final yr, as TechCrunch reported on the time.

In each instances, the leaks had been discovered by Viktor Markopoulos, a researcher who works at Bitcrack Cyber Safety. 

Whereas these had been important instances of information publicity, this incident allegedly involving the ATU and RAB 6 brokers is doubtlessly extra damaging, on condition that the brokers allegedly bought data on-line in an try and revenue from their privileged entry to labeled private data.  

Though the incident is beneath investigation, a well-placed supply inside the authorities informed TechCrunch that there are nonetheless officers who’re providing to promote residents’ information.