ULIP Denies Data Misuse Amid Vehicle Information Leak Allegations
Road Ministry orders forensic audit after reports of unauthorized vehicle data sales.
1Allegations of Data Misuse
The Road Ministry initiated an audit following reports that third-party websites and applications were selling sensitive vehicle information. Allegations suggested that personal data, including owner details, were being extracted in large volumes. The ministry responded to these concerns by investigating the integrity of the Unified Logistics Interface Platform, or ULIP, portal.
2ULIP Technical Defense Stance
ULIP officially rejected claims of data misuse, asserting that all information is relayed in a masked format. The platform stated it does not independently unmask or enrich data received from source APIs. Specifically, fields like mobile numbers remain null, while chassis and engine numbers are protected to ensure user privacy remains intact.
3Volume of Data Extraction
Concerns intensified after the Road Ministry discovered that certain entities were pulling as many as 50 lakh records per month from the platform. This high-volume extraction prompted the ministry to scrutinize how government portals like VAHAN, SARATHI, e-Challan, and PUCC share information with various private firms and other government agencies.
4Existing Security Frameworks
ULIP maintains that it employs rigorous safeguards, including IP whitelisting, phased onboarding, and continuous API usage monitoring. These measures align with the Road Ministry’s Policy for Data Sharing from the National Transport Repository. The framework mandates authentication, secret keys, and strict masking of personally identifiable information to prevent unauthorized access to records.
5Broader Ecosystem Scrutiny Needed
ULIP suggested that the source of the unmasked data might lie outside its own infrastructure. The platform called for a wider investigation into the ecosystem of platforms and channels currently making such information available. They argue that the focus should shift toward auditing the various entities that interact with the transport data.
6Forensic Audit and Investigation
The Road Ministry has formally requested the Indian Computer Emergency Response Team to conduct a forensic audit of key portals. This investigation aims to identify vulnerabilities within VAHAN, SARATHI, e-Challan, and PUCC systems. Additionally, the ministry plans to audit all enforcement agencies that currently hold authorized access to these sensitive transport databases.
7Policy Review and Intervention
The ministry has sought intervention from the Ministry of Electronics and Information Technology to review existing data sharing policies. The goal is to suggest ways to strengthen current protocols and prevent future leaks. This collaborative effort intends to refine the approval mechanisms and security standards governing how government-held vehicle data is distributed.
8Marketplace for Stolen Data
Investigations revealed that personal data was being sold for as little as five rupees per record. Telegram-based brokers reportedly provided access to driving licenses, FASTag, and registration details. Consequently, the ministry has requested that major app-store operators, including Google, remove all applications found to be facilitating the sale of this information.