Bangladeshi police blamed for selling confidential information on Telegram

Two senior police officers working for the anti-terror department in Bangladesh are being accused of allegedly collecting and selling classified and personal information of citizens to criminals on Telegram.

The private information that’s supposedly being sold, originates from National Intelligence Platform (NIP), a governmental web portal that holds classified information on Bangladeshi citizens. It includes cell phone records that are classified as ‘secret information’.

A letter addressed to the senior secretary of the Ministry of Home Affairs Public Security Division claims that two police officers accessed and passed “extremely sensitive information” of private citizens on Telegram in exchange for money.

According to the letter, which was verified by TechCrunch, the officers -a superintendent from the Anti-Terrorism Unit (ATU) and an assistant police superintendent deputy working for the Rapid Action Battalion (RAB 6)- were caught after investigators analyzed logs of the NTMC’s systems.

Researchers concluded that both agents used the National Intelligence Platform (NIP), a governmental web portal that holds classified information on Bangladeshi citizens, more often than other employees, and accessed and collected information that wasn’t relevant to them.

The data was then sent to the administrator of at least one Telegram group, with the purpose to sell it.

Mohammed Baker, director of Bangladesh’s national intelligence agency, the National Telecommunications Monitoring Center (NTMC), confirms that the two police officers are under investigation. Because of that, access privileges of all NIP users from ATU and RAB 6 have temporarily been suspended “until the involved officials are identified, and proper action is taken.”

Bangladesh confronted with multiple data breaches

It's not the first time the NTMC has had to deal with a data breach. Last year, a security researcher found that personal information was being leaked on a unsecure server. Full names, phone numbers, email addresses and locations of an unknown number of Bangladeshi citizens got out in the open.

The Office of the Registrar General, Birth & Death Registration also leaked sensitive information of 50 million citizens. The Bangladeshi Computer Incident Response Team (CIRT) swiftly addressed the data leak and took all of the data down. Bangladesh’s State Minister for Information and Communication Technology Zunaid Ahmed Palak said in a statement that the citizens’ information was exposed due to a vulnerability of the website.