Road Ministry Orders Forensic Audit of Four Portals After Reports of Vahan-Sarathi Data Selling for Rs 5

Why in the News

The Ministry of Road Transport and Highways (MoRTH) has asked the Indian Computer Emergency Response Team (CERT-In) to carry out a forensic security audit of the VAHAN, SARATHI, e-Challan, and PUCC portals. According to media reports, this step came after news that vehicle owners' information was found selling for just Rs 5 on several apps and websites.

Key Facts

• The four portals: VAHAN handles vehicle registration records, SARATHI handles driving licences and related services, e-Challan records traffic violations and fines, and PUCC handles pollution-under-control certificates.
• What was found: According to an investigation by the security company Cyderes, a Telegram-based channel, on being given a vehicle registration number, returned the owner's full name, father's name, current and permanent addresses, PIN code, and mobile number. It also provided driving licence details, challan history, FASTag information, and downloadable PDFs of the registration certificate and driving licence.
• The apps: "Vehicle Information App" (1 crore downloads) and "VehicleSetu - RC & Challan Info" (10 lakh downloads) were identified as popular apps. The ministry has written to major app-store operators, including Google, requesting the removal of all such apps.
• The data-sharing policy: The policy allows access to the National Transport Repository (registration and licence records of VAHAN and SARATHI, and data of e-Challan, eDAR, and FASTag). According to the report, government bodies can view all data fields under the DPDP Act, 2023, while private entities can view only selected fields and face a daily search limit. Sharing happens through APIs, and personally identifying information stays masked for everyone except law-enforcement and security agencies. All entities are required to have a CERT-In security audit certificate.
• RTI figures: An RTI by the Internet Freedom Foundation (IFF) revealed that 25,314 credentials were issued to private entities, through which 1.708 crore queries were run in 33 months.
• ULIP: According to a senior officer, the initial investigation found evidence of misuse of the government's Unified Logistics Interface Platform (ULIP), which operates under the National Industrial Corridor Development Corporation (NICDC). This conclusion is based on unusually high transaction volumes, as several entities recorded more than 50 lakh hits in a month. In its letter of 19 October, the ministry asked NIC for an audit of access and usage patterns.
• New tightening: After the IFF report, data sharing on ULIP will be restricted. Government agencies wanting data will need the approval of the Transport Secretary, and the requesting officer will be verified through an Aadhaar-based digital signature certificate or video KYC. Officials refused to stop data sharing with private entities and described it as necessary for ease of doing business and ease of living.
• Request to MeitY: The ministry has asked the Ministry of Electronics and Information Technology (MeitY) to review the data-sharing policy and suggest strengthening it. The ministry also plans to audit the various enforcement agencies accessing the portals.

28 October: ULIP's Clarification (According to The Hindu's Report)

According to The Hindu (28 October, updated by 8:28 pm IST), ULIP rejected the allegations of its misuse in response to The Hindu's earlier story. According to ULIP's statement quoted in the report, it forwards information received from source APIs in the same format. For example, owners' names and chassis and engine numbers remain masked, and the mobile number field stays blank both in the source response and in the response given to users. ULIP says it neither creates the underlying data itself, nor removes masking, nor enriches it.
According to the report, ULIP listed security measures such as screening of entities, proposed use, binding conditions, IP whitelisting, phased onboarding, and continuous monitoring of API use, and said that apps selling vehicle information without masking call for an "examination of the wider ecosystem of platforms and channels". According to the same report, the Road Ministry has asked CERT-In for a forensic audit of VAHAN, SARATHI, e-Challan, and PUCC, has sought a review of the data-sharing policy from MeitY, and has described a plan to audit the enforcement agencies accessing the portals.
What is not established: This is ULIP's own side, as quoted in the report. The officer's statement above about "evidence of misuse in the initial investigation" and ULIP's denial are separate claims, and neither has independent confirmation or an audit outcome available yet. The original statements and audit reports were not read directly.

From the Exam Point of View

Prelims: the role of CERT-In, the identity of VAHAN, SARATHI, e-Challan, and PUCC, the DPDP Act, 2023.

Mains: data sharing versus privacy in e-governance, monitoring of API-based access, and the risks of centralised databases.

Mains Practice Question

Discuss the benefits and risks of data sharing with private entities from government digital platforms. In the context of portals such as VAHAN and SARATHI, what measures can be taken to protect privacy? (250 words)

Sources and Limitations

• The Hindu, 24 October 2026 (read): Road Ministry seeks forensic audit of its portals after vehicle data leak
• The Hindu, 28 October 2026 (read): Vehicle data shared only in masked form: ULIP. A summary of ULIP's quoted clarification, its security measures, and the ministry's audit demands.
• Limitations: All facts are based on these reports, which include Cyderes' investigation, IFF's RTI, and officers' statements. We have not seen their original documents directly. The misuse of ULIP has been described as a finding of the initial investigation.

Prelims Practice Question