Bengaluru, Aug 4: Bengaluru city police has arrested a young techie on the charge of accessing Aadhaar data following a complaint filed by the Unique Identification Authority of India (UIDAI) last week.
The arrested is Abhinav Srivastav, 31, an IIT-Kharagpur graduate, who is currently employed by ANI Technologies, which owns the Ola brand, as a software development engineer. He has been accused of accessing Aadhaar information in January 2017 through an app named ‘Aadhaar e-KYC’, which was available on the Google Play store till recently.
Police said Srivastav had developed five apps and made ₹40,000 from advertisements displayed on them. Police are now scanning all his apps to see whether more violations were committed. The Aadhaar e-KYC app was downloaded over 50,000 times from the Google Play store since its launch in January, the police said.
City Police Commissioner T. Suneel Kumar said that based on the complaint, six teams of police comprising 26 personnel were formed to nab Srivastav and they tracked him down to Koramangala after a week. He has been accused of using the services of another app, ‘e-hospital’, which is listed as an authenticated user agency (AUA) authorised to access UIDAI data.
A senior police officer said there were around 400 entities that have been authorised to access the data for authentication. Srivastav’s company was not among those authorised.
A native of Kanpur, Srivastav completed his M.Sc. in Industrial Chemistry from IIT-Kharagpur and joined a private firm in 2010 as a security researcher. He launched Qarth technologies in 2012 and shut it down in 2016 owing to financial reasons. In March 2016, Ola announced that it had acquired Qarth and its mobile payments product, X-Pay. Srivastav then joined another private firm before joining ANI Technologies last year.
Investigation revealed that the e-hospital company is not aware of his activities. However, further probe is on to ascertain the facts.
The ability of a software engineer to bypass strict protocols set in place by the UIDAI to access critical data puts the spotlight firmly on the security measures employed to protect Aadhaar data.
Police investigation have revealed that Srivastav had piggy-backed on the infrastructure of another app for hacking the data base.
“Aadhaar related information, legally housed by the National Informatics Centre server, was illegally and without authorisation accessed and used to support this mobile application,” said the police statement.
Srivastav, in order to give his ‘Aadhaar e-KYC’ app an air of authenticity, hacked into the server of the NIC, which houses the e-hospital system, which is a solution for government hospitals to handle patient care and other services, including medical records management.
As part of its regulations, the UIDAI accords certain agencies the title of an AUA, which can then provide Aadhaar-enabled services to the cardholder. For authentication, these agencies have to connect to the Central Identities Data Repository (CIDR) through the services of a Authentication Service Agency (ASA). ASAs are bound by regulations that stipulate encryption of data and logging of access.
The 'e-hospital’ platform had access as a registered AUA. Srivastav used this server to route his app requests for data access and managed to steal the data, the police said.
Question raised
In 2016, a paper titled ‘Privacy and Security of Aadhaar: A Computer Science Perspective’ by the Computer Science and Engineering Department of IIT-Delhi raised the question of leakage of Aadhaar number from an AUA.
The paper, which also discusses several other possible threat scenarios, said, “This, however, does not fully mitigate the risks and the possibility of leakage of the Aadhaar number from an AUA, either from the database, or during “Know Your Customer” (KYC) processes, or even during availing services, cannot be ruled out. In particular, there appear to be no safeguards or even guidelines, either technical or legal, on how the Aadhaar number should be maintained and used by various AUAs in a cryptographically secure way, and how to prevent the Aadhaar number of an individual from becoming public.”
The kidnapped schoolboy was rescued by the police and reunited with his parents. Son of a gift shop owner from Basavanagudi area in Bengaluru, Chirag has reportedly told police that decided to make some quick money to spend on cricket betting and gambling after learning kidnap tricks from the ‘Crime Patrol’. According to police, Chirag reached a private school around 3pm on Tuesday on a Bounce rental bike and zeroed in on a fourth standard student who was walking out of school. He told the boy he was his father's friend and that he required help to search for a relative who had gone missing. The boy believed Chirag and rode pillion on the bike. Chirag then engaged the boy in conversation and learnt about his father's business and got his mobile phone number. He then made a call to the boy's father, demanded Rs 5 lakh and warned him against approaching cops. However, the boy's father alerted Cottonpet police and special teams were formed to crack the case. While Cottonpet inspector Venkatesh TC's squad verified CCTV footage in and around the school, Chamarajpet inspector BG Kumaraswamy's team started tracking the suspect's mobile phone movements. An hour later, the suspect's location was traced to a hotel on the Lavelle Road-St Mark's Road stretch. Police rushed there, rescued the boy and arrested Chirag.
Comments
Add new comment