IFF: New Delhi: Wednesday, 21 October 2026.
We filed RTI applications
with the MoRTH and the NIC asking who has access to VAHAN, SARATHI, e-Challan
and PUCC data, and what has been done about its sale through apps and Telegram
channels. MoRTH disposed of its application in two days without answering a
single question.
Last month we wrote about a complaint we had received on the open market in VAHAN, SARATHI, e-Challan and PUCC records, sent a representation to MoRTH, NIC and CERT-In, and filed two applications under the Right to Information Act, 2005. NIC’s reply of 16 October 2026 contains the first account we have seen of how widely these systems have been queried from outside government. It records 338 credentials for private entities against 62 for government bodies, 25,314 credentials issued to private entities over the period, and 17,079,998 queries through those credentials between January 2024 and September 2026. The same reply mentions, almost in passing, that “the arrangement for sharing information with private entities was discontinued with effect from 01.10.2026 pursuant to the directions of MoRTH.” No reason or date is given for the direction, and we have found no public notice, order or news report of it. NIC also confirms that it received the disclosure made to CERT-In on 1 June 2026 about VAHAN records being sold through Telegram, and says the action taken and the date of any credential revocation “are not specified in the inputs presently available.” MoRTH, which issued the direction and which alone holds the names of the private entities, answered none of our twelve questions. Its reply, reproduced in full below, says that the Ministry deals with the Motor Vehicles Act, that implementing it is for the States, and that a data sharing policy is available on a website. It was written on 24 September 2026, a week before the switch-off took effect, and does not mention it. We filed a first appeal against MoRTH on 6 October 2026 and are filing one against NIC. The Play Store application that started this, which advertises owners’ names, addresses, financier, insurance policy numbers and chassis and engine numbers for ₹29, is still live.
Background
In September 2026 an engineer wrote to us after years of writing to the authorities without a visible result. His point was that if private apps, websites and Telegram channels can return VAHAN, SARATHI, e-Challan and PUCC records on demand, there is a technical path from a government system to those services, and that path can be traced if someone with access to the logs chooses to trace it.
We tested one of the applications he named, and published what we found on 23 September 2026. For ₹29 the “Vehicle Information App” sells 15 search credits, or about ₹1.93 a lookup. From a registration number alone it returned the owner’s full name, father’s name, present and permanent addresses, financier, insurance policy number, chassis and engine numbers, and PUC certificate number. The official Parivahan portal masks or withholds most of those fields and requires an OTP-verified account. On the same day we sent an eight-page representation to the heads of MoRTH, NIC and CERT-In, with copies to MeitY, asking that the matter be registered as a cyber security incident, that logs be preserved, and that a forensic audit trace the queries to their source.
We have been here before
MoRTH sold bulk copies of VAHAN and SARATHI under its Bulk Data Sharing Policy of March 2019. In a Rajya Sabha reply of 8 July 2019 (Unstarred Question No. 1698), the Minister said that 87 private and 32 government entities had been given access and that ₹65 crore had been earned. RTI documents reported that September named 142 purchasers, among them banks, insurers and car makers. In February 2020 we wrote to the Union Government asking that public and private access to these databases be stopped, and the policy was withdrawn in June 2020 on privacy grounds. We welcomed that with a caution that the data already sold would stay sold, which is what happened. In a Lok Sabha reply of 11 February 2021, the Minister put the total revenue at ₹1,11,38,79,757, listed 170 recipients including the Ministry of Home Affairs and law enforcement agencies, and said that no proposal to require deletion of the data was under consideration.
On 18 August 2025 MoRTH circulated its Policy for Data Sharing from the National Transport Repository, which reopened API, portal and bulk channels to private recipients such as banks, insurers, vehicle manufacturers and “transport service providing agencies”, with personal data to be released on an Aadhaar-linked OTP consent. We explained the policy at the time. It is an executive circular with no statutory backing; it names MoRTH as the data fiduciary and the approving authority; it has no public register of recipients and no grievance mechanism; and under clause 4.3 it gives police, law enforcement and national security agencies “complete access to all data parameters, including Personal Data.” Even before that, when MediaNama asked MoRTH under the RTI Act in 2025 which private companies had API access, the Ministry confirmed that government organisations did and ignored the questions about private ones.
Then, on 1 September 2026, the security firm Cyderes published an investigation into a Telegram brokerage selling live VAHAN records at ₹5 a query. The records, it found, were being drawn through API credentials issued to licensed identity-verification intermediaries, not through any breach of a government server. Its request logs ran from September 2025 to April 2026. Cyderes reported its findings to CERT-In and to the affected companies on 1 June 2026, and said that one route was still returning full records when it published.
