Based on Whistleblower’s letter NGO Flags Major Security Risk in Telangana’s Smart Card Supply

Calls for Urgent Probe Over Non NIC- SCOSTA Compliant Chips in Telangana’s Smart Card Supply Chain

Hyderabad, May 2024: Raahat, the Safe Community Foundation, a prominent non-governmental organisation (NGO) dedicated to public safety, has, based on an unnamed whistle blowers letter dated 1st May and copy of email dated 8^th May received by Dr. Kamal Soi, raised significant concerns over the procurement practices of the Telangana Transport Department regarding smart cards. The foundation’s chairman, Dr. Soi, has lodged a detailed complaint with the Transport Minister, Government of Telangana, highlighting potential national security risks associated with the use of substandard Chinese chips in smart cards supplied by M/S. Colorplast India Pvt. Ltd.

Dr. Kamal Soi, speaking to media said, we came to know of an issue in the state of Telangana, which not only involves malpractice in the transport department, is also a threat to the nation, the state and our own safety. A whistle blower had shared a letter mentioning several discrepancies involving someone inside and outside transport department, resorting to malpractices and scam. When we went into the depth of it, we realised it’s an issue deserving to be taken up as a public interest matter. All of us have driving license and vehicle registration details, this data could be compromised putting us to risk. Telangana issued a tender for smart card and assigned it to a company, which violated the Government of India guidelines called SCOSTA. The safety of the chip in the smart card is very important. Generally, most such chips are sourced from manufacturers in Germany, USA and Korea. The chip is an important component with microprocessors, which store data and transmit data. Any discrepancy in the chip can lead to data hacking, data breach and data compromise. Which a not only a threat to the nation but for all individuals like us. As you are aware, today 99% of crimes are vehicle borne crimes, committing crime becomes easy for someone having your vehicle registration or driving license. The company involved in creating smart cards in Telangana has entered into a SCOSTA agreement with the Transport department. But a whistle blower from the company shared with me the discrepancy of Chinese chip being used. I had a meeting with the transport officials and discussed about the discrepancy, they in turn promised to initiate an enquiry. We shared the series of numbers of Chinese chips being used. China can secure the data from such chips and misuse it. Though the department took it seriously initially after I met them on May 8^th, 2024, but they stopped attending to my calls and was left with no option but toreach out to the media and bring it to the notice of the public. This can involve data leakage, data compromise, can be a financial scam or some vested interests of department officials, therefore appeal to media to highlight the issue for the Government to take it seriously.

Given below are some of the contents of that whistle blowers letter received by Dr. Soi:

However, it has come to my attention that the company may have engaged in activities that compromise data security and confidentiality, particularly in government projects. Moreover, there are allegations of the use of substandard Chinese materials, in blatant violation of tender specifications, which pose a significant risk to the integrity of the projects undertaken.

…..

Of particular concern is the alleged unauthorized transfer of government ID data to China, which not only violates legal regulations but also presents a grave national security threat. It is imperative that such allegations be thoroughly investigated to safeguard the interests of our nation and its citizens.

….

The consistent failure to deliver materials that meet specified standards undermines the quality and effectiveness of government projects. It is the standard practice followed by M/s. Colorplast to show compliance at the time of award of tender/contract agreement and thereafter, at the time of execution, using fake, substandard, and noncompliant SCOSTA Smart Cards.

In February 2023 my ex-employer M/s. Colorplast was awarded a tender by Telangana State Transport Department to supply Pre- Printed PVC 64K SCOSTA Smart Cards on Rate Contract basis for 1 year. It is submitted that M/s. Colorplast, is following the same illegal, fraudulent, and malafide practices by supplying non-compliant SCOSTA smart cards, as specifically required and mandated in the tender.

Details of a few of these cards that I have come across are given here in below:

Series RC0380000/24 onwards series

Series RC0460000/24 onwards series

Series DL0358000/24 onwards series

Series DL0284000/24 onwards series

Series DL0362000/24 onwards series

Such illegal practice is a serious threat to the safety and security of the data/information of the State Transport Department as well as India which is a serious criminal act by the Company as these module/chips of Chinese origin poses a serious threat to India’s cybersecurity and national security interests due to potential backdoor access, data breaches, or espionage.

Use of such non-approved chips lack the necessary security protocols and standards mandated by SCOSTA (Smart Card Operating Systems for Transport Applications), leaving smart cards vulnerable to hacking, data breaches, and unauthorized access. This not only compromises user privacy but also undermines trust in smart card systems. Ensuring SCOSTA-approved chips is essential to ensure the integrity and security of the Transport Data in India.

