TRAI Exposes 107,776 Citizen Emails in Net Neutrality Campaign Publication
What Happened – In April 2015 the Telecom Regulatory Authority of India (TRAI) published a dataset containing 107,776 email addresses, sender names, and full message bodies that had been collected from Indian citizens participating in the “SaveTheInternet” net‑neutrality campaign. The data were made publicly accessible without proper redaction or access controls.
Why It Matters for Trust & Control Assurance
- Uncontrolled data releases breach the “protect data in transit and at rest” control objective, a requirement that maps to dozens of frameworks (e.g., NIST CSF, ISO 27001, GDPR).
- Continuous control‑assurance programs would flag missing data‑handling policies, enforce least‑privilege access, and retain evidence that releases are authorized.
- Demonstrable audit evidence of data‑release governance helps regulators and auditors verify that the organization meets its privacy and disclosure obligations.
Who Is Affected – Telecom regulators, Indian citizens whose email communications were disclosed, and any downstream entities that rely on TRAI‑issued guidance.
Recommended Actions
- Conduct a data‑handling policy review and classify email communications as sensitive personal data.
- Implement strict access‑control lists and approval workflows for any public data release.
- Capture and retain evidence of release authorizations in a centralized Trust Center for audit readiness. Source: Have I Been Pwned – TRAI breach
Technical Notes – The exposure resulted from a misconfiguration / human‑error during a public‑facing publication. No vulnerability (CVE) was exploited. Exposed data: email addresses, sender names, full email messages. Source: same as above