Compromised RTI servers

I

 

More than a decade ago when the RTI act was passed in the parliament it gave a new hope to the citizens, to fight injustice. Since then thousands of RTIs have been filed and countless have been answered. The attacks on RTI activists in past few years has made us realize that however simple it may sound to file an RTI, the repercussions are largely harmful. The bigger corruption you expose, the more are chances of you getting in trouble.

Whereas the life of brave activists are protected by the whistleblower protection act the question remains unanswered - Why and how the corrupt are intimidating and killing these activists? And more importantly how the government is working to safeguard them?

Perhaps these questions cannot be answered!

II

The central idea of writing this blog is my encounter with a serious vulnerability on Ministry of Food Processing server. A year ago I filed an RTI with mofpi regarding the Nestle Maggi ban case. The RTI was well answered and complete description with details was provided. A few months ago I saw a note on my desktop. I could not recall why I saved it so I simply searched it on the internet. To my surprise, I found a link to Guv's MOFPI. When I opened it I was shocked to see my filed RTI on their server. The reason I froze for a second was that anybody on the internet could access that RTI which contained my personal information like name, complete address, mobile number and email address. It was an insecure link which can be accessed by any unauthenticated and unauthorized person.

It took me only a minute to realize that I can access as much as 10 RTIs on the server by altering the link. Here is the link to the RTI I filed.

I decided to inform the authorities about the issue. I wrote them an email on 27/10/2016. It has been months and I never received a reply. The issue was never resolved.

This callous nature of Guv is a contributing factor to the insecurities and mistrust in government.




Please share this to raise awareness.