NEW DELHI – The Unique Identification Authority of Indialink> (UIDAI), which runsthe world’s largest biometric identity card scheme, has initiated a policeprobe into a major security breach.

The probe was ordered on Thursday after the local Tribune newspaper accessedlink>adatabase containing the identity details of more than one billion citizens,which was being sold for a meagre $8, the report claimed. An anonymousseller over WhatsApp created a “gateway” for one of the newspaper’scorrespondents to gain access to the database, after which anyidentification number, referred to as Aadhaar, could be entered and theperson’s name, address, photo, phone number and email displayed.

On Thursday, the UIDAI said the breach appeared to have been caused by the”misuse” of a grievance-redressal search facility that can be accessed bythe public.

“The Aadhaar data, including biometric information, is fully safe,” theauthority said in a statement.

But Kiran Jonnalagadda, cofounder of the Internet Freedom Foundation, saidthe incident revealed a serious problem with data security. The breachinvolved the use of a backdoor created by the UIDAI for the use ofauthorised parties, a definition encompassing thousands of governmentofficials, he said.

“These officials were allowed to appoint other officials with the right toaccess data. It’s no wonder someone down the chain went rogue and startedselling access,” Jonnalagadda told Al Jazeera.Growing privacy risks

Activists have warned of increasing security and privacy risks associatedwith the ambitious Aadhaar project and its linking with government andprivate services, including banking and telephone accounts.

Security protocols were clearly violated, said Pranesh Prakash, policydirector at Centre for Internet and Society.

“This incident shows that those who have legitimate access to the Aadhaardatabase have been involved in providing illegitimate access to it bycreating accounts for others, like the journalist for instance. The entireAadhaar ecosystem is leaking like a sieve,” Prakash told Al Jazeera.

The ruling Bharatiya Janata Party (BJP), meanwhile, dismissed the Tribunereport as “fake news”.