BENGALURU: Who could have inserted UIDAI’s toll-free number on phones across India? Technologically, it is possible for any of three sets of entities to do — telecom service providers, mobile manufacturers and operating system (OS) providers like Google and Apple.

“Google had done this earlier globally, but reversed it when it faced flak,” Vinod Senthil, CEO of network security audit & management firm Infysec, said. In February 2010, when Google launched social networking tool Google Buzz, the latter automatically started following people who the user was most frequently in touch with on email or chat. And it made this list public. “So it is possible for Google or Apple to enable the UIDAI number (through Android/iOS),” Senthil said.

But in the UIDAI case, he does not think Google would have done it. He said Google would be very careful about such matters, especially after the enforcement of the European Union’s General Data Protection Regulation (GDPR), which requires explicit user permissions before any such action. Unless there are government orders or local laws applicable for inclusion of the same.

Senthil thought it was more likely that Indian telecom providers added it. “They can do it through the unstructured supplementary service data (USSD),” he said. USSD is a communication technology that is used to send text between a mobile phone and an application program in the network. USSD is what service providers like Reliance Jio, Airtel and Vodafone would use when they want to keep their customer care numbers, fire or distress numbers as default on your phone.

Security researchers such as Robert Baptiste aka Elliot Alderson and Anivar Aravind have tweeted that the number could have been included by mobile makers as a default factory setting. This was first highlighted by Aravind in November 2017. He told TOI, “I was puzzled when I first spotted this in Samsung , Xiaomi and Micromax mobiles. I wondered if it was the SIM (meaning involvement of telecom service provider). So I removed the SIM, did a factory reset on my phone and turned off the Wi-Fi . And still the UIDAI number popped up. I tested it again on my friend’s phone similarly. Again, the UIDAI number was there.”

A person on Twitter said on Friday that she unboxed three brand new devices from different hardware makers and found the UIDAI number pre-installed.

When contacted, an executive at a mobile manufacturer said that they had received a government order to pre-save only the distress number 112.

In short, the issue remains a mystery.