What we asked, and of whom
Our two RTI applications of 22 September 2026 were split by role. MoRTH (Registration No. MORTH/R/E/26/05057) was asked twelve questions about policy and authorisation, the names of private entities given API, portal or bulk access since 4 June 2020 and the data fields approved for each; the number of applications under the NTR Policy and how many were approved, rejected or pending; a copy of the undertaking private recipients sign and its clause on resale; whether AuthBridge (TruthScreen), Invincible Ocean, SurePass or the developer of the Vehicle Information App had held access; suspensions, debarments and audits; complaints about the sale of this data and the action taken; correspondence with CERT-In, MeitY, NIC and Google; FIRs filed; whether deletion was sought of data sold under the 2019 policy; the order deciding which fields are masked in public lookups; which entities other than MoRTH and NIC may send OTPs or SMS to vehicle owners; and the revenue earned each year since 2020-21. We asked that exempt portions be severed under Section 10 and that anything held elsewhere be transferred under Section 6(3).
NIC (Registration No. NICHQ/R/E/26/00591), which builds and runs these systems, was asked sixteen technical questions, how many credentials had been issued to government and private entities, their validity and access conditions, monthly query volumes, how credentials are monitored, how long API, SMS and database logs are kept and whether any had been ordered preserved, the SMS sender IDs and OTP accounts, whether any third-party application had been found triggering Parivahan OTPs, the cybersecurity incidents received, whether the CERT-In disclosure had reached NIC and what followed, security audits, unauthorised access by staff or vendors, and which fields are masked in public lookups but released through private APIs.
Analysis
The sequence
Sequence of events, 1
September to 16 October 2026
We asked the Ministry on 22 September who has access to this data, on what terms, and what has been done about reports that it is being sold. Nine days later, sharing with private entities ended. We learned of that on 16 October, from NIC, in answer to a question about the number of credentials in circulation. MoRTH has not told us that it took the decision, when it took it, on what material, or why. Its own reply of 24 September says nothing about it. We are not in a position to say that the Ministry acted because of our representation or our RTI, and we do not say so. What we can say is that a Ministry which was about to switch off a national data sharing arrangement answered a citizen asking about that arrangement by pointing him to a webpage describing it. If the direction was already in train on 24 September, the reply should have said so. If it came afterwards, the public is entitled to know what prompted it. That question is now before the First Appellate Authority.
What NIC told us
NIC’s reply, signed by its CPIO on 16 October 2026, runs to thirteen numbered parts. The figures it discloses are these.
Seventeen million queries
over 33 months is roughly 17,000 lookups of individual records every day. NIC
does not explain the gap between 338 credentials “recorded” and 25,314
“issued”. The likeliest reading is that 338 is a snapshot of the register when the
CPIO ran his query, after the switch-off, and 25,314 is the cumulative number
created over the period, with credentials renewed annually and issued per user
or per integration; it is also possible that 338 counts approved entities
rather than credentials. On either reading about 25,000 credentials were issued
and are no longer on the register, and NIC gives no figure for how many of
those were revoked, how many expired, and when. On the terms on which private
entities held access, it says only that these “were governed by the MoRTH Data
Sharing Policy in force during the relevant period.” It does not name a single
holder.
Query volumes fell by more than half between July and September 2025, and NIC does not say why.
NIC reply to RTI
NICHQ/R/E/26/00591 dated 16.10.2026, query 5 table, January 2024 to September
2026
Between January 2024 and July 2025 the volume stayed between roughly 590,000 and 940,000 queries a month, averaging 695,366. It then dropped to 452,616 in August 2025, 278,164 in September and 239,659 in October, and from September 2025 to September 2026 it averaged 262,725 a month. The last month in the series, September 2026, is the lowest at 192,703. NIC offers no explanation. Two things coincide with the fall. MoRTH circulated the NTR Policy in August 2025, the month the decline begins, and NIC’s own list of cybersecurity reports records five received in July 2025, more than in any other month of the series.
The CERT-In disclosure reached NIC. What followed is not on record, and the logs that would show it are expiring.
We asked whether NIC had received the disclosure made to CERT-In on 1 June 2026 and what action followed. Its answer in full, “The CERT-In disclosure referred to in the application was received. The action-related information and the date of credential revocation are not specified in the inputs presently available.” So the body that runs the system was told that its records were being sold through Telegram, and four and a half months later its CPIO could find nothing in the file about what was done or when any credential was cut off.
The retention periods NIC disclosed make this urgent. API logs are kept for one year, SMS logs for six months, and database logs “on an ongoing basis.” The operation Cyderes described ran from September 2025, with request logs to April 2026. On those periods the SMS logs for the whole of that window have already been deleted, and the API logs lapse month by month until April 2027. Our question on logs had two halves, the retention period and whether any instruction had been issued to preserve logs in connection with a complaint or investigation. NIC answered the first and said nothing about the second.
Twenty-eight security reports, a half-finished migration, and an audit gap.
