Introduction: The Illusion of Perimeter Security & The Politics of Exposure
Over the past decade, Bangladesh embarked on an aggressive, centralized transition toward digital governance. From electronic Know-Your-Customer (e-KYC) verification in banking and Mobile Financial Services (MFS) to land administration, welfare delivery, and electoral registries, the National Identity (NID) card became the indispensable civic passport of every citizen. Centralizing the demographic, familial, and biometric records of more than 120 million people was framed as a triumph of modern administrative statecraft.
Yet, this rapid digitization occurred without establishing the foundational legal safeguards of data privacy, cryptographic access control, or independent institutional oversight. What was conceived as an engine of civic inclusion has steadily mutated into an acute national security crisis and a dangerous instrument of political vulnerability. Between 2023 and 2026, a relentless cascade of data exposures demonstrated that the personal records of Bangladeshi citizens—names, dates of birth, high-resolution photographs, parental lineages, home addresses, phone numbers, and voting wards are no longer secure within state custody. Instead, they are actively scraped, cataloged, and traded across Telegram channels, social media forums, and dark-web marketplaces .
The evidence suggests that Bangladesh’s problem is therefore not simply a matter of an isolated ‘hack’. It is a governance problem involving excessive data disclosure, weak access controls, third-party dependencies, insider misuse and limited accountability. Recent reporting is particularly revealing: in January 2026, the Criminal Investigation Department (CID) said that 365,608 NID records had been accessed over a 30-day period in an alleged trafficking scheme involving Election Commission personnel. The investigation also alleged that the information was sold at Tk 200–300 per record.
Crucially, this crisis has evolved far beyond conventional cybercrime. In an intensely polarized political landscape, leaked NID datasets have become weaponized tools of political intimidation, partisan doxxing, and state-aligned surveillance. When extremist networks, partisan actors, and foreign entities can purchase the precise residential coordinates and family structures of dissidents, student activists, and journalists for pocket change, data insecurity ceases to be an abstract technical flaw , it becomes an existential threat to personal safety and democratic life.
1. Anatomy of an Epidemic: A Chronology of Institutional Exposure (2023–2026)
The commodification of Bangladeshi personal data is not speculative; it is thoroughly documented across an alarming timeline of systemic exposures across public and private critical information infrastructure (CII):
| Period | Incident & Source Node | Scale & Disclosed Impact |
| June–July 2023 | Office of the Registrar General (BDRIS / LGD) Public endpoint flaw discovered by Bitcrack Cyber Security. | 50M+ citizen records exposed publicly via unauthenticated database query endpoint. |
| October 2023 | Smart NID Automated Telegram Scraper Bot Scraped via compromised partner verification API. | 5.5M+ Smart NID records pulled directly through automated query commands. |
| April–May 2024 | NTMC Intelligence Platform & Insider Misuse Exposed law enforcement credentials on Telegram. | Millions of NID files, Call Detail Records (CDRs), and surveillance telemetry monetized. |
| Oct 2024 – Mar 2025 | Porichoy / Digicon Commercialization Case Senior ICT officials prosecuted under Cyber Security Act. | 110M+ voter files commercialized to 182+ private third-party domestic & international firms. |
| January 2026 | CID Cyber Crime Broker Syndicate Bust Illicit trading ring dismantled by CID Cyber Police. | 365,000+ NID records sold in 1 month, netting BDT 10–11 crore in illicit proceeds. |
| August 2026 | Tech Global Institute ‘Breached & Unanswered’ Comprehensive empirical cartography (2023–2026). | 68 major institutional breaches documented across public and private CNI. |
The public reckoning began in June 2023, when security researcher Viktor Markopoulos discovered that the portal of the Office of the Registrar General, Birth and Death Registration (BDRIS), had left an unauthenticated query endpoint open to the internet, exposing over 50 million citizen files. By October 2023, automated Telegram bots emerged, allowing anyone entering a 10-digit Smart NID number to receive full voter records, high-resolution photographs, and addresses. The Election Commission admitted the leak occurred through one of its 174 partner organizations.
