Aadhaar breach from pvt firm reveals fault lines in data usage

A complaint filed by the Unique Identification Authority of India (UIDAI) in Bengaluru against a private firm for accessing Aadhaar data without seeking prior permission has revealed the fault lines in the way data is used.

According to the complaint filed here on Thursday, accessed by HT, Qarth Technologies, a subsidiary of Ola, had without any permission misused data accessed from the Aadhaar website to provide e-KYC (Know Your Customer) services.

The complaint adds in this way the data was leaked and, hence, a case has been booked against Abhinav Srivastava of Qarth Technologies under sections 37 and 38 of the Aadhaar Act and sections 65 and 66 of the Information Technology Act.

However, an official of the UIDAI at its headquarters in Delhi, speaking on condition of anonymity, said the alleged breach was not from the UIDAI’s own database but from that of the National Informatics Centre. “The UIDAI database is very secure,” the official said. “This seems to have happened at the level of the Authentication User Agency (AUA) or the e-KYC User Agency (KUA).”

The official said that if such a breach has happened at the level of AUA or KUA, the UIDAI was helpless and could only file cases against the misuse. “The matter is now with police and let us wait for the investigation to be completed,” the official added.

The official did not say how many such cases had been registered at the national level.

Meanwhile, officials at the regional office in the city, which also houses the technical centre where data from across the country is stored, said this was the first such case here.

“Generally, we encounter malpractice cases, where some false documents have been submitted. This is the first such technical case,” an official said.

Qarth Technologies, which ran a mobile payments app called X-Pay, was acquired by Ola in March 2016. Sources said the app was developed by Srivastava in his private capacity. A statement issued by the company said: “Ola has neither commissioned nor is involved in any such activity. No such complaint has been brought to our notice.”

Praveen Sood, Bengaluru Police commissioner, said a case has been registered and investigations had started. “We have identified two persons,” he said, adding that no arrests had yet been made. “The app has been deactivated.”