In a Facebook group meant for startups in Bangalore, a post popped on Wednesday afternoon: “Bangalore data available for Rs. 100.” As a teaser, the message also had screenshots of several excel sheets, sorted city-wise: Bangalore, Mumbai, Lucknow and even Bhagalpur in Bihar.
Within a couple of hours, several users in the group responded with one message: “Interested.”
I did that too.
Within 24 hours and after a little bit of haggling, a price was negotiated and I transferred Rs 100 through a mobile wallet. Soon, several excel sheets of data landed in my inbox from two different data brokers.
One of them was called “2.5 lacs mobile.xlx”. It was a list of all mobile subscribers of on a telecom network in Bangalore.
I scrolled down and to my amusement and horror, saw my own name and telephone number on it.
For a hundred rupees, I was a field in a database. I couldn’t buy a pack of cigarettes with hundred bucks but a part of my identity was up for sale.
There were other databases in my inbox. One had a long list of people in Bihar, their mobile numbers, educational qualifications, what they made every year, and even preferred location of working.
Another database had credit cards details of customers of a particular bank including name, age, date of birth and address. Yet another database was a list High Networth Individuals or HNIs with their phone numbers, their annual income, employers and their residential addressees.
TheBigScope called some of the people on these lists to check the veracity of these databases. In some cases, the customers were angry and petrified about how I had accessed their data. Some shooed me off, dismissing me as a salesman from a bank.
One important question was: why are such databases being sold so cheap? The answer is equally worrying. Such databases are by now easily available and have changed hands several times. So, a database like a HNI list in Bangalore would have been sold for Rs 15,000-20,000, a couple of years ago. But after its been passed around in the last few years, its value decreases, a cyber security researcher who chose to remain anonymous told TheBigScope.
She also said that the advent of social media has helped amateur data brokers collate and sell random datasets strewn across internet at dirt cheap prices in groups as the deal gets done quickly. “Earlier these kind of data sets were available on the Dark Web where only a select set of people were buying and selling information about people through digital currencies but platforms like Facebook make it easier for anyone to become a seller.”
Reiterating the dangers of data brokers, she pointed out to a list which was doing the rounds in the national capital on diabetes patients. “Imagine what companies who want to target diabetic patients with their products can do. If you have medical profiling at this level, what else can you do with a list of people with different diseases.”
In the past, I have reported about how easily sensitive data about Indian citizens is being sold online for less than a rupee per person.
Sunil Abraham, the head of Bangalore based research organisation Centre for Internet and Society, says that data broking – or the selling of people’s private data is old business. If a person’s private data sets are being used by a third party without his/her consent, they approach the court under Section 43A of the Indian IT Act. However, they cannot sue the brokers if they have not faced any financial losses for these transactions, adds Abraham.
Indrajeet Bhuyan, an independent security researcher pointed out that with country wide initiatives like Digital India, data about the average person in India is being collected and consolidated by many organizations and it becomes easier for data brokers to collect information about people, make lists and sell it for variable prices across the internet.