No CERT-in update yet on CoWIN data leak; experts demand transparency

• The Indian Computer Emergency Team (CERT-in) has not directly put out any update on its assessment of the leak of personal information of people who received COVID-19 vaccinations, registered on the CoWIN platform.
• CERT-in has not put out any alert to citizens that their Aadhaar or passport numbers, along with other personal details, may be hacked.

Background

• While privacy, including informational privacy, was upheld as a fundamental right in the Constitution by the Supreme Court in 2017, the government has not passed a data protection Bill yet.
• A report by private cybersecurity firm CloudSEK said the data appears to be not from CoWIN directly, but from a health worker who had inadequately protected vaccination beneficiary data.
• The data appeared slightly richer than what CoWIN possessed: namely, precise dates of birth were available for vaccine beneficiaries, though the CoWIN portal only collected the year of birth.

Indian Computer Emergency Response Team (CERT-in)

• A functional organisation of the Ministry of Information & Electronics Technology.
• A national nodal agency for responding to computer security incidents as and when they occur.
• Objective: Securing Indian cyberspace.
• Operational since January 2004.
• Functions:
  • Collection, analysis and dissemination of information on cyber incidents;
  • Forecast and alerts of cyber security incidents;
  • Emergency measures for handling cyber security incidents;
  • Coordination of cyber incident response activities;
  • Issue guidelines, advisories, vulnerability notes and whitepapers relating to information security practices, procedures, prevention, response and reporting of cyber incidents;

Co-WIN App (Covid Vaccine Intelligence Network)

• A cloud-based IT platform.
• Supposed to handle minute details for India’s Covid-19 immunisation programme, including registering beneficiaries, allocating vaccination centres, sending text messages with name of their vaccinator to beneficiaries and live monitoring of vials in cold storage.
• Owned by the Ministry of Health and Family Welfare.
• Earlier the platform was used for conducting Pulse Polio and other crucial immunisation programmes across the country.
• Functions
  • Enables monitoring the inoculation drive and tracking the listed beneficiaries for vaccination on a real-time basis.
  • Also helps to counter proxy vaccinations.

Prelims Takeaway

• Co-WIN App
• Indian Computer Emergency Response Team (CERT-in)