Vehicle data sold for ₹5: Centre orders CERT-In audit of VAHAN, SARATHI and e-Challan portals
Type a car number, pay ₹5, and get the owner’s name, home address and phone number. That is what investigators found. Now the Road Transport Ministry has asked CERT-In, India’s cyber-security agency, to audit its VAHAN, SARATHI, e-Challan and pollution-certificate portals. The same day, The Hindu reported a separate leak of film certification records. For you, it links cyber security, the right to privacy and the Digital Personal Data Protection Act, 2023.
- Audit by
- CERT-In (Section 70B, IT Act)
- Portals
- VAHAN, SARATHI, e-Challan, PUCC
- Price of data
- As low as ₹5
- Private log-ins
- 25,314 credentials
Vehicle data leak: what happened?
- The Road Transport Ministry (MoRTH) asked CERT-In for a forensic (evidence-finding) audit of VAHAN (vehicle registration), SARATHI (driving licences), e-Challan (traffic fines) and the PUCC (pollution certificate) portals.
- Security firm Cyderes found a Telegram channel and apps selling the owner’s full name, father’s name, addresses, PIN code, mobile number, licence details, challan history, FASTag data and a PDF of the licence.
- Not a hack, says the report: the data flowed through log-ins legally given to verification companies, then misused.
- Apps named: Vehicle Information App (1 crore downloads) and VehicleSetu (10 lakh). The Ministry asked app stores, including Google, to remove such apps.
- It sought MeitY’s (IT Ministry’s) help to review its data-sharing policy, and plans to audit enforcement agencies using the portals.
How does transport data flow?
Think of one giant government register of every vehicle and driver, with many keys handed out.
- That register is the National Transport Repository. It joins VAHAN and SARATHI data with e-Challans, Detailed Accident Reports and FASTags.
- Government bodies, including police and security agencies, may see all fields, as per the Digital Personal Data Protection Act, 2023.
- Private firms get only fields relevant to their work, with a daily search limit; personal details are masked (hidden) for all except law-enforcement agencies.
- An RTI reply to the Internet Freedom Foundation showed 25,314 private log-ins ran 1.708 crore searches in 33 months.
Government access vs private access
| Point | Government bodies | Private entities |
|---|---|---|
| Data fields | All fields | Only selected, relevant fields |
| Search limit | As needed for law enforcement | Daily cap |
| Personal details | Visible to law-enforcement and security agencies | Masked |
| Condition | As per the DPDP Act, 2023 | CERT-In security audit certificate |
What is the legal framework?
- Article 21: the right to privacy is part of life and personal liberty (Justice K.S. Puttaswamy vs Union of India, 2017, nine-judge Bench).
- Section 70B, IT Act, 2000: CERT-In is the national agency that responds to cyber attacks, under MeitY.
- CERT-In directions (2022): service providers, data centres and companies must report cyber incidents within 6 hours.
- DPDP Act, 2023: those holding data must keep it safe; penalty up to ₹250 crore for weak security; the Data Protection Board hears breaches.
How big is the exposure?
| Measure | Figure |
|---|---|
| Price per lookup | As low as ₹5 |
| Vehicle Information App downloads | 1 crore |
| VehicleSetu downloads | 10 lakh |
| Private credentials issued | 25,314 |
| Searches by them | 1.708 crore in 33 months |
What should you note for the exam?
| Angle | What to note |
|---|---|
| Institutions | CERT-In under MeitY; Section 70B of the IT Act |
| Rights | Puttaswamy (2017): privacy under Article 21 |
| Law | DPDP Act 2023; Data Protection Board; ₹250 crore penalty |
| Global | EU GDPR in force since 25 May 2018 |
| Another leak | CBFC e-Cinepramaan records of 500+ titles exposed |
What are the challenges?
- Too many keys: thousands of private log-ins make leaks hard to trace.
- Cheap data, big harm: ₹5 details feed fraud calls, fake challan scams and identity theft.
- Apps with crores of downloads repackage government data with little oversight.
- Leaks keep recurring, as the CBFC case shows.
What should be done?
- Fewer log-ins, a record of every search and regular CERT-In audits.
- Enforce DPDP Act penalties on those who fail to keep data safe.
