BENGALURU, JULY 29, 2017 00:00 IST
Complaint was filed by UIDAI against a startup
Two days after a case was booked against a Bengaluru-based startup for ‘misusing’ the Aadhaar database, Unique Identification Authority of India (UIDAI) sources claimed on Friday that the database was not ‘hacked’ nor has there been a ‘data breach’.
The clarification comes in the background of a criminal complaint being lodged against Qarth Technologies Private Ltd., an erstwhile mobile payment startup, for using Aadhaar data without permission.
A case was filed under Section 66 of the IT Act, 2000, which deals with hacking of a computer resource.
The FIR says that the suspect, Abhinav Srivastava, created a mobile app and has been giving out e-kyc, misusing data from the Aadhaar website. He did not seek permission from UIDAI before tapping into the website.
Sources said the complaint by UIDAI says that the firm may have misused unknown Authorised User Agency (AUA), which gives access to biometric data or Authorised KYC User Agency (KUA), which gives access to demographic data.
Probe details
“The investigation should establish the authentication that was used by the mobile payment app to communicate with the Aadhaar database to verify the KYC of its customers. The online trail of the suspect transactions are likely to track down the authentication bridge between the app and the database. The identification of this bridge will throw more light on whether an authentication password of a User Agency was misused by the firm to access the Aadhaar database or whether the database was hacked into without any authentication password given out by UIDAI,” explained a senior police officer.
The cybercrime cell have begun their probe. Police Commissioner Praveen Sood told The Hindu: “It’s very early to comment on the investigation.”
Abhinav Srivastava had on Thursday claimed that the firm had become defunct in March 2016 and the app was not available. However, officials said the complaint indicated that the app was active even in the second week of July 2017.
Srivastava was not available for comment.
Sources said he is yet to be summoned or arrested.
Ola clarifies
Ola, which acquired Qarth last year, said in a statement: “Ola has neither commissioned nor is involved in any such activity. No such complaint has been brought to our notice.”