Report of the investigation into the UK visa breach

The results of the two-month independent investigation into security breaches of the UK visa application process from India, Nigeria and Russia were published towards the end of July.

The full report is available here (currently archived, see Update below). There were also articles by The Register and The Observer in the UK media that covered the publication of this report. In India, there was no media coverage that I am aware of.

The excellent and very comprehensive report speaks for itself, and I would recommend it as good holiday reading if you're a fan of non-fictional tragic comedies spanning multiple continents. Thats probably exactly what the UK Members of Parliament did, taking a copy of the report with them as they broke off for a 11 week summer recess shortly after it was presented in Parliament.

In the limited time provided, I thought that the appointed Independent Investigator prepared quite a detailed and thorough report. The only striking omission I noticed was any plausible explanation as to why this breach wasn't reported by more applicants considering that this website had such fundamental flaws and left vulnerable for such a long duration of time. A little research into the Indian psyche, perhaps by way of interviews with applicants would have shown that no right thinking, progressive, frequent-flying, peace-loving Indian would ever want to bite the hand that stamps their visa.

I even know individuals in India who would consider themselves famous if their personal details were exposed online! Such is the scale of ignorance towards identity abuse here.

Update: The link for the full report isn't available on the FCO website any longer and claims to be moved to the 'National Archive' if you click it. I've still retained the above link though, to show that the National Archive seems to have misplaced its copy of the report too. Hmmm. However, it can still be found here.

Old lady of Indian skies

Responding to the recent Indian Airlines (IA) strike, the civil aviation ministry said in a statement that "The strike will cause distress to a large number of passengers, apart form being detrimental to the financial condition and image of the company''

Oh, really? I hadn't thought of that.

Upon hearing of this strike by IA (now renamed 'Indian'), one can't help but immediately visualize sari-clad distressed stewardesses with brightly painted lips comfortably seated in the airport halls with tiffin-boxes by their side, and sharing tales of their grandchildren, occasionally waving a little white banner of protest. In this case, it seems cabin baggage handlers and ground support staff didn't show up for work at all.

In a way, the strike might benefit a greater number of people, and I fully support the protesters, despite the fact the Delhi High Court termed it illegal - Instead of dying the uncertain, slow, painful death that this airline seemed to be destined for, the protesters efforts will erode their already dwindling market share much more quicker, and ensure a natural, faster and final end to this winged misery. In effect, bringing relief to a lot of would-be passengers, spared from IA's renowned service-with-a-grunt and general inefficiency.

This is also a much better way of going, than by being blamed for any major air-disaster as a direct result of having budgeted more on flawed PR strategies, than on critical airline safety measures. Lets hope recent incidents such as these, aren't indicative of this trend.

Too bad that they happen to be our national airlines though.

Source: Strike a windfall for low-cost carriers, Times of India

VFS plugs security hole

This is an update to my earlier posting on the VFS security breach on the 10th of May.

I am pleased to write that this security breach on the VFS UK India website has now been rectified, thanks to the timely action taken by Davey Winder, and the co-operation of the VFS India IT department. He has published an article on this yesterday which describes the sequence of events that led to the resolution of this serious issue.

Having run out of avenues to turn to in an attempt to get someone to take notice, Davey Winder was my obvious last resort. I am quite thankful to Davey for approaching this in a very responsible and proactive way, and for his genuine concern and understanding about the implications this could possibly have.

At the moment, I can only reveal that I am in touch with UK government officials to aid in their investigations so that such breaches are not repeated in the future.

Update 17 th May: Statement by Lord Triesman, UK Secretary of State, Foreign & Commonwealth Office. Announces an independent government investigation into this breach.

Update 14th August: Results of the investgation are out. More details on this post.

Identity Leakage: Trust VFS to reveal all

The Visa Facilitation Services (VFS) in India have over the years greatly simplified any need to escape the motherland. If you're privileged enough to possess appropriately valid and verified documents, be it travel for holiday, human trafficking, business, family reunion or work, the VFS in India will see to it that you needn't do the worrying nor have to stand in long queues overnight wondering whether you've filled in that visa form correctly. According to recent reports I've been hearing, those days are almost gone.

On the VFS UK India website, you can nowadays apply online for most United Kingdom (UK) visa categories, as part of their Business Express Program and track your application too. VFS India are the British High Commission's commercial partner, and they operate application centres on behalf of the 4 visa departments in India.They have about 11 offices across Indian cities.

Last year, while I was directed to this VFS website due to an UK assignment, I stumbled upon a technical problem. After entering all my details on the online visa application form, I couldn't proceed further. All I had was this blank browser page on my computer monitor, and a 'Back' button that refused to do what it was designed to do.

Having spent a good hour typing in my details, I decided to twiddle around with the URL in my browser to see if something could be salvaged. About two minutes of twiddling with the VFS Uniform Resource Locator (URL) resulted in the following revelation: Anyone who has ever applied for a UK visa online, have their personal details exposed to everyone on the Internet. Personal details such as passport number, address, phone numbers, email, family details, work details, salary, clients, real-estate owned, countries you've visited, where you're going and when you're travelling...the list goes on. Essentially, the entire form, i.e. everything the British High Commission needs to know about you to grant you a visa is available for anyone to misuse. Security is thrown out the window.

This was naturally quite shocking. I quickly verified that what I was seeing was true: that VFS India could be responsible for large scale identity theft, for every online visa application that it receives. I sent an email to both VFS India and the British High Commission explaining this serious security issue. After about two months, I heard back from the British High Commission thanking me for the email bringing this to their notice, and promising to look into this matter. A year later nothing has happened. And this is in spite of the fact that identity theft in the UK is treated quite seriously and there is a parliamentary act that protects such information.

Identity theft occurs when a criminal uses another person's personal information to take on that person's identity. Identity theft in any form has serious consequences, and our law-makers in India should take a tougher stance. From a Wikipedia entry on Identity Theft, "The crimes include illegal immigration, terrorism and espionage, to mention a few. It may also be a means of blackmail if activities undertaken by the thief in the name of the victim would have serious consequences for the victim".

Terms & Conditions on the VFS UK India website state that "Under the Data Protection Act, we have a legal duty to protect any information we collect from you". And they go on to say "VFS shall not disclose or allow access to any personal data provided by the Foreign & Commonwealth Office or acquired by VFS during the execution of the contract, other than to VFS personnel or those otherwise lawfully concerned with the execution of the contract".

Doesn't look like that to me. Whoever VFS India uses to design their website has some serious answering to do, and heads will surely roll. I'm not sure whether this security hole is visible in the United States VFS site or any other country's visa processing that VFS India handle.

In any case, I don't think I want to pay VFS for their services and then be exposed to this gaping security hole.

Excuse me while I try to find the end of this queue.

Update: Problem "sol-ved", as they say here in Bangalore! Check this post. This posting was also the basis of a Channel 4 television news report in the UK on the 17th of May, just a week after publishing on this blog.