ULIP Denies Data Misuse Amid Vehicle Information Leak Allegations
Road Ministry orders forensic audit after reports of unauthorized vehicle data sales.
1Allegations of Data Misuse
The Road Ministry initiated an audit following reports that various websites and mobile applications were selling sensitive vehicle information. Allegations suggested that personal data was being traded for as little as five rupees. Consequently, the ministry requested a formal investigation into the security of its logistics and transport portals.
2ULIP Defense Strategy
The Unified Logistics Interface Platform rejected claims of data misuse, stating it only relays information received from source APIs. It maintains that sensitive fields like owner names and engine numbers remain masked. The platform asserts that it does not independently generate, unmask, or enrich any underlying data during the relay process.
3Scale of Data Extraction
Concerns intensified after the Road Ministry discovered that certain entities were extracting massive volumes of data from the platform. Some users were reportedly pulling as many as 50 lakh records per month. This high-frequency access prompted the ministry to scrutinize the data sharing practices across its various transport-related digital repositories.
4Existing Security Framework
ULIP claims to utilize robust safeguards, including IP whitelisting, phased onboarding, and continuous monitoring of API usage. The platform states its operations comply with the National Transport Repository data sharing policy. This framework mandates strict authentication, the use of secret keys, and the masking of all personally identifiable information for users.
5Forensic Audit Request
The Road Ministry has officially requested the Indian Computer Emergency Response Team to conduct a forensic audit. This investigation targets the VAHAN, SARATHI, e-Challan, and PUCC portals. These systems hold extensive records, including registration certificates, driving licenses, and FASTag information, which are currently under intense scrutiny for potential security vulnerabilities.
6Policy Review Intervention
Beyond the forensic audit, the ministry has sought intervention from the Ministry of Electronics and Information Technology. The goal is to review the current data sharing policy and identify methods to strengthen security protocols. Furthermore, the ministry plans to audit all enforcement agencies that currently possess access to these government portals.
7Broader Ecosystem Scrutiny
ULIP emphasized that the problem may lie within the wider ecosystem of platforms and channels. It suggested that unauthorized data availability stems from sources beyond its own interface. The ministry has responded by asking major app store operators, including Google, to remove applications identified as selling vehicle-linked personal data to users.
8Investigation Findings Impact
A Cyderes investigation revealed that Telegram-based brokers could retrieve comprehensive owner details from a simple registration number. This exposure includes addresses, contact information, and challan records. The ongoing regulatory response highlights the critical need for stricter oversight in the digital transport infrastructure to protect citizen data from unauthorized commercial exploitation.