- Hide personal fields by default; share only what a purpose needs.
Protect yourself in 3 steps
- Pay traffic fines only on the official e-Challan or Parivahan site, never through an SMS or WhatsApp link.
- A caller who knows your car number and address is not proof they are officials.
- Lost money to fraud? Call 1930 or report at cybercrime.gov.in quickly.
What can Prelims ask on data protection?
- VAHAN = vehicle registration; SARATHI = driving licences.
- CERT-In: Section 70B, IT Act 2000; under MeitY.
- Service providers, data centres and body corporates must report cyber incidents.
- Right to privacy: Article 21 (Puttaswamy, 2017).
- DPDP Act, 2023: Data Protection Board of India.
Probability in Prelims: Expect a statement question on the Indian Computer Emergency Response Team: the national cyber agency under Section 70B, Information Technology Act, 2000, to which service providers, data centres and body corporates must report cyber incidents.
How to write about data security in Mains
Practice question (15 marks, 250 words): Describe the context and salient features of the Digital Personal Data Protection Act, 2023. How far can it prevent leaks such as the sale of vehicle data? (GS-III)
- Intro: vehicle data sold for ₹5; CERT-In audit ordered.
- Body 1: context: Puttaswamy (2017), Srikrishna Committee, the 2023 Act.
- Body 2: features: consent, data fiduciaries’ duties, Data Protection Board, penalties.
- Body 3: gaps: wide government access, private credentials, weak enforcement.
- Way forward: data minimisation, audit trails, quick penalties, citizen awareness.
Ready lines for your answer
If asked: Describe the context and salient features of the Digital Personal Data Protection Act, 2023. (GS-III, 2024)
Quote: “Under the policy, government bodies may access all data fields in accordance with the Digital Personal Data Protection Act, 2023.”
Use it: Use it to discuss how wide state access sits alongside the new law.
If asked: Data security has assumed significant importance in the digitised world. Discuss the strengths and weaknesses of India’s framework. (GS-III, 2018)
Quote: “25,314 credentials had been issued to private entities to access VAHAN, SARATHI, e-Challan, and PUCC data, through which 1.708 crore queries were run over a period of 33 months.”
Use it: Quote the numbers to show how many access points a single database can have.
Image: Cars and an autorickshaw on a street in Bengaluru. Chaitanya.lala, via Wikimedia Commons, Public domain
Exam angle
Prelims: CERT-In, Section 70B IT Act, VAHAN/SARATHI, Puttaswamy, DPDP Act 2023, GDPR. · Mains GS-III: cyber security and data protection.
Practice MCQs
Original practice questions (not PYQs).
Consider the following statements:
1. VAHAN holds driving licence records.
2. CERT-In works under the Ministry of Electronics and Information Technology.
3. The Supreme Court declared privacy a fundamental right in the Puttaswamy case (2017).
Which of the statements given above are correct?
Answer (b) & explanation
Driving licences are on SARATHI; VAHAN holds vehicle registration.
In India, it is legally mandatory for which of the following to report cyber security incidents?
1. Service providers
2. Data centres
3. Body corporates
Select the correct answer using the code given below.
Answer (d) & explanation
Under CERT-In rules and 2022 directions, all three must report cyber incidents.
Under the Digital Personal Data Protection Act, 2023, the maximum penalty for failing to take reasonable security safeguards to prevent a personal data breach is:
Answer (c) & explanation
The Act provides a penalty of up to ₹250 crore for failure to take reasonable security safeguards.
Questions students ask about this
Was the VAHAN portal hacked?
Reports say no server was broken into. Data leaked through log-ins legally given to private verification firms, which were then misused.
What data was being sold?
Owner’s name, father’s name, addresses, PIN code, mobile number, licence details, challan history and FASTag data.
Which portals will CERT-In audit?
VAHAN, SARATHI, e-Challan and the PUCC (pollution certificate) portal of the Road Transport Ministry.
What is CERT-In?
India’s national cyber-security agency under the IT Ministry, set up under Section 70B of the IT Act, 2000.
Which law protects personal data in India?
The Digital Personal Data Protection Act, 2023, along with the right to privacy under Article 21.