Govt. orders security audit of key transport portals after reports of data being sold online, Pg12

Key Highlights:

• The Ministry of Road Transport and Highways (MoRTH) has directed the Indian Computer Emergency Response Team (CERT-In) to conduct a forensic security audit of key transport portals.
• The audit targets VAHAN, SARATHI, e-Challan, and PUCC portals, which store extensive vehicle-owner data.
• This action follows reports of personal vehicle information being sold online through various apps and websites for as little as ₹5.
• The MoRTH has requested major app store operators, including Google, to remove applications facilitating the sale of such data.
• The Ministry has also sought intervention from the Ministry of Electronics and Information Technology (MeitY) to review its data-sharing policy.

Detailed Insights:

• The compromised data included sensitive personal details such as the owner’s full name, father’s name, addresses, PIN code, mobile number, driving license details, challan history, and FASTag information.
• The data is consolidated in the National Transport Repository, a central MoRTH database that integrates records from VAHAN, SARATHI, e-Challans, eDARs, and FASTags.
• The existing data-sharing policy permits government bodies to access all data fields in compliance with the Digital Personal Data Protection Act, 2023.
• Private entities, however, are restricted to accessing only selected relevant data fields with a daily search limit.
• An investigation by the Internet Freedom Foundation (IFF) revealed that 25,314 credentials were issued to private entities, leading to 1.708 crore queries over 33 months.

Key Concepts Involved:

• Indian Computer Emergency Response Team (CERT-In): India's national agency for responding to cybersecurity incidents, operating under the Ministry of Electronics and Information Technology (MeitY).
• Ministry of Electronics and Information Technology (MeitY): The nodal ministry responsible for policy formulation, regulation, and strategic development in electronics, information technology, digital governance, and cybersecurity in India.
• Digital Personal Data Protection Act, 2023: A comprehensive law enacted to provide for the processing of digital personal data in a manner that recognizes both individual rights to data protection and the need for lawful data processing.
• VAHAN: A national database and integrated solution for vehicle registration, fitness, taxation, permits, and Pollution Under Control (PUC) certificates, managed by MoRTH.
• SARATHI: A national database for driving licenses and related services, including learner's licenses and conductor licenses, also managed by MoRTH.
• e-Challan: A digital system for issuing and managing traffic violation tickets, integrating MoRTH, traffic police, and citizens for efficient enforcement and online fine payments.
• FASTag: An electronic toll collection system using Radio Frequency Identification (RFID) technology for automatic deduction of toll payments at plazas, implemented by NHAI under MoRTH.
• National Transport Repository (NTR): A centralized database maintained by MoRTH that consolidates vehicle and driver-related data from various platforms like VAHAN, SARATHI, e-Challan, eDARs, and FASTags.
• Internet Freedom Foundation (IFF): An Indian digital rights advocacy organization that works to defend civil liberties and democracy in the digital sphere, focusing on issues like privacy, free speech, and net neutrality.