Road Ministry seeks forensic audit of its portals after vehicle data leak

The Road Ministry asked CERT-In to conduct a forensic security audit because reports suggested that sensitive vehicle-owner information was being sold through apps, websites and a Telegram channel. The audit matters because the four portals contain registration, licence, traffic-fine and pollution-certificate records. It can help identify how data was accessed, whether controls failed, and who may have misused it.

Cyderes found that a vehicle registration number could reveal a person’s name, father’s name, addresses, PIN code and mobile number. The same service reportedly offered driving-licence files, challan history, FASTag information and downloadable documents. Popular apps were also identified, prompting the Ministry to ask major app stores to remove them.

The Ministry also plans to audit enforcement agencies using the portals. It has sought MeitY’s help to review the data-sharing policy and strengthen it. Officials have tightened technical controls for ULIP, while continuing private-sector access because they consider it necessary for ease of doing business and living.

VAHAN stores vehicle-registration records, while SARATHI handles driving licences and related services. The e-Challan system records traffic violations and fines. PUCC manages pollution-control certificates. Together, these systems describe both the vehicle and many official interactions connected to it.

The reported exposure was much broader than a registration record. A Telegram channel could provide an owner’s full name, father’s name, present and permanent addresses, PIN code and mobile number from a registration number. It also offered driving-licence details, challan history, FASTag information, a downloadable registration certificate and a PDF of the driving licence.

The National Transport Repository brings together registration and licence data from VAHAN and SARATHI, along with e-Challans, eDARs and FASTags. This concentration makes access controls important. If information from separate services is exposed together, it can reveal a detailed picture of a person’s vehicle, identity, travel-related records and official documents.

The scale is substantial: 25,314 credentials were issued to private entities for access to VAHAN, SARATHI, e-Challan and PUCC data. Those credentials were used to run 1.708 crore queries over 33 months, according to figures obtained by the Internet Freedom Foundation through an RTI request.

The policy also allows government bodies, including police, law-enforcement and national-security agencies, to access all available data fields. Private entities receive only selected fields relevant to their domains and face a daily search cap. Access is provided through APIs or login-based systems, with secret keys, two-factor authentication and Aadhaar-authenticated OTPs.

The figures show why the Ministry is reviewing access patterns rather than focusing only on individual apps. It plans to audit enforcement agencies and has asked for a review of the data-sharing policy. In the related ULIP investigation, some entities recorded more than 50 lakh hits in a month, raising concerns about unusually high usage and possible misuse.

Combining records turns separate administrative details into a detailed profile of one vehicle owner. A registration number can identify the vehicle in VAHAN, while linked licence, challan, FASTag and pollution records add information about the driver, violations, payments and compliance. Personal fields can then connect those records to a named individual and address.

The reported Telegram service illustrates the risk. It allegedly supplied a full name, father’s name, present and permanent addresses, PIN code and mobile number. It also offered driving-licence details, challan history, FASTag information, a registration certificate and a driving-licence PDF. These records came together after a single vehicle number was provided.

Road Ministry officials suspected that bad actors were triangulating data gathered from different portals and compiling it. The Ministry therefore ordered audits of access and usage, including ULIP activity. New controls will limit ULIP data sharing, require Transport Secretary approval for government requests and verify requesting officers through Aadhaar-based signatures or video KYC.

An API, or application programming interface, is a software connection that lets one system request information from another. In this policy, APIs allow an approved organisation’s system to send a query to transport databases and receive permitted records automatically. That supports services needing repeated or fast checks without a person manually opening each portal.

The policy allows machine-to-machine access through APIs, as well as login-based access. Connections are secured by secret keys, two-factor authentication and Aadhaar-authenticated one-time passwords. Private entities can retrieve only selected fields relevant to their domain and face a daily cap on searches. Personally identifiable information is masked for them.

Government bodies, including police, law-enforcement and national-security agencies, may access all fields available through the applications, subject to the stated policy and the Digital Personal Data Protection Act, 2023. All entities must hold a CERT-In Security Audit Certificate. The Ministry is auditing usage because large query volumes and reported data sales suggest controls may need strengthening.

The policy distinguishes between public authorities and private entities because their stated functions differ. Police, law-enforcement and national-security agencies may need broad records for official work, so they can access all fields available through the applications. Private entities are restricted to fields relevant to their domain and face daily search limits.

The system is supposed to reduce misuse through several controls. APIs use secret keys, two-factor authentication and Aadhaar-authenticated OTPs. Personally identifiable information is masked for everyone except law-enforcement and security agencies. All entities must possess a CERT-In Security Audit Certificate. ULIP requests from government agencies will also require Transport Secretary approval, with officers verified through an Aadhaar-based digital signature certificate or video KYC.

These safeguards are now being tested by reported data sales and unusual usage. The Ministry plans to audit enforcement agencies and review its policy with MeitY. It has not suspended private access, saying that continued sharing supports ease of doing business and ease of living.

Personally identifiable information, or PII, connects a database entry to an identifiable person. Protecting it matters because vehicle records can include names, addresses, phone numbers, licence details and official documents. If exposed together, these details can reveal a person’s identity and make records from different services easy to connect.

The article describes a concrete warning. A Telegram channel reportedly returned a full name, father’s name, present and permanent addresses, PIN code and mobile number after receiving a vehicle registration number. It also offered challan history, FASTag information, a registration certificate and a driving-licence PDF. Such breadth shows the consequences of weak controls.

The policy therefore masks PII for most users and restricts private entities to selected fields. It also requires authentication, search caps and CERT-In audit certificates. Because misuse was suspected, the Ministry is auditing portals, agencies and ULIP access. Protecting PII helps keep essential transport services available without turning official databases into easily assembled personal profiles.