Abhinav Srivastav, 31, an IIT-Kharagpur graduate, has been arrested by the Bengaluru city police on the charge of accessing Aadhaar data, the police said in a statement.
The arrest made on August 1 followed a complaint filed against him by the Unique Identification Authority of India (UIDAI) last week.
Srivastav, currently employed by ANI Technologies, which owns the Ola brand, as a software development engineer, has been accused of accessing Aadhaar information in January 2017 through an app named ‘Aadhaar e-KYC’, which was available on the Google Play store till recently.
Police said Srivastav had developed five apps and made ₹40,000 from advertisements displayed on them. Police are now scanning all his apps to see whether more violations were committed. The Aadhaar e-KYC app was downloaded over 50,000 times from the Google Play store since its launch in January, the police said.
City Police Commissioner T. Suneel Kumar said that based on the complaint, six teams of police comprising 26 personnel were formed to nab Srivastav and they tracked him down to Koramangala after a week. He has been accused of using the services of another app, ‘e-hospital’, which is listed as an authenticated user agency (AUA) authorised to access UIDAI data.
A senior police officer said there were around 400 entities that have been authorised to access the data for authentication. Srivastav’s company was not among those authorised.
- 2012: Abhinav Srivastav launches Qarth Technologies Pvt. Ltd., the company named in the complaint by Unique Identification Authority of India.
- 2016: Qarth, and its product X-Pay, are acquired by ANI Technologies, which owns Ola brand.
- 2017 January: Srivastav develops ‘Aadhaar e-KYC’ app and launches it on Google Play Store. The app earns him ₹40,000 from advertisements.
- July 27: Police receive complaint from an UIDAI official in which Srivastav and others of Qarth Technologies are listed as accused.
- July 29: Based on the complaint, city cyber-crime police take over investigation and form six special teams.
- August 1: The accused is traced to Koramangala and arrested.
A native of Kanpur, Srivastav completed his M.Sc. in Industrial Chemistry from IIT-Kharagpur and joined a private firm in 2010 as a security researcher. He launched Qarth technologies in 2012 and shut it down in 2016 owing to financial reasons. In March 2016, Ola announced that it had acquired Qarth and its mobile payments product, X-Pay. Srivastav then joined another private firm before joining ANI Technologies last year.
Investigation revealed that the e-hospital company is not aware of his activities. However, further probe is on to ascertain the facts.
The ability of a software engineer to bypass strict protocols set in place by the UIDAI to access critical data puts the spotlight firmly on the security measures employed to protect Aadhaar data.
Police investigation have revealed that Srivastav had piggy-backed on the infrastructure of another app for hacking the data base.
“Aadhaar related information, legally housed by the National Informatics Centre server, was illegally and without authorisation accessed and used to support this mobile application,” said the police statement.
Srivastav, in order to give his ‘Aadhaar e-KYC’ app an air of authenticity, hacked into the server of the NIC, which houses the e-hospital system, which is a solution for government hospitals to handle patient care and other services, including medical records management.
As part of its regulations, the UIDAI accords certain agencies the title of an AUA, which can then provide Aadhaar-enabled services to the cardholder. For authentication, these agencies have to connect to the Central Identities Data Repository (CIDR) through the services of a Authentication Service Agency (ASA). ASAs are bound by regulations that stipulate encryption of data and logging of access.
The 'e-hospital’ platform had access as a registered AUA. Srivastav used this server to route his app requests for data access and managed to steal the data, the police said.
Question raised
In 2016, a paper titled ‘Privacy and Security of Aadhaar: A Computer Science Perspective’ by the Computer Science and Engineering Department of IIT-Delhi raised the question of leakage of Aadhaar number from an AUA.
The paper, which also discusses several other possible threat scenarios, said, “This, however, does not fully mitigate the risks and the possibility of leakage of the Aadhaar number from an AUA, either from the database, or during “Know Your Customer” (KYC) processes, or even during availing services, cannot be ruled out. In particular, there appear to be no safeguards or even guidelines, either technical or legal, on how the Aadhaar number should be maintained and used by various AUAs in a cryptographically secure way, and how to prevent the Aadhaar number of an individual from becoming public.”