NIC lists 28 dates on which reported cybersecurity issues were received between January 2024 and September 2026, eight in 2024, ten in 2025 and ten in 2026, the most recent on 16 September 2026, six days before we filed. What was done about them is, in NIC’s words, “general in nature and is not mapped separately to each receipt date.” The general note says that vulnerabilities in the NextGen mParivahan application were addressed, that an issue in its Android version was resolved, and that vulnerabilities reported in older versions of the e-Challan application “were being addressed through migration to the NextGen e-Challan application. Migration had been completed in 22 States, with the process underway in the remaining States.” On the Ministry’s own technical partner’s account, then, a version of the national traffic enforcement application with known vulnerabilities was still running in some States when the reply was written.
On audits, NIC says the last three of VAHAN were conducted on 28 April 2023, 17 December 2024 and 17 December 2025, and the last three of SARATHI on 7 January, 7 July and 6 August 2026, by two CERT-In empanelled agencies. VAHAN, the system whose records Cyderes found on sale, has not been audited since December 2025, six months before the CERT-In disclosure; SARATHI has been audited twice since. NIC adds that no case of unauthorised access by staff, contractors or vendors has been reported in its records.
No third-party app has been found triggering Parivahan OTPs.
The SMS sender IDs are SRTHDL and VAAHAN. Under the VAHAN header “multiple SMS and OTP accounts are in use”, whose names NIC has redacted “subject to the applicable provisions of the RTI Act, 2005”, without identifying which provision. The transaction counts it does give run into the hundreds of millions of messages a year. On the complainant’s question whether third-party apps are triggering government OTPs, NIC’s answer is no, “No such applications or entities have been identified as being able to trigger SMS/OTP through the specified sender IDs outside the identified arrangements. No unauthorised third-party application has been reported as having been identified in relation to the triggering of such SMS/OTP.” If that is right, the apps are not riding on the Parivahan OTP gateway, which leaves two routes for the data, credentials issued to licensed recipients and then resold or proxied, as Cyderes found, or copies bought under the 2019 policy and never deleted.
How MoRTH disposed of the same questions in two days
Our application to MoRTH was received on 22 September 2026 and marked “REQUEST DISPOSED OF” on 24 September 2026. This is the Ministry’s reply in its entirety:
The undersigned is dealing with Motor Vehicles Act, 1988 (MV Act) and Central Motor Vehicles Rules, 1989 (CMVRs). Both MV Act and CMVRs are available on this Ministry official website: www.morth.nic.in. Implementation of provisions of MV Act and CMVRs come under the purview of concerned State/UTs. With reference to RTI application it is stated that this Ministry has formulated a data sharing policy and placed it in public domain link https://services.parivahan.gov.in/ntr/ . Any citizen/ entity may apply for data subject to fulfillment of the conditions prescribed therein.
None of the twelve points is addressed. No exemption under Section 8 or 9 of the RTI Act is claimed, and no reasons, appeal period or particulars of the First Appellate Authority are given, though Section 7(8) requires all three whenever a request is refused. Taken on its own terms, the reply makes three moves, and none of them answers the application.
The app is still on the Play Store
The application at the centre of the complaint, listed as “Vehicle Information App” (package rto.owner.address.parivahan.car.malik.address.finder), remains live and installable on the Google Play Store as we publish this. We checked again on 17 October 2026.
Its listing still
advertises the owner’s full name, present and permanent address, financier,
insurance policy number and expiry, chassis and engine numbers, and PUC
validity and number. It still carries the disclaimer that the developer has no
association with any State RTO and that everything it shows is “publicly
available on the Parivahan/mparivahan website.” It has gained roughly 600
reviews since we first examined it. We make no claim about where this
application gets its data; that is what we asked MoRTH, and MoRTH did not
answer. Nothing visible to a citizen has changed since 1 October.
Numbers without names
NIC told us how much. MoRTH was asked who, and said nothing. A citizen reading the two replies together learns that 25,314 credentials were issued and 17 million queries were run, and cannot find out the name of anyone who held a credential. The names are what matter. Without them the public cannot check the 338 against the companies Cyderes identified, or against the apps and Telegram channels selling this data, and nothing can be audited.
The division of labour between the two bodies produced this result. NIC answered what could be read off a database and deferred the three questions that needed a policy answer, on credential validity, access conditions and data fields, to “the MoRTH Data Sharing Policy in force during the relevant period.” MoRTH, which owns that policy, pointed back at the policy document. The citizen is sent in a circle, and this is the second time in two years that the Ministry has met a question about private recipients with silence.
A switch-off without a reason
That private sharing was discontinued on 1 October 2026 is a welcome step. Whether the Ministry acted on the Cyderes report, on our representation, or on a review of its own, it acted in the right direction.
