![Hindu nationalist Narendra Modi, prime ministerial candidate for India’s main opposition BJP, takes “selfie” with mobile phone after casting his vote at a polling station during seventh phase of India’s general election in Ahmedabad](https://beebom.com/wp-content/uploads/2018/02/modi_featured_750px.jpg?w=750&quality=75)
Following reports that the Narendra Modi app was sending user data to third-party domains belonging to a app marketing company CleverTap, the BJP’s IT cell denied the allegations, saying that the data was being used to offer users contextual content to enhance their experience of the app.
Now, the the ruling party is going one step further, and accusing the Congress of sharing user data with “practically anyone”.
A tweet posted by BJP’s Amit Malviya last evening quotes a disclosure on the official INC website, and ridicules the party for sharing data with “undisclosed vendors, unknown volunteers, even groups with similar causes”. As can be seen from the embedded tweet below, Malviya goes on to accuse the Congress of outright data theft, saying that the party has “never been discreet” about stealing user data.
Full marks to @INCIndia for stating upfront that they'll give your data to **practically anyone** – undisclosed vendors, unknown volunteers, even 'groups with similar causes'. In theft of all forms, Congress has never been discreet! pic.twitter.com/FCSIv6nPMn
— Amit Malviya (@amitmalviya) March 26, 2018
Congress, however, has denied the allegations, saying that it doesn’t collect any personal data through the INC app. According to a tweet from the party’s social media spokesperson Divya Spandana (aka Ramya), the company discontinued the app a long time ago. She went on to say that the party only collects data through its website, and that too, only for membership purposes.
https://twitter.com/divyaspandana/status/978101853031452673
It all started Saturday night when Rahul Gandhi seemingly mocked the PM for the NaMo app’s apparent lackadaisical attitude towards data privacy.
Hi! My name is Narendra Modi. I am India's Prime Minister. When you sign up for my official App, I give all your data to my friends in American companies.
Ps. Thanks mainstream media, you're doing a great job of burying this critical story, as always.https://t.co/IZYzkuH1ZH
— Rahul Gandhi (@RahulGandhi) March 25, 2018
Gandhi’s tweet was based on media reports that cited tweets by famed cyber-security expert Elliot Alderson, who claimed Friday that the Narendra Modi app was sending personal user data to a US domain that’s classified as a phishing link by cyber-security firm G-Data.
When you create a profile in the official @narendramodi #Android app, all your device info (OS, network type, Carrier …) and personal data (email, photo, gender, name, …) are send without your consent to a third-party domain called https://t.co/N3zA3QeNZO. pic.twitter.com/Vey3OP6hcf
— Baptiste Robert (@fs0c131y) March 23, 2018
While the privacy policy of the NaMo app has been updated after the issue came to light, NDTV claims that until Sunday, the privacy policy on the official Narendra Modi website read, “Your personal information and contact details shall remain confidential and shall not be used for any purpose other than our communication with you. The information shall not be provided to third parties in any manner whatsoever without your consent”.
The updated version, however, says that the “information may be processed by third party services to offer you a better experience as stated above: name, email, mobile phone number, device information, location and network carrier”.
Alderson also looked in to the Congress app on Android and found some glaring security holes in it as well. He also discovered that the app is sending data to servers located in Singapore.
When you apply for membership in the official @INCIndia #android #app, your personal data are send encoded through a HTTP request to https://t.co/t1pidQUmtq. pic.twitter.com/6RH0ORYrQd
— Baptiste Robert (@fs0c131y) March 26, 2018
Moreover, the personal data are encoding with base 64. This is not encryption! Decode this data is very easy as shown in the example. pic.twitter.com/yDWawN2YiR
— Baptiste Robert (@fs0c131y) March 26, 2018
The IP address of https://t.co/t1pidQUmtq is 52.77.237.47. This server is located in Singapore. As you are an #Indian political party, having your server in #India is probably a good idea. pic.twitter.com/tbspCtOPfB
— Baptiste Robert (@fs0c131y) March 26, 2018
Ominously, INC seems to have taken down the app after these discoveries.
Did @INCIndia removed their #android #app from the PlayStore just before my tweet?
— Baptiste Robert (@fs0c131y) March 26, 2018
The mud-slinging and allegations are not likely to stop in the coming days as more and more people become aware about the data collection practices employed by official political apps of India. We will be bringing you all the fallout from this controversial issue as it unfolds.