The Ministry of Road Transport and Highways (MoRTH) has asked the Indian Computer Emergency Response Team (CERT-In) to conduct a forensic security audit of the VAHAN, SARATHI, e-Challan and PUCC portals, which hold various types of vehicle-owner information.
The Ministry also plans to audit various enforcement agencies accessing its portals. The data-sharing policy allows access to data from the National Transport Repository, a central MoRTH database that consolidates vehicle-registration and driving-licence records from VAHAN and SARATHI, as well as data from e-Challans, eDARs (Detailed Accident Reports), and FASTags. Meanwhile, private entities can access only selected data fields relevant to their domain and have a daily cap on searches. Data is shared through application programming interfaces (APIs), enabling machine-to-machine access or login-based access secured by secret keys, two-factor authentication, and Aadhaar-authenticated one-time passwords (OTPs). Personally identifiable information (PII) is masked for all except law-enforcement and security agencies. All entities must possess a Security Audit Certificate from CERT-In.
Under the policy, government bodies, including the police, law-enforcement and national-security agencies, may access all data fields available through the various applications, in accordance with the Digital Personal Data Protection Act, 2023. Through an RTI request, the Internet Freedom Foundation (IFF) found that 25,314 credentials had been issued to private entities to access VAHAN, SARATHI, e-Challan, and PUCC data, through which 1.708 crore queries were run over a period of 33 months.
A senior official from the Ministry of Road Transport and Highways said they have sought the intervention of the Ministry of Electronics and Information Technology (MeitY) to review its data-sharing policy and suggest ways to strengthen it.
The finding was based on unusually high transaction volumes, with many entities permitted to access the portal recording more than 50 lakh hits in a month. Government agencies seeking data will now be required to get approval from the Transport Secretary, and requesting officers must be verified through an Aadhaar-based digital signature certificate or video KYC. However, officials ruled out suspending data sharing with private entities, saying it was necessary to support ease of doing business and ease of living.
A preliminary investigation found evidence of data misuse involving the Indian government’s Unified Logistics Interface Platform (ULIP), managed by the National Industrial Corridor Development Corporation (NICDC), according to another senior Road Ministry official. Road Ministry officials said that, following a representation from the IFF, the Ministry has further tightened technical controls and will limit data sharing for ULIP.
