Data shared in masked form, says ULIP amid complaints over sale of vehicle information

Why in the News

Vehicle-owner data that the Centre’s logistics portal says it shares only in masked form is being sold by apps and websites, complaints allege. The Ministry of Road Transport and Highways has sought an audit of users of the Unified Logistics Interface Platform (ULIP) after finding some entities pulling as many as 50 lakh records a month.

How does ULIP share vehicle data?

1. What it is: ULIP is the Centre’s logistics data gateway, passing government data to approved users through application programming interfaces (APIs), or software links. It works like a sorting office forwarding sealed letters unopened.
2. Source portals: The Ministry’s portals hold vehicle-owner records: VAHAN (vehicle registration), SARATHI (driving licences), e-Challan (traffic fines) and PUCC (Pollution Under Control Certificates).
3. Policy home: ULIP is part of the National Logistics Policy (NLP), 2022, and links 43 government systems across ministries through APIs.
4. Masking by design: ULIP relays data in the format the source system sends. Owner names, chassis and engine numbers stay masked, and the mobile number field stays empty.
5. The takeaway: ULIP says it does not generate, unmask or enrich data, so the unmasked records on sale point to a leak elsewhere in the chain.

What has the Ministry done?

1. Audit of ULIP users: The Ministry has sought an audit of the entities that access ULIP, given the bulk extraction it found.
2. Forensic audit: It has asked the Indian Computer Emergency Response Team (CERT-In), the nodal agency for cybersecurity incidents, for a forensic audit of all four source portals.
3. Policy review: It has sought a review of its data-sharing policy by the Ministry of Electronics and Information Technology (MeitY), with ways to strengthen it.
4. Enforcement agencies: It plans to audit the enforcement agencies that draw data from its portals.

Who is responsible for the leak?

1. ULIP’s safeguards: ULIP screens each user and its stated purpose and binds it to contract terms. It admits only pre-approved Internet Protocol (IP) addresses, the network addresses of approved computers, onboards users in phases and monitors API use.
2. Policy compliance: ULIP says it follows the Ministry’s Policy for Data Sharing from the National Transport Repository, which requires authentication, secret keys, masking of personally identifiable information (PII), details that identify a person, and approval steps.
3. Wider ecosystem: ULIP wants scrutiny of the “wider ecosystem of platforms and channels” through which unmasked data reaches the market.
4. Bulk access: Approved users can still extract records in very large volumes, so rules on who may access data do not limit how much they take.

Challenges

1. Re-identification risk: Masked records pulled in bulk can be matched with other datasets to identify owners again, more easily with artificial intelligence (AI) tools.
2. Diffuse data trail: The Ministry shares the same vehicle data with many government agencies and private firms, so a single leak is hard to trace.
3. Capacity deficit: Most government departments lack trained Data Protection Officers to oversee such data sharing.
4. Weak accountability: CERT-In is exempt from the Right to Information Act, 2005, so citizens cannot use that law to examine how it reports data breaches.

Way Forward

1. Volume caps: The Ministry should cap and log the records each API user can pull, with alerts on unusual volumes.
2. Privacy by design: Build encryption, access controls and audit logs into the source portals, as the Digital Personal Data Protection Act, 2023 and its 2025 Rules require.
3. Trained officers: Train Data Protection Officers in every ministry through iGOT Karmayogi, the government’s online training platform.
4. Published findings: Publish the audit findings, so vehicle owners know how their data left the system.

Conclusion

ULIP’s defence that it passes on only masked data shifts attention to the portals, agencies and private users that also handle vehicle records. The forensic and policy reviews now under way will show where the leak lies and whether data-sharing rules tighten.

Matching Previous Year Question

“[2024, GS3, 10 marks] Describe the context and salient features of the Digital Personal Data Protection Act, 2023”