By 2024 and 2025, commercial and insider exploitation became undeniable. NTMC intelligence credentials were confirmed by international reports to have been abused by senior personnel to sell citizen dossiers on Telegram. Concurrently, criminal investigations into the porichoy.gov.bd verification gateway revealed that private vendor Digicon Global Services had re-sold NID access to 182+ private firms without oversight, leading to the arrest of former ICT Senior Secretary N. M. Ziaul Alam. In January 2026, the CID busted a syndicate selling over 365,000 NID records in a single month for BDT 10–11 crore. In August 2026, Tech Global Institute’s landmark report, ‘Breached and Unanswered’, mapped 68 major institutional breaches, confirming that virtually every exposure was uncovered by external researchers rather than internal state monitoring.
2. The Architecture of Insecurity: Why Systemic Harvesting Persists
The Election Commission’s central servers were not compromised via a single catastrophic mainframe breach. Instead, the vulnerability lies in the distributed, over-permissive integration model that connects central identity repositories to external entities:
A. The Structural Failure of Data Minimization
In secure digital identity systems, third-party verification operates on a Zero-Knowledge or Boolean model. If a financial institution or telecom provider checks an identity, the API should return a simple verification confirmation (Match: TRUE or Match: FALSE). In Bangladesh, the NID verification API was engineered to return the entire citizen dossier like full names, parents’ names, dates of birth, present/permanent addresses, and high-resolution photographs. Every partner organization became an instant, unvetted repository of complete citizen profiles.
B. Insecure Endpoints, Static Credentials & Mirror Caching
Dozens of partner portals lacked basic API security controls, including Mutual TLS (mTLS), strict IP whitelisting, and rate-limiting. Scrapers could query endpoints continuously without triggering defensive blocks. Furthermore, to avoid per-query verification fees, partner agencies routinely stored unencrypted local ‘mirror copies’ on insecure local servers, multiplying the attack surface across hundreds of vulnerable subdomains.
3. The Human & Political Cost: Financial Fraud, Partisan Weaponization & Doxxing
The real-world consequences of mass identity exposure extend far beyond financial crime into acute political harassment and civil insecurity:
- MFS Fraud & Synthetic Identity Theft: Leaked photos and demographic data are used to forge physical cards and bypass e-KYC checks on digital wallets (bKash, Nagad), creating mule accounts for money laundering, cyber fraud, and illegal gambling, leaving innocent victims to face police interrogation.
- Political Weaponization & Targeted Doxxing: In an increasingly fractured political climate, partisan troll networks, extremist groups, and political actors weaponize leaked NID datasets to ‘dox’ their opponents. Opposition activists, investigative journalists, and minority community members have had their exact residential addresses, parental identities, and mobile numbers blasted across Telegram channels and Facebook groups to orchestrate mob intimidation and physical harassment.
- Legal Forgery & Untraceable Burner SIMs: Stolen NID credentials allow fraudulent sub-registry land deed transfers, unauthorized bank loans, and the illicit acquisition of pre-activated burner SIM cards for criminal extortion.
- Geopolitical Surveillance & Foreign Coercion: Comprehensive identity registries combined with telecommunication metadata provide foreign intelligence agencies and transnational actors with the tools to map social networks, identify family vulnerabilities, and execute strategic coercion against citizens.
