 "Despite being a partially government-run service, privacy experts say Digiyatra has a weak governance structure and is unreliable due to a lack of information and disclosures. PTI")
Digiyatra is undergoing a transformation.
However, amid this upgrade to the old version, the government-promoted app is also at the centre of a controversy.
The Digiyatra Foundation, which manages the app, is reportedly parting with its vendor, Dataevolve Solutions, as per Economic Times.
This has brought up major concerns about data storage and misusage.
Here’s all we know about it.
The controversy
According to ET, cyber security experts have expressed caution saying that since Digiyatra was operating on Dataevolve’s infrastructure, the Hyderabad-based company has the potential to misuse data.
Despite being a partially government-run service, privacy experts say Digiyatra has a weak governance structure and is unreliable due to a lack of information and disclosures.
When Digiyatra Foundation was in partnership with Dataevolve, it had access to sensitive citizen information such as facial biometrics and Aadhaar data, according to Internet Freedom Foundation associate policy counsel Disha Verma.
She told the Economic Times, however, the foundation has repeatedly neglected to make the necessary disclosures and its data security audits public, and it has consistently declined to do so even as it is believed to be ending the partnership.
The centre-backed platform is managed by Digi Yatra Foundation, a Not-For-Profit company made under Section 8 of the Companies Act, 2013, as per Business Standard. It does not fall under the purview of the Right to Information (RTI) Act.
Impact Shorts
More ShortsThis latest privacy concern arises as Andhra Pradesh police have accused Dataevolve Solutions of defrauding them of traffic e-challan payments.
Last year, the Enforcement Directorate arrested Komireddi Avinash, CEO of the Hyderabad-based company, for siphoning off funds by cloning payment gateways of traffic e-challan accounts.
Digiyatra’s clarification
The CEO of the Digiyatra Foundation, Suresh Khadakbhavi, has denied allegations that passenger data is being stored and misused. According to him, the data is stored solely on the user’s device and is not transferred.
He explained to ET that parting with Dataevolve was necessary due to the app’s growing user base.
He claimed that, in addition to providing additional features like hotel check-in, the app is getting ready for foreign travel.
“There was a requirement for a complete overhaul of architecture,” he told the outlet.
Khadakbhavi said every infrastructure of the Digiyatra app is owned by the Digiyatra Foundation and there is no chance that any data resides with Dataevolve.
“The complete architecture of the system is owned by Digiyatra Foundation. Service providers may come and go.”
“The data is not stored in a central location. It is there in the device of the passenger only. Once the validation of the passenger is done at the airport, the data is purged,” he said, adding that the foundation conducts audits at airports to ensure the data is purged within 24 hours.
The Centre clarified in February this year that “no central storage of passenger’s Personally Identifiable Information (PII) data” is available on Digiyatra and that the portal was designed with privacy issues in mind, as per Business Standard.
“The Digi Yatra processes are subjected to audits and certification by CERT-In empanelled agencies to ensure adherence to data privacy and security standards,” the Minister of State in the civil aviation ministry, Gen. (Dr) V K Singh (Retd), said in a written reply to a question in Rajya Sabha.
Similar concerns in the past
Notably, this isn’t the first time that privacy concerns about the app have been raised.
Numerous passengers have reported on social media that they were prompted to create Digi Yatra credentials by the airport management.
Union civil aviation minister Jyotiraditya Scindia had clarified that passengers were permitted to choose manual security clearance as an alternative. “Consent of passengers is a prerequisite for taking face biometrics on kiosk-based registration,” he stated.
The ministry said that the Digiyatra guidelines have been issued by the Directorate General of Civil Aviation (DGCA).
“Digiyatra guidelines provide for decentralised mobile wallet-based identity management platforms. The personal information of the passenger is stored in the mobile wallet of the traveller. The same is shared with the departure airport in the encrypted format, and data is purged from the system after 24 hours of departure of the flight,” it noted.
About Digiyatra
Digiyatra offers Facial Recognition Technology, which allows for contactless and hassle-free entry into airports via e-gates.
At several Indian airports, Digiyatra uses facial recognition technology for both admission and security clearance.
According to the Delhi airport website, visitors can have a seamless travel experience by storing their IDs and travel papers on the decentralised storage platform.
According to Financial Express, through the Digiyatra app, passengers can register their credentials and utilise the services. In order to use the app, one must first authenticate using Aadhaar and then take their own photo. Subsequently, the application generates a boarding pass that must be scanned before it can be shown at the electronic gate.
At the e-gate, passengers must scan their bar-coded boarding pass. The facial recognition technology then verifies the passengers’ identities. Passengers can then enter the airport after this. But before boarding a flight, passengers must check in at the security desk.
Currently, Digi Yatra is available to travellers at 14 airports, and by the end of this month, it is anticipated to be available at an additional 14 airports. There are about five million users of Digi Yatra, and the foundation is trying to make the travel experience more convenient for travellers, the report said.
With inputs from agencies