Alderson points out Covid privacy issues on Surat, Vadodara municipal websites

NEW DELHI: At least two municipal corporations in Gujarat - Surat and Vadodara - have published a list of people who tested positive for Covid-19 on their websites. French hacker, who goes by the pseudonym Elliot Alderson on Twitter, pointed out the breach of privacy while sharing screenshots of these lists.
The Surat municipal corporation has listed 943 such names, along with their addresses, which is marked out on a map. The list, divided into three categories - active (red dots), cured/discharged (blue dots) and death (black dots), is easily accessible to anyone with an internet connection.
"Hi @MySuratMySMC, Even sick or dead, people deserve privacy. Publish the personal data of #Covid19 patients on a governmental website and so violate medical confidentiality seems to be the new normal in India... Regards," Alderson wrote around 4pm, while sharing a picture, which had redacted the details of the individuals. When TOI checked the list around 8pm, it was still available on the corporation's website.
When asked about privacy of the patients whose name are being published on Surat Municipal Corporation (SMC)'s website, Surat municipal commissioner Banchhanidhi Pani said that during a pandemic, “public health is more important than individual privacy as it is being done to protect people from coming into contact with infected persons.”
The Vadodara corporation's list, comprising 638 names, is even more exhaustive, but follows a similar pattern. The homepage of the website has an option called "Corona Corner", which leads users to a map of the city. It uses red dots on the map for "active case", green for patients recovered and black dots for the deaths registered in the city. The list includes personal data like a person's name, address, age, gender and the date of result of their tests.
Earlier, Alderson had pointed out a similar breach by the Madhya Pradesh government, where a "dashboard" was published online along with the name of quarantined people, their GPS coordinates and their mobile device ID. The state government later took down the list.
(With inputs from Vijaysinh Parmar)