India’s transport registers are supposed to be closed. A complaint from the Internet Freedom Foundation suggests they are for sale by the lookup.
Records pulled from state systems were circulating through channels that have nothing to do with government, the foundation says. Its account names mobile apps, commercial websites and Telegram groups as resale points, with the underlying material traced to VAHAN, SARATHI, e-Challan and PUC stores.
A single trial was enough to demonstrate the access. Fifteen lookups cost Rs 29 inside one Android app carrying more than 10 million downloads – roughly Rs 1.93 each. The software, listed as Vehicle Information App and refreshed on July 31, returned a result after one query against a staff member’s own car, with consent, and the foundation says it searched no other vehicle.
No login and no one-time password stood in the way. The result returned the owner’s full name, father’s name, present and permanent addresses, financier details, insurance policy numbers, chassis and engine numbers, and pollution certificate data.
The official Parivahan portal masks those fields. The third-party route does not, which is the center of the complaint.
A registration number is an awkward identifier to leak. It is printed on both ends of a car, quoted in parking systems, tolling and traffic enforcement, and it ties a place to a name. At two rupees a search, nobody needs an insider or a breach to convert it into a home address.
India has been tightening vehicle cyber rules, including AIS-189 for connected cars, but those rules cover the vehicles. The registry that identifies their owners sits in a different conversation.