As per the Whistle blower the core of the controversy lies in allegations that the smart cards supplied by M/S. Colorplast India Pvt. Ltd. are equipped with non SCOSTA compliant chips, which do not meet conditions set forth in the RFP issued by the Telangana Transport Department and the standards set by the Smart Card Operating Systems for Transport Applications (SCOSTA) mandated by the National Informatics Centre (NIC).

The whistle blowers letter received by Dr. Soi has further highlighted that:

It is submitted to the M/s. Colorplast had followed the same illegal, fraudulent, and malafide practices in the State of Gujarat as well by first it took the work with malafide intentions and thereafter supplying substandard, low, and cheap quality material to the State Transport Department.

….

Similarly in the State of Bihar also M/s. Colorplast followed the same illegal, fraudulent, and malafide practices by taking the work with malafide intentions and thereafter supplying substandard, low, and cheap quality material to the State Transport Department.

Further the RFP Page No: 6, Schedule: I, Clause: A.5 – Quality Checklist states:

• The Bidder must submit an undertaking that in the event of acceptance of the bid submitted by it and subsequent award of order, it shall use only SCOSTA certified smart card product certified by NIC towards the fulfilment of the order and shall keep the SCOSTA certificate renewed and/or upgraded asper the latest amendments issued by NIC.

• The quality check of the Smart Cards shall be undertaken by the Department or any Govt. approved agency or any other Authorized Agency recommended by the Transport Department. The cost for the Quality Check of the Sample Cards is to be borne by the bidder. Details will be informed to the successful bidder during the contract period.

As per the above clause the quality check of the materials supplied can be done by the Department at any time. Further to the best of my understanding it is also been defined in Award letter that testing of the samples have to be done through NIC New Delhi.

QUESTION IS >>>HAS THIS EVER BEEN DONE? IF YES WHAT ARE THE FINDINGs?

Dr. Soi, Chairman Raahat has lodged a detailed complaint with the Transport Minister, Government of Telangana, where he has urged the Telangana authorities to conduct a thorough investigation into all supplied smart card batches to verify their compliance with SCOSTA standards. He has advocated for severe penalties against the vendor, including financial repercussions and strict measures such as blacklisting from future Government contracts. Additionally, he has called for systemic changes to prevent such breaches in the future, underlining the need for increased security and regular compliance checks within Government procurement processes.

In light of these developments, Dr. Soi urges the media, as the fourth pillar of democracy, to highlight the urgent need for stringent regulatory oversight and proactive governance to safeguard citizens’ data and maintain national security. The outcome of any investigations and subsequent actions taken will be critical in determining future practices and regulations in the smart card industry, impacting policy-making and regulatory frameworks within government contracts and supply chains across India.

I trust that thru the intervention of the media, as the fourth pillar of democracy the Transport department shall take swift and decisive action to rectify this situation. However, despite your intervention, should remedial measures not be forthcoming, I will be compelled to explore further legal recourse in the interest of public welfare.

About RAAHAT

RAAHAT is a non-profit, non-government Organization, under the name and style of “Raahat the Safe Community Foundation” registered under the Societies Act 1860 bearing Registration No. 467/2005. RAAHAT, established and working since 2006 to ensure effective implementation of various policies and guidelines in various fields for ensuring rights and benefits to the public at large coupled with compliance of various laws, for the health, safety and well-being of the general public of India, besides seeking effective implementation of the laws relating to Motor Vehicles Act and Rules and making people at large aware of the basic Traffic Rules, Regulations made for their safety and security thus avoiding loss of lives and road accidents.

For further information contact

Dr Kamal Soi

Email: kamaljsoi@gmail.com

Mobile: +91 78639 00003 +91 98150 33333.

Phd, MSc, MBA, LLB, MEP (IIMA), MDP (ISB), MITE, MACRS, MCIHT. ASSE (Sustainable Safety Expert)

President – GSHP, Global Society of HSE Professionals

Ex Vice Chairman -PSRC, Department of Transport, Government of Punjab.

Member- NRSC

GOVERNMENT OF INDIA, Ministry of Road Transport & Highways.

Chairman@Raahat – The Safe Community Foundation

Member -European Association for Accident Research & Analysis

Adviser -European Union, Member- International Road Federation Member – IEEE, Member -ASSE (American Society of Safety Engineers)