Data of 45 lakh veterans goes missing; FIR filed

The Delhi Police has filed an FIR against a private company, on a complaint by the Defence Ministry, for allegedly not returning a database containing personal information of 45-lakh ex-servicemen after it completed a contract for ECHS smart cards, officials said.

The case was unearthed in RTI applications and subsequent follow-ups filed by activist Commodore Lokesh Batra (retd).

He was recently informed by a Defence Ministry official through an email -- a copy of which is with PTI -- that the Delhi Police registered the FIR on December 19 against a private vendor who allegedly did not handover the personal data of the 45 lakh ex-servicemen enrolled in the Ex-Servicemen Contributory Health Scheme (ECHS).

Batra had sent an RTI query seeking file notings about the issue.

The notings received in response to the RTI application show that "in the absence of any written confirmation in form of 'Confidentiality Certificate' from the firm, the security of the database of ECHS beneficiaries cannot be confirmed."

The ministry has alleged that Score Information Technology (SITL) was given a five-year contract in 2010 for the development of smart cards for ECHS but after the expiry of contract in 2015, the company did not return the database, source code, keys and computer applications, the file notings show.

The ministry claimed that neither did the STIL return the personal database, nor did it confirm that they are not holding it and also alleged that the company has also not returned source codes and key, necessary to make changes in the database, it says.

The company, in response to a legal notice from the ministry, has strongly denied the allegations, saying the data has been returned, the notings show.

After accessing file notings and detailed communication exchanged at various levels on the issue, Batra, a navy veteran, asked the Defence Ministry to explain the action taken against the company.

"With reference to your email referred to above in the subject line, you are informed that FIR has been lodged against M/s Score Information Technologies Private Limited and its directors and employees by Central Organisation, ECHS on December 19, 2019 at Police Station, Sadar Bazar, Delhi Cantonment," Under Secretary AK Karn in Department of Ex Servicemen Welfare told him.

The officials have noted in files that data which have been handed over to Central Organisation, ECHS, responsible for implementation of the scheme, vide the certificate dated November 5, 2015 comprises only front-end software and source code of MIS module. However, the source codes and keys required for making changes in the database have not been handed over to this office, it shows.

"...Regarding the confidentiality of the data the firm has committed to abide by the provisions of the agreement which does not mention about the confidentiality certificate, however, in the absence of any written confirmation in the form of 'Confidentiality Certificate' from the firm the security of the database of ECHS beneficiaries cannot be confirmed," a Colonel ranked officer noted.

The company had said that the transactions on the smart cards only took place at respective parent polyclinic and accordingly, the said transactional database is available at respective polyclinic, the notings show.

All transactions from authentication, key loading, fingerprint acquisition, etc were done locally by a central organisation, ECHS, it said.

"In the premises, the question of possession of above does not arise by our client. Further Database as generated upto June 30, 2015 was duly handed over in CD which was acknowledged by your client (Central Organisation, ECHS) on July 6, 2019," the company said in response to the notice.

In December 2002, the government had sanctioned ECHS healthcare scheme to cater for medical care of all ex-servicemen (ESM) in receipt of pension, including disability and family pensioners and dependents.

An agreement was signed between the MD ECHS and M/s Score Information Technologies Limited (SITL) in January 2004 to develop smart cards for an amount of Rs 89.99 per card, valid for a period of five years, which was later extended by one more year, Comptroller and Auditor General had noted in its 2015 report.

It said renewal of agreement, which was to be done at the same cost, was however carried out in 2010 at an enhanced cost of Rs 135 per card against the existing cost of Rs 89.99.