Researcher: Smriti Ranabhat

Editor: Nuva Rai

Growing Risks to Personal Data Protection

September witnessed a series of data privacy incidents which affected public institutions, political parties, and the banking sector. A group calling itself Erebus (3r3bu5) claimed to have stolen personal records from a government portal and offered the data for sale on a dark web forum. Similarly, a security researcher reported that members’ login credentials of the Rastriya Swatantra Party had been exposed online. Meanwhile, an unsecured Application Programming Interface in the Mero Kitta portal of the Survey Department reportedly allowed access to citizens’ personal and land ownership records without authentication. In the financial sector, more than 7,500 customer credentials linked to 17 commercial banks were reported to have surfaced on dark web forums.

Furthermore, the Election Commission’s publicly accessible voter database allows anyone to search the personal information of more than 18.9 million registered voters, including names, addresses, family details and voter identification numbers. As per civil society organisations, unrestricted access may violate the fundamental right to privacy.

A common pattern across these incidents is that many appear to result from security weaknesses, including inadequate access controls, unsecured API, and weak authentication practices. When sensitive identifiers such as citizenship numbers, voter IDs, and land ownership records are exposed, identity theft, fraud, and harassment may continue for years. These repeated incidents signal the need for stronger cybersecurity standards, timely breach notification mechanisms, institutional accountability and a comprehensive data protection framework.

Cyber Laws and the Boundaries of Political Expression

When criticism of those in power moves from public debate into the digital space, the use of cyber laws raises important questions about the boundaries between legitimate regulation and restrictions on freedom of expression. Nepal Police arrested political analyst Bharat Dahal from Morang following a warrant issued by the Cyber Bureau. He was arrested for a controversial interview that circulated online, leading to questions about whether political criticism and dissent were being considered cyber crimes. The Supreme Court later ordered Dahal’s release following a habeas corpus petition filed by his daughter. Similar issues also drew attention in Parliament where opposition lawmaker Sita Thapaliya urged the government not to misuse cyber laws against critics. She noted that while freedom of expression does not protect the spread of false information, democratic governance requires space for public criticism and accountability. These repeated actions from power show the need for authorities to apply cyber laws carefully and consistently, ensuring that they address genuine harm and unlawful conduct without limiting legitimate criticism, public debate and freedom of expression.

Misinformation, Disinformation and Ethical Responsibility During Disaster

The Bhotekoshi massive flood created a parallel information crisis with false and misleading content spreading rapidly on social media while affected families were searching for reliable updates. In this context, people face a growing challenge of managing misinformation during emergencies when inaccurate information can cause harm, create panic, and deepen distress among affected communities.

Nepal Fact Check found that a video which claimed to show a 3 years old child rescued after 50 hours was unrelated to the flood and actually showed a previous incident in Nawalparasi East. Similarly, a video presented as footage from the Rasuwa flood was traced to a cloudburst in Chamoli, Uttarakhand. Another claim that 24 people had been rescued from the Chilime Hydropower Project tunnel was also found to be false, with officials confirming that only a smaller number of people were trapped. Such misinformation created false expectations for families awaiting news about their loved ones. 

In this context, several institutions took steps to address the spread of misleading content. The Cyber Bureau formed a technical team to monitor harmful content, identify misleading videos, and request removals from social media platforms. The Press Council Nepal also reviewed disaster-related content and found violations involving graphic images of victims, recycled footage presented as current and misleading AI-generated material. It issued guidance reminding media organisations to verify information, protect the dignity and privacy of affected individuals and follow ethical reporting practices. The response to the flood-related misinformation shows progress in fact-checking and institutional coordination but important challenges remain. Platform cooperation, transparent content moderation processes and clear boundaries for legal action are necessary.

When Trust Becomes the Trap for Scams

Scammers exploited the urgency surrounding the Bhotekoshi flood, the reputation of trusted brands, and the promise of quick financial returns to target people through fake donation campaigns, fraudulent digital services and investment schemes. Following the flood, Krishna KC was arrested for allegedly collecting donations through a personal QR code. Meanwhile, scammers used the public interest around the floods to promote fake free satellite internet offers. Victims were directed to download Android applications disguised as official SpaceX software which installed malware capable of monitoring devices and stealing sensitive information. 

