“How is this possible?”: Minister reacts seeing leaked data from his own mobile phone

It is possible to obtain, simply by paying money, information about whom people in Bangladesh speak to on their mobile phones, what messages they send and where they go. Such information has been openly traded for years through websites where buyers can register and place orders.

On 6 September, a minister’s mobile phone number was sent to one of the people involved in selling such information. The amount they demanded was also paid. Within a few hours, the minister’s call detail record (CDR) was received.

The CDR contained a range of confidential information, including whom the minister had spoken to over the preceding three months, the duration and timing of those calls, and where he had been while making them.

To establish whether the CDR was genuine, this correspondent went to the minister’s office on 7 September. After showing him the CDR, the minister took out his mobile phone and checked the details against it. He was astonished. “How is this possible?” he asked. “Then no one is safe.”

An investigation has found that it is possible to obtain the CDR of any mobile phone user in the country. Alongside the CDR of a minister, Prothom Alo obtained the CDRs of two heads of important organisations in the information technology and telecommunications sectors. The CDRs of two Prothom Alo employees were also obtained.

When the details were checked against the respective mobile phones, all of the CDRs were found to be accurate.

An online market has emerged around the buying and selling of confidential mobile phone data. Such information is being sold through Facebook advertisements, dedicated websites, Telegram and WhatsApp.

For a fee, buyers can obtain an individual’s national identity (NID) card information, CDR, mobile phone location, text messages or SMSs, tax identification number (TIN) certificate, passport information and financial details of mobile transactions.

Prothom Alo obtained some information on the matter, including the CDRs of several people, last October. Meanwhile, on 31 August, fact-checking organisation Dismislab published a report on the issue. It said it had identified 10 active websites selling personal information, as well as more than 600 posts on Facebook offering such data for sale.

Prothom Alo’s investigation has found that even the information of people holding important positions in the state is not secure. In some cases, even the confidential information of those responsible for keeping people safe is being exposed.

Miraj Ahmed Chowdhury, managing director of Digital Rights, an organisation working on the impact of technology on information systems, told Prothom Alo that a person’s private communications constitute highly confidential information.

“When such information is available simply by reaching out and paying for it, the right to privacy is undermined,” he said. “Suppose a criminal gang wants to harm someone. By purchasing that person’s mobile phone CDR, they can get an idea of where the person goes and the places they visit.”

On one of the websites selling CDRs, registration and access to the homepage reveal advertisements for services including NID creation, smart NID creation, birth registration creation, auto-sign copies, biometric orders, location orders, call-list orders, orders for mobile financial service app information and sales of passport SB copies.

A separate fee and turnaround time are specified for each service.

A three-month CDR costs Tk1,050, while a six-month CDR costs Tk1,200.

The operators of these websites communicate with customers through WhatsApp groups, where they exchange messages and process requests.

Asked about the leaking of confidential mobile phone information, Posts, Telecommunications and Information Technology Minister Fakir Mahbub Anam told Prothom Alo that the sale or leakage of citizens’ personal information in this manner could not be allowed to continue.

“The government is working to identify and bring this network to justice as quickly as possible, in coordination with the Bangladesh Telecommunication Regulatory Commission (BTRC), the regulator, and law-enforcement agencies,” he said.

On 6 September, money was paid after registering on a website that offers CDRs for the mobile phone number of the director general of a government agency in the telecommunications and information technology sector. The CDR arrived within around five hours.

When Prothom Alo visited the agency chief on 8 September, he confirmed that the CDR was accurate. He said he had been aware that CDRs could be leaked, but had not imagined that such up-to-date information could be obtained so easily.

The Bangladesh Telecommunication Regulatory Commission (BTRC) is the regulator of the telecommunications sector. It is also responsible for overseeing the security of customers’ personal information.

BTRC Chairman Major General (retd.) Md Emdad Ul Bari told Prothom Alo on Tuesday that if citizens’ personal information was being sold in this way, it posed a risk to national security.

“BTRC is working with law-enforcement agencies on the matter,” he said.

The four mobile operators in the country have over 190 million subscribers. According to the latest Population and Housing Census (2022) conducted by the Bangladesh Bureau of Statistics (BBS), 56 per cent of people aged over five use mobile phones.

Mobile operators store information about whom a person calls, who calls them and what text messages are exchanged. They are legally required to retain such information.

These details are included in CDRs, along with the International Mobile Equipment Identity (IMEI) number of the handset and information about the mobile tower used when a call or SMS was made or sent.

Twelve organisations, including law-enforcement agencies and intelligence agencies, have access to the operators’ databases.

However, CDRs do not contain information from mobile applications such as WhatsApp, Signal or Telegram.

Prothom Alo sent written questions to Grameenphone and Robi seeking their views on how people’s information could be leaked. Both operators said they maintained strict controls over access to their databases.

They also said that, under the law, access to such information was restricted to authorised individuals.

However, an official of a mobile operator, speaking to Prothom Alo on condition of anonymity, claimed that certain individuals in specific government agencies had the ability to access operators’ databases directly, outside the authorised process.

According to the official, in such cases there was not even a need to make a separate request to the operator for the information.

Sources at mobile operators said it was possible to identify who was taking people’s information and how they were obtaining it. What was needed, however, was a strong government initiative.

A report published last month by the technology research organisation TechGlobal Institute (TGI) said Bangladesh had recorded at least 68 data breaches between January 2023 and May 2026. Of these, 36 involved government organisations and 32 involved private-sector organisations.

A range of personal information belonging to citizens was exposed in these breaches.

In February last year, information from the NID database was leaked. In 2023, the data of 50 million people contained in the NID database was also leaked. No action was taken against those responsible for these incidents.

In July 2023, the then state minister for information and communication technology, Zunaid Ahmed Palak, said that the data leak did not constitute a threat to national security.

According to the TGI report, most of the organisations responsible for safeguarding the data were unaware that breaches had occurred. There have been no notable instances of accountability or punishment following such incidents.

Transparency International Bangladesh (TIB) Executive Director Iftekharuzzaman believes that the commercial leakage and sale of citizens’ mobile phone-related personal information points to weaknesses and abuse within the overall system.

He told Prothom Alo that the use of such information as a commercial commodity created a risk of violating citizens’ privacy and constitutional rights.

“The relevant authorities should investigate the matter with the highest priority and identify those involved,” he said. “At the same time, the weaknesses in the system that create opportunities for data leaks must be identified and addressed through technological and strategic measures.”