CBFC data leak: Sensitive documents of over 500 films exposed
What's the story
A major data breach has exposed the certification records of over 500 films at the Central Board of Film Certification (CBFC). The leaked documents include shooting scripts, cut orders, and distribution agreements. The incident raises serious concerns over the security of sensitive information in India's film industry. The CBFC is now investigating this breach and conducting a security audit.
Portal vulnerability
How the leak happened
The CBFC uses an online portal called e-Cinepramaan for its certification work.
Filmmakers submit their documents through this platform when applying for certification.
According to a report by The Hindu, the leaked documents were accessed through this very portal.
They remained accessible for days, even though many had been uploaded earlier and were later taken down.
Information exposure
What was leaked?
The leaked files were not the films themselves, but shooting scripts, cut orders and other documents submitted during the certification process.
These records were available for download via the Internet Archive, a non-profit digital library that preserves online content.
While these scripts and certification details don't reveal everything about a film's plot or production, they can still give away information filmmakers may not want publicly available before a film's release.
Agreement exposure
Distribution agreements for international films were also out
The data leak has implications beyond creative work.
Some exposed records included local distribution agreements for films like Brazilian Academy Award nominee The Secret Agent and Hollywood film Good Luck, Have Fun, Don't Die.
At least three agreements revealed fees paid for licensing films.
These contracts could contain commercially sensitive details such as revenue-sharing arrangements, intellectual property rights, promotional obligations, and conditions around a film's storyline or production.
Investigation underway
CBFC, Internet Archive respond to leak
The CBFC has said it is investigating the breach and conducting a security audit of the portal.
It reviewed information about the alleged unauthorized access but found no evidence of further access to documents claimed to have been exposed.
The Internet Archive confirmed that the account in question had been taken down, and a complaint was filed with cybercrime authorities.
Assurance given
Need for stronger cybersecurity measures
The CBFC assured that no individual filmmaker's account appeared to have been compromised while committing to a thorough security audit.
The investigation is still ongoing, and the full extent of the exposure remains unclear.
This incident highlights the need for stronger cybersecurity measures in protecting sensitive information within India's film industry.