Lok Sabha Question No. 1046 (UNSTARRED), answered on 2023-07-26
Subject: Leak Information from CoWin Portal
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: Mohammad Jawed, Behanan Benny

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION NO. 1046

TO BE ANSWERED ON: 26.07.2023

## LEAK INFORMATION FROM COWIN PORTAL

## 1046. DR. MOHAMMAD JAWED: SHRI BENNY BEHANAN:

Will the Minister of ELECTRONICS AND INFORMATION TECHNOLOGY be pleased to state:

- (a) whether the Government has a tangible plan to contain the leaked information from the CoWIN portal and if so, the details thereof;
- (b) whether  the  Indian  Computer  Emergency  Response  Team  (CERT-In)  has  started investigation and identified those responsible for the breach;
- (c) if so, the details including the present status thereof and if not, the reasons therefor; and
- (d) the measures taken by the Government to enhance safety protocols regarding such large databases, with the key focus of protecting private information of citizens and preventing unauthorized access to their database?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAJEEV CHANDRASEKHAR)

(a):  As  per  the  information  provided  by  Ministry  of  Health  &  Family  Welfare,  Co-WIN portal  of  Ministry  of  Health  &  Family  Welfare  has  complete  security  measures  and adequate  safeguards  for  data  privacy  with  Web  Application  Firewall  (WAF),  AntiDistributed Denial-of-Service (DDoS),  Secure Sockets Layer (SSL)/Transport Layer Security (TLS), Identity & Access Management and regular vulnerability assessment.

(b) and (c):Taking cognizance of the cyber incident regarding CoWIN data in June 2023, CERT-In  coordinated  incident  response  measures  with  Ministry  of  Health  &  Family Welfare (MoHFW). The MoHFW has lodged a complaint and F.I.R has been registered by a law enforcement agency and CERT-In has provided inputs to facilitate investigation.

(d):  Government has taken following measures to enhance the cyber security posture and prevent data breaches:

- (i) To enhance  safety  protocols  regarding  large  databases,  with  the  key  focus  of protecting private information of citizens and preventing unauthorized access to their  database  such  as  Co-WIN App  /  Portal,  Ministry  of  Health  and  family welfare has taken following measures:
- a. Beneficiary  can  access  vaccination  details  by  registered  mobile  number through OTP authentication only.
- b. Mobile Numbers, Aadhaar Number & other Photo  ID Card numbers of beneficiary are masked. Only last 4 characters are visible to users (service providers) of Co-WIN.
- c. Complete Co-WIN database is  encrypted  using  'Encryption  Algorithm' key  to  protect  citizen  data  and  data  integrity  is  maintained  for  all  vital information.
- d. Two factor authentication feature (Password & OTP) while login by the users (service providers) is put in place restricting unauthorised access to Co-WIN.
- (ii) National Informatics Centre(NIC) adopts layered security approach in the form of practices,  procedures  and  technologies  that  are  put  in  place  at  both  network  and application level, in order to protect sensitive information. This is further strengthened through periodic compliance, audit and vulnerability assessment.
- (iii) To secure cloud infrastructure, NIC uses encryption at data rest as well as at data transient.
- (iv) As per Security audit guidelines and advisories by NIC, respective web application owners take necessary proactive measures to enforce data security and privacy at web  application  end  and  also  check  that  data  privacy  of  Personally  Identifiable Information (PII) and application audit log trail is duly maintained. As per the NIC best practices, sensitive data access is also controlled through multifactor authentication and strong authorization checks.
- (v) On observing the data breaches, CERT-In notifies the affected organisations along with remedial actions to be taken. CERT-In  coordinates  incident response measures with affected organisations, service providers, respective sector regulators as well as Law Enforcement Agencies.
- (vi) CERT-In issues alerts and advisories regarding latest cyber threats/vulnerabilities and countermeasures to protect computers, networks and data on an ongoing basis.
- (vii) A  special  advisory  on  security  practices  to  enhance  resilience  of  health  sector entities has been communicated by CERT-In to the Ministry of Health and Family Welfare, for sensitising health sector entities regarding latest cyber security threats in  December 2022. The Ministry has been requested to disseminate the advisory among all authorised medical care entities / service providers in the country.
- (viii) CERT-In is operates an automated cyber threat exchange platform for proactively collecting,  analysing  and  sharing  tailored  alerts  with  organisations  across  sectors for proactive threat mitigation actions by them.
- (ix) CERT-In has issued guidelines on information security practices for government entities  in  June  2023  covering  domains  such  as  data  security,  network  security, identity  and  access  management,  application  security,  third-party  outsourcing, hardening  procedures,  security  monitoring,  incident  management  and  security auditing.
- (x) CERT-In has empanelled 150 security auditing organisations to support and audit implementation of Information Security Best Practices.
- (xi) Government has formulated a Cyber Crisis Management Plan for countering cyber attacks and cyber terrorism for implementation by all Ministries/ Departments of Central  Government,  State  Governments  and  their  organizations  and  critical sectors.
- (xii) Cyber security mock drills are conducted regularly to enable assessment of cyber security  posture  and  preparedness  of  organisations  in  Government  and  critical sectors.  80  such  drills  have  so  far  been  conducted  by  CERT-In  where  1062 organizations from different States and sectors participated.
- (xiii) CERT-In  operates  the  Cyber  Swachhta  Kendra  (Botnet  Cleaning  and  Malware Analysis Centre) to detect malicious programs and free tools to remove the same and to provide cyber security tips and best practices for citizens and organisations
- (xiv) CERT-In conducts regular training programmes for network / system administrators  and  Chief  Information  Security  Officers  (CISOs)  of  Government and  critical  sector  organisations  regarding  securing  the  IT  infrastructure  and mitigating cyber attacks. A total of 42 training programmes have been conducted, covering 11,486 participants, during the years 2021 and 2022. In 2023, up to June, a total of 627 officials from Government, critical sectors, public and private sectors were trained in 6 training programs in the area of cyber security.
- (xv) Security  tips  have  been  published  for  users  to  secure  their  desktops  and  mobile phones and to prevent phishing attacks.
- (xvi) CERT-In  regularly  disseminates  information  and  shares  security  tips  on  cyber safety and security through its official social media handles and websites. CERT-In organised various events and activities for citizens during Safer Internet Day on 7 February 2023 and Cyber Security Awareness Month in October 2022, by posting security  tips  using  posters  and  videos  on  social  media  platforms  and  websites. CERT-In, in  association  with  Centre  for  Development  of  Advanced  Computing, conducted  an  online  awareness  campaign  for  citizens,  covering  topics  such  as general  online  safety,  social  media  risks  and  safety,  mobile  related  frauds  and safety,  secure  digital  payment  practices,  etc.,  through  videos  and  quizzes  on  the MyGov platform.
- (xvii) CERT-In has set up the National Cyber Coordination Centre (NCCC) to generate necessary situational awareness of existing and potential cyber security threats.
- (xviii) CERT-In  co-operates,  works  and  coordinates  incident  response  measures  with international CERTs, overseas organisations and service providers as well as law enforcement agencies.
- (xix) The National Critical Information Infrastructure Protection Centre has been setup for  the  protection  of  critical  information  infrastructure  and  responding  to  cyber incidents  pertaining  to  such  infrastructure.  The  Centre  provides  near-real-time threat  intelligence  and  situational  awareness,  based  on  which  regular  alerts  and tailored advisories are sent to the entities concerned with such infrastructure.
- (xx) The Ministry of Electronics and Information Technology conducts programmes to generate information security awareness. Books, videos and online materials about information security are developed for general users, children and parents, and are disseminated through portals such as www.infosecawareness.in and www.csk.gov.in.

*******