What it did not do is tell anyone. We have found no public announcement of the discontinuation, no order on the Ministry’s website, no Gazette entry and no news report, and we would be glad to be corrected. An arrangement that can be switched off without a stated reason can be switched back on the same way, by the same unpublished route, and nobody outside would know that either. Neither reply tells us why it was discontinued; whether the private entities whose credentials were withdrawn have been required to delete what they already hold, which is the question the Ministry answered in the negative in 2021; whether the discontinuation is permanent or a pause before a revised policy; or whether any of the 17 million lookups reached people who should never have had them. No vehicle owner in India has been told that their record was queried, by whom, or how often, and the NTR Policy gives them no way to find out.
The calendar makes this worse. The complainant asked for log preservation in his first letter to the authorities, more than a year ago. NIC has now told us that SMS logs last six months and API logs one year, so the SMS records for the period in the Cyderes report have already gone and the API records go month by month until April 2027. The file, meanwhile, moves at the speed of the RTI Act, an application, a two-day disposal, a first appeal, thirty days for a decision, then a second appeal to the Central Information Commission, where matters routinely wait years. By the time anyone is directed to produce the logs, there may be nothing left to produce. NIC was asked whether any preservation instruction had been issued, and did not answer.
The door that stayed open: police access and Delhi’s camera networks
The discontinuation NIC describes is of sharing “with private entities.” The 62 government credentials are not affected, and clause 4.3 of the NTR Policy continues to give police, law enforcement and national security agencies complete access to every field, including personal data. That access needs none of the OTP consent private recipients had to obtain, is subject to no proportionality or judicial check, and leaves no record the vehicle owner can see.
In Delhi, four systems already run on that access or are being built on it:
Action
On 6 October 2026 we filed a first appeal against MoRTH under Section 19(1) of the RTI Act (Registration No. MORTH/A/E/26/00656), which was forwarded to the First Appellate Authority on 7 October. The appeal argues that the CPIO’s reply is a refusal without any ground the Act recognises, no information was supplied, no exemption was cited as Section 7(1) requires, and none of the particulars required by Section 7(8) were given. It argues that the officer’s statement that he deals only with the MV Act and the CMVRs is not a ground for refusal, because Section 5(4) requires a CPIO to seek the assistance of the division that holds the record and Section 5(5) makes that officer a deemed PIO; that the points held by NIC, CERT-In or MeitY should have been transferred under Section 6(3), as we expressly asked; and that any third-party objection required notice under Section 11, the public interest test under Section 8(2) and severance under Section 10, none of which was done. We have asked the First Appellate Authority to set aside the reply, direct complete point-wise information on all twelve points within fifteen days, and direct at least a yes or no on each of the four named entities.
We are now filing a first appeal against NIC’s reply. It is a far better reply than MoRTH’s, but it leaves four things unaddressed that we will press, what “recorded” and “issued” mean, how many of the 25,314 credentials were active on 30 September 2026, and how many of the rest were revoked or expired and when; the deferral of the questions on credential validity, access conditions and data fields to “the MoRTH Data Sharing Policy”; the redaction of the SMS and OTP account names without any exemption being identified; and the unanswered half of our question on log preservation. The first relief we seek is a direction to preserve the logs that remain before they lapse. We are also filing a fresh application with MoRTH for a copy of the direction by which private sharing was discontinued, its date and file number, the material on which it was issued, and the communication by which NIC was informed.
Beyond the appeals, the following should not need an RTI at all:
Important documents
Last month we wrote about a complaint we had received on the open market in VAHAN, SARATHI, e-Challan and PUCC records, sent a representation to MoRTH, NIC and CERT-In, and filed two applications under the Right to Information Act, 2005. NIC’s reply of 16 October 2026 contains the first account we have seen of how widely these systems have been queried from outside government. It records 338 credentials for private entities against 62 for government bodies, 25,314 credentials issued to private entities over the period, and 17,079,998 queries through those credentials between January 2024 and September 2026. The same reply mentions, almost in passing, that “the arrangement for sharing information with private entities was discontinued with effect from 01.10.2026 pursuant to the directions of MoRTH.” No reason or date is given for the direction, and we have found no public notice, order or news report of it. NIC also confirms that it received the disclosure made to CERT-In on 1 June 2026 about VAHAN records being sold through Telegram, and says the action taken and the date of any credential revocation “are not specified in the inputs presently available.” MoRTH, which issued the direction and which alone holds the names of the private entities, answered none of our twelve questions. Its reply, reproduced in full below, says that the Ministry deals with the Motor Vehicles Act, that implementing it is for the States, and that a data sharing policy is available on a website. It was written on 24 September 2026, a week before the switch-off took effect, and does not mention it. We filed a first appeal against MoRTH on 6 October 2026 and are filing one against NIC. The Play Store application that started this, which advertises owners’ names, addresses, financier, insurance policy numbers and chassis and engine numbers for ₹29, is still live.
Background
In September 2026 an engineer wrote to us after years of writing to the authorities without a visible result. His point was that if private apps, websites and Telegram channels can return VAHAN, SARATHI, e-Challan and PUCC records on demand, there is a technical path from a government system to those services, and that path can be traced if someone with access to the logs chooses to trace it.
We tested one of the applications he named, and published what we found on 23 September 2026. For ₹29 the “Vehicle Information App” sells 15 search credits, or about ₹1.93 a lookup. From a registration number alone it returned the owner’s full name, father’s name, present and permanent addresses, financier, insurance policy number, chassis and engine numbers, and PUC certificate number. The official Parivahan portal masks or withholds most of those fields and requires an OTP-verified account. On the same day we sent an eight-page representation to the heads of MoRTH, NIC and CERT-In, with copies to MeitY, asking that the matter be registered as a cyber security incident, that logs be preserved, and that a forensic audit trace the queries to their source.
We have been here before
MoRTH sold bulk copies of VAHAN and SARATHI under its Bulk Data Sharing Policy of March 2019. In a Rajya Sabha reply of 8 July 2019 (Unstarred Question No. 1698), the Minister said that 87 private and 32 government entities had been given access and that ₹65 crore had been earned. RTI documents reported that September named 142 purchasers, among them banks, insurers and car makers. In February 2020 we wrote to the Union Government asking that public and private access to these databases be stopped, and the policy was withdrawn in June 2020 on privacy grounds. We welcomed that with a caution that the data already sold would stay sold, which is what happened. In a Lok Sabha reply of 11 February 2021, the Minister put the total revenue at ₹1,11,38,79,757, listed 170 recipients including the Ministry of Home Affairs and law enforcement agencies, and said that no proposal to require deletion of the data was under consideration.
On 18 August 2025 MoRTH circulated its Policy for Data Sharing from the National Transport Repository, which reopened API, portal and bulk channels to private recipients such as banks, insurers, vehicle manufacturers and “transport service providing agencies”, with personal data to be released on an Aadhaar-linked OTP consent. We explained the policy at the time. It is an executive circular with no statutory backing; it names MoRTH as the data fiduciary and the approving authority; it has no public register of recipients and no grievance mechanism; and under clause 4.3 it gives police, law enforcement and national security agencies “complete access to all data parameters, including Personal Data.” Even before that, when MediaNama asked MoRTH under the RTI Act in 2025 which private companies had API access, the Ministry confirmed that government organisations did and ignored the questions about private ones.
Then, on 1 September 2026, the security firm Cyderes published an investigation into a Telegram brokerage selling live VAHAN records at ₹5 a query. The records, it found, were being drawn through API credentials issued to licensed identity-verification intermediaries, not through any breach of a government server. Its request logs ran from September 2025 to April 2026. Cyderes reported its findings to CERT-In and to the affected companies on 1 June 2026, and said that one route was still returning full records when it published.
What we asked, and of whom
Our two RTI applications of 22 September 2026 were split by role. MoRTH (Registration No. MORTH/R/E/26/05057) was asked twelve questions about policy and authorisation, the names of private entities given API, portal or bulk access since 4 June 2020 and the data fields approved for each; the number of applications under the NTR Policy and how many were approved, rejected or pending; a copy of the undertaking private recipients sign and its clause on resale; whether AuthBridge (TruthScreen), Invincible Ocean, SurePass or the developer of the Vehicle Information App had held access; suspensions, debarments and audits; complaints about the sale of this data and the action taken; correspondence with CERT-In, MeitY, NIC and Google; FIRs filed; whether deletion was sought of data sold under the 2019 policy; the order deciding which fields are masked in public lookups; which entities other than MoRTH and NIC may send OTPs or SMS to vehicle owners; and the revenue earned each year since 2020-21. We asked that exempt portions be severed under Section 10 and that anything held elsewhere be transferred under Section 6(3).
NIC (Registration No. NICHQ/R/E/26/00591), which builds and runs these systems, was asked sixteen technical questions, how many credentials had been issued to government and private entities, their validity and access conditions, monthly query volumes, how credentials are monitored, how long API, SMS and database logs are kept and whether any had been ordered preserved, the SMS sender IDs and OTP accounts, whether any third-party application had been found triggering Parivahan OTPs, the cybersecurity incidents received, whether the CERT-In disclosure had reached NIC and what followed, security audits, unauthorised access by staff or vendors, and which fields are masked in public lookups but released through private APIs.
Analysis
The sequence
We asked the Ministry on 22 September who has access to this data, on what terms, and what has been done about reports that it is being sold. Nine days later, sharing with private entities ended. We learned of that on 16 October, from NIC, in answer to a question about the number of credentials in circulation. MoRTH has not told us that it took the decision, when it took it, on what material, or why. Its own reply of 24 September says nothing about it. We are not in a position to say that the Ministry acted because of our representation or our RTI, and we do not say so. What we can say is that a Ministry which was about to switch off a national data sharing arrangement answered a citizen asking about that arrangement by pointing him to a webpage describing it. If the direction was already in train on 24 September, the reply should have said so. If it came afterwards, the public is entitled to know what prompted it. That question is now before the First Appellate Authority.
What NIC told us
NIC’s reply, signed by its CPIO on 16 October 2026, runs to thirteen numbered parts. The figures it discloses are these.
Query volumes fell by more than half between July and September 2025, and NIC does not say why.
Between January 2024 and July 2025 the volume stayed between roughly 590,000 and 940,000 queries a month, averaging 695,366. It then dropped to 452,616 in August 2025, 278,164 in September and 239,659 in October, and from September 2025 to September 2026 it averaged 262,725 a month. The last month in the series, September 2026, is the lowest at 192,703. NIC offers no explanation. Two things coincide with the fall. MoRTH circulated the NTR Policy in August 2025, the month the decline begins, and NIC’s own list of cybersecurity reports records five received in July 2025, more than in any other month of the series.
The CERT-In disclosure reached NIC. What followed is not on record, and the logs that would show it are expiring.
We asked whether NIC had received the disclosure made to CERT-In on 1 June 2026 and what action followed. Its answer in full, “The CERT-In disclosure referred to in the application was received. The action-related information and the date of credential revocation are not specified in the inputs presently available.” So the body that runs the system was told that its records were being sold through Telegram, and four and a half months later its CPIO could find nothing in the file about what was done or when any credential was cut off.
The retention periods NIC disclosed make this urgent. API logs are kept for one year, SMS logs for six months, and database logs “on an ongoing basis.” The operation Cyderes described ran from September 2025, with request logs to April 2026. On those periods the SMS logs for the whole of that window have already been deleted, and the API logs lapse month by month until April 2027. Our question on logs had two halves, the retention period and whether any instruction had been issued to preserve logs in connection with a complaint or investigation. NIC answered the first and said nothing about the second.
Twenty-eight security reports, a half-finished migration, and an audit gap.
NIC lists 28 dates on which reported cybersecurity issues were received between January 2024 and September 2026, eight in 2024, ten in 2025 and ten in 2026, the most recent on 16 September 2026, six days before we filed. What was done about them is, in NIC’s words, “general in nature and is not mapped separately to each receipt date.” The general note says that vulnerabilities in the NextGen mParivahan application were addressed, that an issue in its Android version was resolved, and that vulnerabilities reported in older versions of the e-Challan application “were being addressed through migration to the NextGen e-Challan application. Migration had been completed in 22 States, with the process underway in the remaining States.” On the Ministry’s own technical partner’s account, then, a version of the national traffic enforcement application with known vulnerabilities was still running in some States when the reply was written.
On audits, NIC says the last three of VAHAN were conducted on 28 April 2023, 17 December 2024 and 17 December 2025, and the last three of SARATHI on 7 January, 7 July and 6 August 2026, by two CERT-In empanelled agencies. VAHAN, the system whose records Cyderes found on sale, has not been audited since December 2025, six months before the CERT-In disclosure; SARATHI has been audited twice since. NIC adds that no case of unauthorised access by staff, contractors or vendors has been reported in its records.
No third-party app has been found triggering Parivahan OTPs.
The SMS sender IDs are SRTHDL and VAAHAN. Under the VAHAN header “multiple SMS and OTP accounts are in use”, whose names NIC has redacted “subject to the applicable provisions of the RTI Act, 2005”, without identifying which provision. The transaction counts it does give run into the hundreds of millions of messages a year. On the complainant’s question whether third-party apps are triggering government OTPs, NIC’s answer is no, “No such applications or entities have been identified as being able to trigger SMS/OTP through the specified sender IDs outside the identified arrangements. No unauthorised third-party application has been reported as having been identified in relation to the triggering of such SMS/OTP.” If that is right, the apps are not riding on the Parivahan OTP gateway, which leaves two routes for the data, credentials issued to licensed recipients and then resold or proxied, as Cyderes found, or copies bought under the 2019 policy and never deleted.
How MoRTH disposed of the same questions in two days
Our application to MoRTH was received on 22 September 2026 and marked “REQUEST DISPOSED OF” on 24 September 2026. This is the Ministry’s reply in its entirety:
The undersigned is dealing with Motor Vehicles Act, 1988 (MV Act) and Central Motor Vehicles Rules, 1989 (CMVRs). Both MV Act and CMVRs are available on this Ministry official website: www.morth.nic.in. Implementation of provisions of MV Act and CMVRs come under the purview of concerned State/UTs. With reference to RTI application it is stated that this Ministry has formulated a data sharing policy and placed it in public domain link https://services.parivahan.gov.in/ntr/ . Any citizen/ entity may apply for data subject to fulfillment of the conditions prescribed therein.
None of the twelve points is addressed. No exemption under Section 8 or 9 of the RTI Act is claimed, and no reasons, appeal period or particulars of the First Appellate Authority are given, though Section 7(8) requires all three whenever a request is refused. Taken on its own terms, the reply makes three moves, and none of them answers the application.
- It points to the law. We did not ask for the law. The Motor Vehicles Act and the Rules are published, and nothing in them tells a citizen which private entities hold API access to the national vehicle register or what the Ministry did when told that its data was being sold. We asked for the records of how the Ministry has shared data under that law.
- It says implementation is for the States. The National Transport Repository is maintained by MoRTH. Under the Ministry’s own NTR Policy, MoRTH is the data fiduciary and the approving authority for private access. The records we asked for are generated by the Ministry’s own approval procedures and sit in the Ministry’s own files.
- It points to the NTR webpage. The page answers the question “what are the rules?” We asked who was let in under them. It carries the policy and blank application forms, not recipient names, application counts, signed undertakings, audit reports, suspensions, complaints, correspondence, FIRs, the masking order, the list of entities permitted to send OTPs, or revenue figures.
The app is still on the Play Store
The application at the centre of the complaint, listed as “Vehicle Information App” (package rto.owner.address.parivahan.car.malik.address.finder), remains live and installable on the Google Play Store as we publish this. We checked again on 17 October 2026.
Numbers without names
NIC told us how much. MoRTH was asked who, and said nothing. A citizen reading the two replies together learns that 25,314 credentials were issued and 17 million queries were run, and cannot find out the name of anyone who held a credential. The names are what matter. Without them the public cannot check the 338 against the companies Cyderes identified, or against the apps and Telegram channels selling this data, and nothing can be audited.
The division of labour between the two bodies produced this result. NIC answered what could be read off a database and deferred the three questions that needed a policy answer, on credential validity, access conditions and data fields, to “the MoRTH Data Sharing Policy in force during the relevant period.” MoRTH, which owns that policy, pointed back at the policy document. The citizen is sent in a circle, and this is the second time in two years that the Ministry has met a question about private recipients with silence.
A switch-off without a reason
That private sharing was discontinued on 1 October 2026 is a welcome step. Whether the Ministry acted on the Cyderes report, on our representation, or on a review of its own, it acted in the right direction.
What it did not do is tell anyone. We have found no public announcement of the discontinuation, no order on the Ministry’s website, no Gazette entry and no news report, and we would be glad to be corrected. An arrangement that can be switched off without a stated reason can be switched back on the same way, by the same unpublished route, and nobody outside would know that either. Neither reply tells us why it was discontinued; whether the private entities whose credentials were withdrawn have been required to delete what they already hold, which is the question the Ministry answered in the negative in 2021; whether the discontinuation is permanent or a pause before a revised policy; or whether any of the 17 million lookups reached people who should never have had them. No vehicle owner in India has been told that their record was queried, by whom, or how often, and the NTR Policy gives them no way to find out.
The calendar makes this worse. The complainant asked for log preservation in his first letter to the authorities, more than a year ago. NIC has now told us that SMS logs last six months and API logs one year, so the SMS records for the period in the Cyderes report have already gone and the API records go month by month until April 2027. The file, meanwhile, moves at the speed of the RTI Act, an application, a two-day disposal, a first appeal, thirty days for a decision, then a second appeal to the Central Information Commission, where matters routinely wait years. By the time anyone is directed to produce the logs, there may be nothing left to produce. NIC was asked whether any preservation instruction had been issued, and did not answer.
The door that stayed open: police access and Delhi’s camera networks
The discontinuation NIC describes is of sharing “with private entities.” The 62 government credentials are not affected, and clause 4.3 of the NTR Policy continues to give police, law enforcement and national security agencies complete access to every field, including personal data. That access needs none of the OTP consent private recipients had to obtain, is subject to no proportionality or judicial check, and leaves no record the vehicle owner can see.
In Delhi, four systems already run on that access or are being built on it:
- Delhi Police’s Safe City project, 10,000 AI-enabled cameras funded with about ₹800 crore from the Nirbhaya Fund, is being integrated with “at least 32 data sets”, which the reporting names as including NCRB data, criminal dossiers, the VAHAN portal and ZIPNET.
- On 30 September 2026, the day before private sharing ended, the Cabinet Committee on Economic Affairs approved Delhi Police’s Intelligent Traffic Management System at ₹1,789.52 crore, with 1,029 automated enforcement locations, 42 traffic corridors and “AI-based analytics” to identify “stolen, hot-listed and blacklisted vehicles”. Reporting on the project says it will be integrated with VAHAN and e-Sarathi and will push alerts through CCTNS, the police crime database.
- The ANPR cameras being installed at Delhi’s border points to stop end-of-life vehicles check every plate against VAHAN.
- NIC’s e-Challan application, used by traffic police forces including Delhi’s and the one whose older versions NIC says are still being migrated, is described by NIC as “integrated with VAHAN, SARATHI, and Intelligent Traffic Management Systems”, a camera reads a plate, “the vehicle’s registration details are then fetched from VAHAN”, and the notice goes to the mobile number or address on the owner’s record.
Action
On 6 October 2026 we filed a first appeal against MoRTH under Section 19(1) of the RTI Act (Registration No. MORTH/A/E/26/00656), which was forwarded to the First Appellate Authority on 7 October. The appeal argues that the CPIO’s reply is a refusal without any ground the Act recognises, no information was supplied, no exemption was cited as Section 7(1) requires, and none of the particulars required by Section 7(8) were given. It argues that the officer’s statement that he deals only with the MV Act and the CMVRs is not a ground for refusal, because Section 5(4) requires a CPIO to seek the assistance of the division that holds the record and Section 5(5) makes that officer a deemed PIO; that the points held by NIC, CERT-In or MeitY should have been transferred under Section 6(3), as we expressly asked; and that any third-party objection required notice under Section 11, the public interest test under Section 8(2) and severance under Section 10, none of which was done. We have asked the First Appellate Authority to set aside the reply, direct complete point-wise information on all twelve points within fifteen days, and direct at least a yes or no on each of the four named entities.
We are now filing a first appeal against NIC’s reply. It is a far better reply than MoRTH’s, but it leaves four things unaddressed that we will press, what “recorded” and “issued” mean, how many of the 25,314 credentials were active on 30 September 2026, and how many of the rest were revoked or expired and when; the deferral of the questions on credential validity, access conditions and data fields to “the MoRTH Data Sharing Policy”; the redaction of the SMS and OTP account names without any exemption being identified; and the unanswered half of our question on log preservation. The first relief we seek is a direction to preserve the logs that remain before they lapse. We are also filing a fresh application with MoRTH for a copy of the direction by which private sharing was discontinued, its date and file number, the material on which it was issued, and the communication by which NIC was informed.
Beyond the appeals, the following should not need an RTI at all:
- Publication of the direction discontinuing private sharing, with its date and reasons, and a statement of whether it is permanent or an interval before a revised policy.
- A public register of every entity with access to NTR data, government and private, with the purpose and data fields approved for each, published and kept current.
- Deletion on affidavit by every entity that holds transport data obtained under the 2019 policy or since, which the Ministry declined to seek in 2021.
- Log retention matched to the investigation timetable rather than six months, with preservation triggered automatically by a reported incident.
- Notification to the vehicle owners whose records were accessed. The Digital Personal Data Protection Act, 2023 will require this of MoRTH as a data fiduciary when its substantive provisions take effect in May 2027; the Ministry need not wait until then.
- Completion of the e-Challan migration in the States where, on NIC’s own account, a known-vulnerable version is still running.
- A statutory basis, with proportionality and record-keeping requirements, for police and law enforcement access to the NTR, in place of clause 4.3 of a circular.
Important documents
- IFF’s RTI application to MoRTH dated 22.09.2026, Registration No. MORTH/R/E/26/05057 (Link)
- MoRTH CPIO’s reply dated 24.09.2026 [Link]
- IFF’s RTI application to NIC dated 22.09.2026, Registration No. NICHQ/R/E/26/00591 (Link)
- IFF’s representation to MoRTH, NIC and CERT-In dated 23.09.2026 (Link)
- IFF, Less Than ₹2 for Your Name and Home Address: How VAHAN and SARATHI Data Is Being Sold Online, 23.09.2026 (Link)
- MoRTH, Policy for Data Sharing from the National Transport Repository, 18.08.2025 (Link); NTR data sharing portal (Link)
- IFF, Data Highways, Rights Roadblocks: An explainer on the National Transport Repository, 01.09.2025 (Link)
- IFF, We have written to Government asking them to stop public access to the Vahan database #SaveOurPrivacy, 26.02.2020 (Link); IFF, Bulk data sharing policy scrapped is an incremental victory that requires follow up action #SaveOurPrivacy, 30.06.2020 (Link)
- Rajya Sabha Unstarred Question No. 1698, answered 08.07.2019 (Link); Lok Sabha reply of 11.02.2021 as reported by Business Today (Link) and Business Insider (Link)
- Cyderes Howler Cell, 6 Cents USD per Lookup: Inside an Indian Data Brokerage Running on Unauthorized KYC Access, 01.09.2026 (Link)
- PIB, Cabinet approval of the Intelligent Traffic Management System for Delhi, 30.09.2026 (Link)
- IFF, IFF Writes to the Commissioner of Police and files RTIs on live facial recognition at Jantar Mantar (Link)
.JPG)
.JPG)