Nepal Clearing House Limited warned users that it does not request such information through SMS links after a phishing website imitating ConnectIPS attempted to collect usernames, passwords, and OTP codes. Separately, thousands of individuals lost money through the BV Nepal scheme, a fraudulent investment platform that attracted users with early returns before blocking withdrawals and demanding additional payments. 

In all of these episodes, scammers build trust through urgent situations or attractive financial promises before seeking money or sensitive information. The increasing use of AI-generated advertisements and impersonation tactics makes such scams harder to identify while responsibility for prevention often remains concentrated on individual users. Platforms, financial institutions, and telecom providers are better positioned to detect and prevent such harms through stronger monitoring and rapid response mechanisms. 

Digital Safety: Abuse, Hate and the Space for Empathy Online

Online platforms continue to reflect wider social tensions with individuals facing harassment during moments of grief, public debate and identity-based discussions. Following the Bhotekoshi floods, a woman seeking help to locate her missing husband reportedly faced online harassment and victim-blaming instead of support. The incident drew attention to broader concerns about the lack of empathy and accountability in online interactions, particularly when individuals are vulnerable. 

The Cyber Bureau arrested a man following a technical investigation for allegedly posting discriminatory content targeting ethnic communities and expressing support for the destruction caused by the floods. He is being investigated under the Electronic Transactions Act, 2006 for content alleged to undermine social harmony and tolerance. During a UN meeting marking the 25th anniversary of the Durban Declaration and Programme of Action, Foreign Minister Shishir Khanal raised concerns about algorithmic bias and hate speech in artificial intelligence systems, and called for stronger anti-discrimination measures and international cooperation. While addressing hate speech and discriminatory content remains important, responses must also ensure that legal measures are applied with clear definitions and proportionality.

When Intimate Images Become a Weapon

Technology is increasingly being used as a tool for intimate partner abuse, sexual exploitation and harassment with private images, manipulated content, and fake identities used to threaten, shame, and control women and girls. For example, a man in Kathmandu was arrested for allegedly extorting NPR 995,000 from a woman after posing as a hacker and threatening to release her private photos and videos. In another case, a  man was charged with using a woman’s Facebook photo to create explicit content and sharing it through Facebook and Telegram, causing reputational harm and emotional distress. Furthermore, a female health worker was harassed through a fake female profile that sent explicit messages and attempted to obtain intimate images in exchange for money. Similarly, a 17-year-old girl was allegedly subjected to repeated sexual violence and coercion after meeting the accused through Facebook under the promise of marriage. The accused was arrested in Oman through an Interpol Red Notice and brought back to Nepal. 

These cases show that online abuse often begins with the exploitation of trust and can result in long-term harm to a victim’s privacy, dignity, and safety. While law enforcement agencies have taken action in several cases, access to justice often depends on victims reporting abuse and navigating complex legal processes. Stronger survivor-centred responses including rapid content removal, protection of privacy during proceedings, effective remedies, and greater awareness about reporting and evidence preservation are essential to ensure that victims can seek justice safely.

Digital Governance and Regulatory Developments

Nepal is continuing to expand its digital governance initiatives with recent reforms focused on improving transparency, access to public services, and institutional efficiency. However, these developments also raise important questions about whether security, privacy, and accountability measures are keeping pace with rapid digitalisation. The Supreme Court introduced the Live Streaming of Court Hearings (Management and Operation) Directive, 2083 to make judicial proceedings more accessible to the public while protecting sensitive cases involving sexual offences, children, family disputes, medical privacy, and witness protection. Parliament also began testing a Digital Parliament Platform to provide digital access to legislative documents, records, and meetings, including the use of AI tools for document search and summaries. Similarly, the draft National Enterprise Architecture (NEA) Framework proposes a once-only principle, allowing government agencies to reuse verified information instead of repeatedly asking citizens to provide the same details.

At the same time, recent incidents show that our digital systems continue to face security challenges. The Electronic Government Procurement system was suspended for nearly 20 days following repeated cyberattacks. It forced bidders to temporarily submit documents through alternative channels. In the financial sector, Nepal Rastra Bank’s Risk Management Guideline, 2026, has introduced stronger expectations for cybersecurity, digital fraud prevention, and responsible use of emerging technologies.

These developments show that digital transformation in Nepal is moving forward but public trust depends on how effectively risks are managed. Initiatives involving data sharing and AI can improve efficiency but they also require clear rules on who can access information, how it can be used, and who is responsible when systems fail.

 

 

References: