Vehicle data shared only in masked form: ULIP
NEW DELHI After the Road Ministry sought an audit of users accessing the Centre’s logistics portal following complaints that multiple apps and websites were selling vehicle information, the Unified Logistics Interface Platform (ULIP) rejected the allegations of its misuse. It said all data were masked and called for broader scrutiny of the platforms involved. “ULIP relays information in the format received from the source API.
For example, vehicle owner names, chassis and engine numbers retain their masking, and the mobile number field remains null in both the source response and the response provided to users. ULIP does not independently generate, unmask or enrich the underlying data,” ULIP wrote in response to a story in The Hindu. Road Ministry seeks forensic audit of its portals after vehicle data leak Road Ministry seeks forensic audit of its portals after vehicle data leak A senior Ministry official says they have sought the intervention of the Ministry of Electronics and Information Technology to review its data-sharing policy and suggest ways to strengthen it Road Ministry seeks forensic audit of its portals after vehicle data leak storyline 1 The Road Ministry sought an audit after finding that some entities were extracting data in large volumes from ULIP with some as many pulling out as many as 50 lakh records a month.
The Road Ministry shares vehicle information with multiple government agencies and private firms from its portals such as VAHAN, SARATHI, e-Challan and PUCC portals. Sufficient safeguards ULIP says it uses sufficient safeguards that include screening of entities that have access to its portal, their proposed use cases, binding terms and conditions, IP whitelisting, phased onboarding and continuous monitoring of API usage.
This framework complies with the Road Ministry’s Policy for Data Sharing from the National Transport Repository, which prescribes authentication, secret keys, masking of personally identifiable information (PII) and defined approval mechanisms, ULIP added. Referring to multiple apps selling vehicle information data in unmasked form, ULIP said there needed to be a “scrutiny of wider ecosystem of platforms and channels through which such information is being made available”.
The Road Ministry has written to the government’s nodal agency for investigating cybersecurity incidents, Indian Computer Emergency Response Team (CERT-In), seeking a forensic audit of VAHAN, SARATHI, e-Challan and PUCC portals, which hold a range of vehicle-owner information. It has also sought the intervention of the Ministry of Electronics and Information and Technology (MEITY) for a review of its data sharing policy and suggest ways to strengthen it.
The Road Ministry also plans to audit various enforcement agencies that access its portals for data. The Ministry’s action follows reports that apps and websites were selling vehicle-linked personal data for as little as ₹5. A Cyderes investigation found that a Telegram-based broker could retrieve an owner’s name, contact details, addresses and other records from a vehicle registration number, along with driving licence, challan, FASTag and registration certificate information.
The Ministry has asked major app-store operators, including Google, to remove such apps.
