\n
\n
The health ministry has clarified that reports of alleged CoWIN portal breach, stating that personal information, including Aadhaar and passport details, phone number, date of birth and gender, was available on a Telegram (online messenger application) bot for a brief period of time, are \u201cwithout any basis and mischievous in nature”.<\/p>\n
\u201cThe Co-WIN portal of Health Ministry is completely safe with adequate safeguards for data privacy. Furthermore, security measures are in place on Co-WIN portal, with Web Application Firewall, Anti-DDoS, SSL\/TLS, regular vulnerability assessment, Identity & Access Management etc. Only OTP authentication-based access of data is provided. All steps have been taken and are being taken to ensure security of the data in the CoWIN portal,” the ministry said.<\/p>\n
COWIN was developed and is owned and managed by the Ministry of Health and Family Welfare (MoHFW) and is a repository of all data of beneficiaries who have been vaccinated against Covid-19. An Empowered Group on Vaccine Administration (EGVAC) was formed for steering the development of COWIN and for deciding on policy issues. Former CEO National Health Authority (NHA) chaired EGVAC which also included members from MoHFW and Ministry of Electronics and Information Technology (MeitY).<\/p>\n
<\/p>\nThe ministry explained that Co-WIN data access is available at three levels:<\/strong><\/em><\/p>\n\n- Beneficiary dashboard:<\/strong> The person who has been vaccinated can access the CoWIN data through the use of registered mobile number with OTP authentication.<\/li>\n
- Co-WIN authorised user:<\/strong> The vaccinator, with the use of authentic login credential provided, can access personal level data of vaccinated beneficiaries. But the COWIN system tracks and keeps record of each time an authorised user accesses the COWIN system.<\/li>\n
- API-based access:<\/strong> The third party applications who have been provided authorised access of CoWIN APIs can access personal level data of vaccinated beneficiaries only through beneficiary OTP authentication.<\/li>\n<\/ol>\n
<\/span>Ministry on Telegram\u00a0Bot<\/span><\/h4>\n\n- Without OTP, vaccinated beneficiaries\u2019 data cannot be shared<\/strong> to any bot.<\/li>\n
- Only the Year of Birth (YOB) is captured for adult vaccination<\/strong>, but media posts claim that the bot also\u00a0mentioned the Date of Birth (DOB).<\/li>\n
- There is no provision to capture the address<\/strong> of the beneficiary.<\/li>\n<\/ul>\n
\n
![\"The](\"https:\/\/images.news18.com\/ibnlive\/uploads\/2021\/07\/1627283897_news18_logo-1200x800.jpg?impolicy=website&width=510&height=356\" "\\"The"){kind=logo}
<\/figure>\n