4. Critical Legal & Governance Analysis: Scrutinizing the PDPA and National Data Governance Framework
In response to escalating breaches, Bangladesh introduced two cornerstone legislative instruments: the Personal Data Protection Act (PDPA) (enacted in 2026 after its 2025 Ordinance) and the National Data Governance Act (NDGA). While these laws mark a formal departure from the purely punitive, speech-policing focus of the Digital Security Act and Cyber Security Act, a rigorous legal analysis reveals profound structural flaws that undermine their protective potential.
| Legislative Pillar | Statutory Promise | Critical Analytical Flaw & Structural Risk |
| Personal Data Protection Act (PDPA) | Establishes citizen data ownership, defines data fiduciaries/processors, and mandates explicit consent. | Broad National Security Exemptions: State agencies, intelligence bodies, and law enforcement enjoy sweeping exemptions without judicial warrant requirements. |
| Data Protection Authority (DPA) | Creates an independent statutory body to enforce compliance and penalize negligent data fiduciaries. | Executive Subordination: The Authority lacks constitutional independence; leadership appointments and directives remain tethered to the executive branch. |
| Compliance & Grace Periods | Phased implementation allowing institutions to upgrade technical systems. | Delayed Accountability: Key breach-notification mandates are deferred up to 18 months, immunizing state fiduciaries from immediate legal liability. |
| National Data Governance Act (NDGA) | Establishes the National Responsible Data Exchange (NRDEX) and a 4-tier data classification model. | Surveillance Interoperability: Centralizes cross-ministerial data pooling without mandatory Zero-Knowledge proofs, increasing single-point failure risks. |
A. The Paradox of the Personal Data Protection Act (PDPA)
The PDPA formally recognizes citizens as the rightful owners of their data and classifies entities as data fiduciaries and processors. It sets penalties of up to 5% of annual domestic turnover for significant data fiduciaries and mandates explicit consent for sensitive biometric and demographic records. However, the legislation contains critical structural loopholes:
- The ‘National Security’ Blanket: The Act retains expansive carve-outs for ‘public interest’, ‘law enforcement’, and ‘national security’ (notably under provisions like Section 49). These exemptions allow state agencies to intercept, process, and share citizen data without independent judicial warrants or transparent oversight.
- Institutional Subordination of the Regulator: The proposed Data Protection Authority is not an autonomous constitutional ombudsman. Its funding, appointments, and policy directions remain tied to executive ministries. Since the state is the largest data collector and primary source of leaks, an executive-controlled board creates an insurmountable conflict of interest.
- The 18-Month Enforcement Vacuum: The prolonged transition window delays mandatory 72-hour breach notification enforcement, shielding public agencies from legal liability while data breaches continue in real time.
B. The National Data Governance Act (NDGA) & The Risks of NRDEX
The National Data Governance Act introduces a four-tier classification system (public, internal, restricted, and confidential) and establishes the National Responsible Data Exchange (NRDEX) to enable secure cross-ministerial data sharing. While interoperability is vital for e-governance, without strict technical guardrails, NRDEX risks creating a centralized super-structure where disparate datasets (tax, health, land, NID, telecom) are fused together:
- The Centralized Attack Surface: Merging discrete ministerial silos into a unified data exchange exponentially increases the blast radius of any single compromise. A breach at a low-security municipal node can expose high-security national identity linkages.
- Interoperability Without Cryptographic Boundaries: The NDGA promotes administrative efficiency over cryptographic privacy. Without legally binding mandates for data anonymization, pseudonymization, and zero-knowledge queries, the Act facilitates state surveillance under the guise of administrative modernization.
5. The Technical & Institutional Blueprint for Genuine Data Sovereignty
To bridge the gap between statutory promises and operational security, Bangladesh must implement an actionable engineering and institutional roadmap:
- 1. Zero-Knowledge Verification by Default: Decommission all legacy verification APIs that transmit raw demographic payloads. All external queries from banks, MFS, and ministries must strictly return Boolean verification scores (Match: Yes/No) or cryptographic verification tokens.
- 2. Hardware-Bound Cryptographic Access: Mandate Mutual TLS (mTLS), short-lived ephemeral session tokens, and Hardware Security Modules (HSMs) for all 170+ partner connections, combined with automated rate-limiting to prevent bulk scraping.
- 3. Constitutional Independence for the DPA: Amend the PDPA to establish an autonomous Data Protection Commission accountable directly to a bipartisan parliamentary standing committee, equipped with independent forensic investigative powers.
