India's Ministry of Road Transport and Highways has initiated a forensic security audit of its vehicle data portals following reports of data leaks. The audit, to be conducted by the Indian Computer Emergency Response Team (CERT-In), will cover the VAHAN, SARATHI, e-Challan, and PUCC portals, which store sensitive vehicle-owner information.
Concerns arose after investigations revealed that vehicle data was being sold on various apps and websites for as little as ₹5. A Telegram-based channel was found to be offering extensive personal data, including names, addresses, and mobile numbers, upon receiving a vehicle registration number. Popular apps like Vehicle Information App and VehicleSetu were identified as platforms where such data was accessible.
The Ministry has reached out to major app store operators, including Google, to remove these apps. Additionally, it has sought the expertise of the Ministry of Electronics and Information Technology (MeitY) to review and bolster its data-sharing policy. This policy currently allows government bodies to access comprehensive data from the National Transport Repository, while private entities have limited access.
Data sharing is facilitated through application programming interfaces (APIs), with security measures like secret keys, two-factor authentication, and Aadhaar-authenticated one-time passwords (OTPs) in place. However, personally identifiable information (PII) is masked for all but law-enforcement and security agencies.
Through a Right to Information (RTI) request, the Internet Freedom Foundation (IFF) discovered that 25,314 credentials had been issued to private entities, enabling them to access the data portals. Over 1.708 crore queries were made in 33 months, raising concerns about potential misuse.
A preliminary investigation highlighted possible data misuse involving the Indian government's Unified Logistics Interface Platform (ULIP), managed by the National Industrial Corridor Development Corporation (NICDC). The Road Ministry has asked the National Informatics Centre (NIC) to audit access and usage patterns to ensure compliance with approved purposes and terms.
The Ministry is also scrutinizing the process of granting access to entities, including the due diligence performed and criteria used to determine eligibility. Officials suspect that some actors may be triangulating data from different sources to compile comprehensive profiles.
In response to a representation from the IFF, the Ministry has tightened technical controls and restricted data sharing for ULIP. Now, government agencies must obtain approval from the Transport Secretary for data requests, and officers must be verified through Aadhaar-based digital signature certificates or video KYC.
Despite these measures, the Ministry has ruled out suspending data sharing with private entities, citing the necessity to support ease of doing business and living. This decision underscores the delicate balance between data security and accessibility in India's digital landscape.
