At about 1 am on 24th March 2018, a cybersecurity expert who uses the moniker ‘Elliot Anderson‘ made a shocking revelation:
When you create a profile in the official @narendramodi #Android app, all your device info (OS, network type, Carrier …) and personal data (email, photo, gender, name, …) are send without your consent to a third-party domain called https://t.co/N3zA3QeNZO. pic.twitter.com/Vey3OP6hcf
— Elliot Alderson (@fs0c131y) March 23, 2018
He found out that a company named CleverTap owns the website where this data is being sent. CleverTap had tried to be clever and ‘mask’ or hide their ownership of this website, but Anderson found it anyway.
After a quick search, this domain belongs to an American company called @CleverTap. According to their description, “#CleverTap is the next generation app engagement platform. It enables marketers to identify, engage and retain users and provides developers” pic.twitter.com/Ikqp9GbCDm
— Elliot Alderson (@fs0c131y) March 23, 2018
Even more clever were some Twitter users who pointed out that the founder of CleverTap is closely associated with Narendra Modi. It seems like Modi ‘personally invited’ him on an official letterhead to be a part of the Swacch Bharat’ .’cause’.
Clevertap, founded by @helloanand collecting unauthorized personal data from NaMo Android app, appears to be associated with our PM for sometime now. Our PM had written an official letter inviting him for #CleanIndia initiative ???? pic.twitter.com/aiSxf44gxo
— shashi thammaiah (@shashitham) March 25, 2018
I could fit these 6 tweets only in this image. pic.twitter.com/amvPOfG1Tz
— Saurabh Sawant (@CandidlySaurabh) March 24, 2018
Intriguingly, these tweets seem to have been deleted by Anand Jain now.
Anderson shared an interaction he had with the ‘Namo App’ team.
One minute after my post on @narendramodi‘s #android app, the “App team” created a new Twitter profile to discuss with me. We had a nice discussion. In order to be fair, here their first answer. pic.twitter.com/4JbdoSefpt
— Elliot Alderson (@fs0c131y) March 24, 2018
While at first glance the explanation provided by the app team seems fair enough, a deeper enquiry reveals otherwise.
First, the Namo App claims that they use CleverTap only as an analytical tool just like ‘GA’ which presumably is Google Analytics. As pointed out to us by Kiran Jonnalagadda (Co-Founder, Internet Freedom Foundation) Google Analytics explicitly forbids the collection of any personally identifiable information.
On the other hand, CleverTap seems to be happy to collect personally identifiable information.
Secondly, as pointed out by Anderson himself, nothing justifies the fact that the app did not seek consent from users before sending data to third parties. Anderson also pointed out that this conduct is in violation of European Laws.
In a tweet, Rahul Gandhi severely criticised Narendra Modi and accused the mainstream media for burying the story.
Hi! My name is Narendra Modi. I am India’s Prime Minister. When you sign up for my official App, I give all your data to my friends in American companies.
Ps. Thanks mainstream media, you’re doing a great job of burying this critical story, as always.https://t.co/IZYzkuH1ZH
— Rahul Gandhi (@RahulGandhi) March 25, 2018