- 4. The Sovereign Citizen Access Dashboard: Launch a public-facing Citizen Access Log Portal inspired by Estonia’s X-Road enabling every Bangladeshi to log in, view which entity queried their NID, dispute unauthorized access, and temporarily lock their profiles from third-party verification.
- 5. Formalized Vulnerability Disclosure: Replace administrative hostility toward ethical security researchers with formal Vulnerability Disclosure Programs (VDPs) and institutional bug bounties across all Critical Information Infrastructure (CII).
Conclusion: Restoring the Digital Social Contract
National identity is more than a digital record stored on a server. It is the civic bond linking the individual to the state. When citizens surrender their personal details, biometric data, and family histories, they do so trusting the state to act as a responsible custodian.
When that trust is breached and citizen files are traded openly in online markets, the social contract itself is eroded. These leaks are not abstract technical failures. Political extremists weaponize the data to harass and intimidate. The exposure can be life-threatening. Foreign powers can exploit the same information for surveillance, influence, or coercion.
A democratic and resilient Bangladesh cannot rest on systems that leave its citizens exposed, vulnerable, and disposable. Protecting citizen data is not a policy preference; it is a non-negotiable constitutional duty, an economic necessity, and the minimum condition for national dignity. As Bangladeshi citizens, it should be the bare minimum to ask.
References & Further Reading
- Tech Global Institute. (2026). Breached and Unanswered: A Cartography of Bangladesh’s Data Breach Epidemic (2023–2026). https://investigations.techglobalinstitute.com/
- Tech Global Institute. (2026). Unmasking Data Exploitation in Bangladesh’s Digital Identity Systems. https://techglobalinstitute.com/data-exploitation-in-bangladeshs-digital-identity-systems/
- WIRED. (2024). A Spy Agency Leaked People’s Data Online—Then the Data Was Stolen. https://www.wired.com/story/ntmc-bangladesh-database-leak
- The Daily Star. (2024). Cybergangs now selling ‘genuine’ NIDs. https://www.thedailystar.net/news/bangladesh/crime-justice/news/cybergangs-now-selling-genuine-nids-3606211
- The Daily Star. (2025). Bangladesh’s Personal Data Protection Ordinance 2025: Key Takeaways. https://www.thedailystar.net/tech-startup/news/bangladeshs-personal-data-protection-ordinance-2025-key-takeaways-4015401
- The Daily Star. (2025). Shielding Personal Data: Govt Brings Big Tech Under Local Courts’ Purview. https://www.thedailystar.net/news/bangladesh/news/shielding-personal-data-govt-brings-big-tech-under-local-courts-purview
- Transparency International Bangladesh (TIB) & ARTICLE 19. (2024/2026). Review and Recommendations on the Personal Data Protection Act. https://www.ti-bangladesh.org/
- The Business Standard. (2026). Over 365,000 NID Records Sold in a Month, CID Uncovers Tk 11cr Fraud. https://www.tbsnews.net/bangladesh/over-365000-nid-records-sold-month-cid-uncovers-tk11cr-fraud-1335126
- The Daily Star. (2025). Ex-Senior ICT Secretary Held in Ctg over NID Data Leak Case. https://www.thedailystar.net/news/bangladesh/crime-justice/news/ex-senior-ict-secretary-held-ctg-3840746
- The Daily Star. (2025). EC halts NID verification by Ansar, BRAC Bank. https://www.thedailystar.net/news/bangladesh/news/ec-halts-nid-verification-ansar-brac-bank-3888981
About Author:
Moontacir Habib
Moontacir Habib is an undergraduate student in Computer Network and Cyber Security (CNCS) at American International University-Bangladesh (AIUB), focusing on national cybersecurity architecture,human rights,environmental policy, public data governance and analyzing media landscapes. His experience includes facilitating international electoral outreach and dialogue with bodies such as the EU EOM, driving high-impact cross-border civic and cultural engagement, strategic communication, and collaborative planning.