A panchayat helpdesk website exposing Aadhaar before an official visit
A student team at a government senior secondary school in Patiala builds a panchayat helpdesk website on free hosting for a community IT/ITeS project. The form collects name, mobile number, Aadhaar number, and address, and writes entries to a public Google Sheets link. The site is served over HTTP; the hosting dashboard shows a 'mixed content' warning because the banner loads over HTTPS but the form posts to HTTP. In three weeks, 200 residents have submitted complaints, including 12 containing copies of land records. The team plans to display a public dashboard of complaints with names and Aadhaar numbers to show transparency before a district officer's visit. A local journalist asks for the data. The teacher-coordinator must decide what to publish, what to fix before the visit, and how to handle the collected data.
1. Assess the three highest risks in the current setup, ranking them by likelihood and impact. Include the public Sheets link, HTTP form, and planned dashboard.
Read the worked answer
Highest risk: the public Google Sheets link. It likely exposes names, mobile numbers, Aadhaar numbers and 12 land-record copies to anyone with the URL, and search engines may index it. Aadhaar is sensitive identity data; exposure can enable impersonation and is a serious privacy breach. Likelihood is high because the link has already been shared with the team and possibly residents. Second: the HTTP form. Data travels unencrypted, so anyone on the same network or Wi-Fi can read or alter submissions; the mixed-content warning also trains residents to ignore browser warnings. Impact is high but exploitation requires proximity or a compromised network. Third: the planned public dashboard with names and Aadhaar. Even if the form is fixed, publishing Aadhaar would create a new permanent exposure and would be disproportionate to the transparency aim. The journalist's request is a risk amplifier: sharing the raw data would be a secondary disclosure. The 12 land records add property-fraud risk.
2. Give an immediate remediation plan for the next 72 hours that keeps the helpdesk usable for residents and prepares for the district officer's visit. Include what to do with the 200 existing entries and the journalist's request.
Read the worked answer
Within 72 hours: (1) Take the public Sheet private immediately, revoke the 'anyone with link' sharing, and export a copy to an encrypted local folder held by the teacher-coordinator. Do not delete the original until the copy is verified. (2) Replace the form's Aadhaar field with an optional token number; stop accepting land-record uploads; add a clear purpose and consent notice. (3) Move the form to HTTPS - most free hosts provide a free TLS certificate - and change the form action to HTTPS so the mixed-content warning disappears. (4) For the dashboard, publish only aggregate counts by complaint category and ward, with no names, mobile numbers or Aadhaar. (5) For the journalist, do not release raw data. Offer the aggregate dashboard and, if a specific case is needed, obtain the resident's written consent and redact identifiers. (6) Check access logs for the Sheet; if it was public and indexed, treat it as a suspected breach, inform the principal and the panchayat, and follow the school's escalation route. Keep the helpdesk usable by posting a notice and a phone number.
3. Redesign the data collection and publication model to meet the principles of purpose limitation, data minimisation, and consent. Specify fields, hosting, access control, and retention.
Read the worked answer
Redesign around data minimisation. Collect a system-generated complaint token, complaint category, ward, date, a short description, and an optional mobile number for callback. Do not collect Aadhaar unless a law or scheme specifically requires it; if identity verification is needed, use a masked reference or verify in person and store only a verification flag. Make name optional and never publish it. Host the form and database on an HTTPS service with individual logins; give the panchayat clerk write access, the teacher read-only access, and no public access. Keep a separate public dashboard generated from aggregate queries, not from the raw table. Add a consent checkbox that states purpose, retention period and who can see the data. Retain open complaints for 90 days after closure, then delete; keep only anonymised counts. Restrict land-record uploads to a secure, access-controlled folder if legally required, with a retention rule. Nominate a grievance contact. This meets purpose limitation, minimisation and consent while preserving transparency.