One for the Record Books

India’s birth and death registrations compromised, fake entries corrupt official database for Rs 200

26 July 2021
For at least two years, the login details of birth-and-death registrars have been compromised, which are being used to generate fraudulent certificates that are formally recorded in the official, national database of births and deaths.
ILLUSTRATION BY SHAGNIK CHAKRABORTY
For at least two years, the login details of birth-and-death registrars have been compromised, which are being used to generate fraudulent certificates that are formally recorded in the official, national database of births and deaths.
ILLUSTRATION BY SHAGNIK CHAKRABORTY

The digital database of the Civil Registration System, or CRS, of India, the most comprehensive records of the Indian population that includes district-wise birth-and death-registration certificates, has been compromised for the last two years at least. A four-month long investigation by The Caravan revealed that the official login IDs of a large number of registrars across India, which is being used to generate birth and death certificates online, are up for sale for just Rs 1,800. The registrars’ login details are being sold to the vast network of over four lakh Village Level Entrepreneurs—the workforce implementing various Digital India schemes at the grassroots level, under the Common Service Centre network of the ministry of electronics and information technology. The VLEs, in turn, are using them to generate certificates at just Rs 200–250 per customer.

The Caravan has observed the working of this operation, including the messages shared by the VLEs and videos of the process through which the certificates are generated. The VLEs ask their online customers to fill in a form with personal details that need to be entered in the certificate, and within five minutes, a certificate is produced using a registrar’s login details. While the official process requires applicants to provide documentary proof in support of the details to be entered into the certificates, the VLEs creating these certificates have no such requirement. The certificate produced is then shared with the customer online as a PDF file.

The authenticity of these fraudulently produced certificates is evidenced by the fact that a QR code on the certificates, when scanned, directs the reader to the entry of the certificate on the CRS’s official website, crsorgi.gov.in. The only discernible way to distinguish the genuine certificates from the fraudulent ones appears to be that the registrars mentioned in the fake certificates are identified as officers of a different district in the same state than the area of the birth or death concerned.

Rachna Khaira is an award-winning investigative journalist based in Delhi. She specialises in issues of privacy and technology.

Keywords: National Population Register Data Breach Punjab National Register of Citizens Assam
COMMENT