Digital Rights Weekly/Year 1/Issue 28

Nepal National ID Card Portal is Not Secure!!
The National Identity Card of Nepal is the official document issued by the Government of Nepal to Nepali citizens. It contains the personal information of the holder, such as name, date of birth, gender, and address. The card contains demographic data, biometric data and a microchip with a unique identification number for each citizen. The card also has a photograph of the holder, and is used for various purposes such as identification, verification, and authentication. The idea of digital national identity card was introduced in 2009 in Nepal in the government’s policies and programs to make voter’s lists more systematic. In April 2010, a pilot project was launched to distribute voter identity cards with photos and fingerprints. It was believed that the pilot project would lead to the distribution of national ID. But that only materialized in 2018. In the first phase, the government distributed national ID cards to citizens in the Panchthar district and employees working at the Singha Durbar. As of February 2021, 1.9 million cards have been distributed to citizens in different districts.
To get the national Id card one needs to fill the pre-enrollment form, which is available both manually and online.  The department of National ID and Civil Registration has created an online portal to fill online pre-enrollment forms. The pre-enrollment portal is marked as “not secured” in the address bar in a bid to stamp out the prevalence of unencrypted page, raising the issues of data privacy.
In July 2018, google chrome updated all HTTP sites as not secure. The explicit warning followed years of warning from google and others for website owners to serve traffic over the more secure HTTPS protocol. HTTPS stands for HTTP Secure. It is a more secure version of HTTP, and it is used to establish an encrypted connection between a web server and a client (Browser and similar app). This means any data transmitted between the web-server and the client is encrypted, which makes it more difficult for someone (man in the middle attack, ISPs and so forth) to intercept and read that data. HTTP does not encrypt data that travels between a user’s computer and a website and, therefore, does not protect the integrity and confidentiality of data.
As the pre-enrollment form needs information like name, address, gender, date of birth, citizenship number, next of kin information etc. With all this personally identifiable information (PII) that loads over an insured connection without redirecting to a secure, encrypted connection raises a question of how secure our data that is, in hands of the government.
Cyber Security Researcher Saroj Lamichhane said “HTTPS is an important security measure that helps to keep sensitive information private and secure, and it can also improve a website’s search engine rankings”.  He further added, “When we provide personally identifiable information (PII), credit card information, password multi-factor authentication data, and so forth, HTTPS is mandatory, and most international compliance such as GDRP clearly mention using HTTPS.  Here NID Pre-Enrollment (nidmc.gov.np) stores critical personal information, therefor it should’ve implemented HTTPS since implementing HTTPS nowadays is easy, from free to a minimum, you can get the certificates from the service provider and it does not affect the faster connection.”
Mr. Lamichhane pointed out the loophole and said “We can see gross negligence while hosting the nidmc.gov.np website, first and foremost, it should have been hosted at the GIDC data center where they asked for a basic security test report before hosting to their data center, right now it is hosted at the NTC network.
Constitution of Nepal, 2072 and Individual Privacy Act, 2075 mandated the government and its agencies to make all the necessary arrangements to protect PII that is collected and stored by the government. But, having HTTP sites of government agencies violates the essence of the constitutional right of Privacy of an individual and individual Privacy Act. Which makes personal data on the verge of being misused by a third party. It’s high time that government needs to look more seriously at data protection and digital security.

Tech Care: A step-by-step guide to providing digital support for civil society. This guide will enable smaller organizations and grassroots groups to set up a team to respond to the digital safety needs of the people they work and fight with. It can be read by techies who want to organize and join forces to help their movement, but also by managers and organizers, who can follow the steps outlined in the initial chapters to start planning the creation of a digital security help desk for civil society and then look for people with a technical background to staff their help desk during the implementation phase.
To access guide: Tech Care 

Digital Rights Weekly is a week-based update on Digital Rights and ICT issues, that happened throughout the week, compiled and analyzed from the digital rights perspective by Digital Rights Nepal (DRN). DRN is a not-for-profit initiative dedicated to the protection and promotion of digital rights, including the right to online freedom of expression and association, online privacy, access to information, and related issues such as internet governance, cyber laws/policies, and cyber securities in Nepal.