Govt IT test lab to audit EPFO's suspended Aadhaar seeding app over data theft concerns

New Delhi: Standardisation Testing and Quality Certification (STQC) directorate has been asked to conduct an audit on CSC-designed EPFO app for Aadhaar seeding, which was suspended earlier this year after facing a glitch, Common Service Centres (CSC) Chief Dinesh Tyagi has said."The IT Ministry wrote to STQC for auditing the application which was being used for purpose of seeding of Aadhaar in EPFO. We, thereafter, requested STQC to send their team for auditing and are now awaiting their confirmation," the CSC CEO told PTI.Tyagi was replying to a specific query on the action taken by CSC -- whose vast network acts as access points for delivery of a host of digital services -- in the aftermath of the EPFO-related controversy that had erupted earlier this year.[caption id="attachment_4491425" align="alignleft" width="380"]

Representational image. AP[/caption]The said CSC-designed application is not in operation since (then), Tyagi pointed out.STQC directorate is an attached office of the Ministry of Electronics and IT, involved in certifying entities and products through audit and testing.STQC offers quality assurance services in the area of electronics and IT through countrywide network of labs and centres. It also provides testing, calibration, IT and e-Governance, training and certification to public and private organisations.The proposed audit by STQC comes after retirement fund body EPFO, in May this year, revealed it has discontinued services provided through CSC "pending vulnerability checks".The statement from the Employees Provident Fund Organisation (EPFO) had followed reports of a letter purportedly written by EPFO Central Provident Fund Commissioner V P Joy to CSC's CEO, Dinesh Tyagi on March 23 flagging a data theft issue.Announcing the suspension of CSC services, the EPFO had stated at that point that: "Warnings regarding vulnerabilities in data or software is a routine administrative process based on which the services which were rendered through the CSC have been discontinued from 22 March, 2018".The EPFO had also said that all necessary measures were being taken to ensure that no data leakage takes place.When the incident came to light, a top IT ministry official had assured that since a vulnerability had been flagged, the ministry would take action to plug the gaps in case they existed.Separately, Aadhaar-issuing body, Unique Identification Authority of India (UIDAI) too had clarified that there was no data compromise from its servers, and had asserted that the Aadhaar database remained "safe and secure".Tyagi had maintained that while the application had been designed by the CSC, it was being hosted on EPFO data centres and servers