Daybreak - Why does Digiyatra have a new app? The real reason is a scam

Episode Date: May 22, 2024

If you were flying sometime last month, you may have noticed, staff from Digiyatra, the contactless, biometric entry system at airports, were repeating the same thing over and over again to passengers at the entrance: “The old app is discontinued, please download the new app.” Passengers were only given this information at the airport. None of them received any notifications or SMSes.Apart from inconveniencing passengers, this also sent  alarm bells ringing among some of them. Because, think about it. Usually you're asked to update an app, not delete it and download a new one, right?Anyway, most attributed it to some kind of a tech upgrade, which was also what Digiyatra Foundation (DYF), the company that runs the app said. Apparently, it was a part of their plan to expand to a larger user base.But you know what? That’s not the real reason. Behind it all, is a scam.Tune in.Daybreak is produced from the newsroom of The Ken, India’s first subscriber-only business news platform. Subscribe for more exclusive, deeply-reported, and analytical business stories.P.S. Daybreak episodes drop daily now :)

Hi, this is Rohan Dharma Kumar. If you've heard any of the Ken's podcasts, you've probably heard me, my interruptions, my analogies, and my contrarian takes on most topics. And you might rightly be wondering why am I interrupting this episode too. It's for a special announcement. For the last few months, I and Sita Raman Ganesh, my colleague and the Ken's deputy editor, have been working on an ambitious new podcast. It's called Intermission.

We want to tell the secret sauce stories of India's greatest companies. Stories of how they were born, how they fought to survive, how they build their organizations and culture, how they manage to innovate and thrive over decades, and most importantly, how they're poised today. To do that, Sita and I have been reading books, poring over reports, going through financial statements, digging up archives, and talking to dozens of people. And if that wasn't enough, we also decided to throw in video into the mix. Yes, you heard that right. Intermission has also had to find its footing in the world of multi-camera shoots in professional studios, laborious editing, and extensive post-production. Sita and I are still reeling from the intensity of our first studio recording.

Intermission launches on March 23rd. To get alert, as soon as we release our first video. episode, please follow intermission on Spotify and Apple Podcast or subscribe to the Ken's YouTube channel. You can find all of the links at the ken.com slash I am. With that, back to your episode. If you're a frequent flyer, then you know that there is no way to avoid Digi Yatra folks at the airport. The government launched the app back in December 2020 and labeled it as the future of air travel. It is basically an online wallet that has all your ID information plus your biometric data.

A contactless facial recognition-based passenger entry system, to be precise. Every time you're at the airport, Digiathra people will ask you to sign up, saying it's going to help you drastically shorten the wait time outside the airport. But if you were flying sometime around last month, you may have noticed that Digiathra staff was saying the same thing over and over again to passengers, like a broken record. The old app is discontinued. Please download the new app.

Some passengers did not think twice and just wanted to get done with it. But many found it annoying. They ask questions. Because think about it. Usually you're asked to update an app, not delete it and download a new one, right? Also, passengers were only given this information at the airport.

None of them received any notifications or SMSes. Anyway, now you would think that whatever it is, it must be because of some kind of a tech upgrade, right? And actually, that is what those who run Digiata said it was, a part of their plan to expand to a larger user base, apparently. But you know what? That is not the real reason why passengers have been hounded and inconvenienced to download the new Digiata app,

because behind all of it is a scam. Welcome to Daybreak, a business podcast from the Ken. I'm your host, Nick Dha Sharma, and I don't chase the news cycle. Instead, every day of the week, my colleague, Rahal Philipoza and I will come to you with one business story that is worth understanding and worth your time. Today is Wednesday, the 22nd of May. So, first of all, who runs Digi Yatra? It is called the Digi Yatra Foundation or D-YF.

It is a not-for-profit company created to streamline air travel. The Airports Authority of India, or AAI, which is a public sector enterprise responsible for civil aviation infrastructure, holds a 26% stake in DIYF. The rest of it is held by five private airports, Cochin, Bangalore, Delhi, Hyderabad and Mumbai.

Now, to make the app work, so you're able to avoid cues, the app uses facial recognition technology. And in order for it to work, the app collects personally identifiable data along with sensitive facial information. But it is not the government or any government-related body that built this crucial technology. It was a private one-person company called Data Evolve. An AI official told my colleague the Ken reporter Ronakumar Gunjan

that the government paid 10 crores as fee to build Digiatra. Now, here is where it gets shocking. Data Evol's founder, Komi Reddi Avinash, is under investigation for a scam in Andhra Pradesh. He is accused of stealing more than $4 million by cloning the payment gateway services of traffic Echelan accounts. This scam went on for almost five years between 2018 and 2023. So basically, when Data Evolved partnered with DYF to build Digiatra, it was also carrying out the scam side by side. Oh, and fun fact, Komi Reddy Avinash is the son-in-law of the former police chief of Andhra Pradesh. He was finally arrested in November last year and released on bail around three months ago.

Now, the question, what happened to Digiatra after all of this? Stay tuned to find out. Of course, as soon as the scam came to light, DYF wanted to wash its hands off data evolves. Aniti Ayog official who was aware of the developments told the Ken that a restructuring exercise began in February. They said that the tech teams inside DIYF were asked to cut off all ties with data evolve, and that as of now, the company, which is DIYF, has nothing to do with data evolve.

And the whole launch a new app and make passengers downloaded was a part of this restructuring. But if you're thinking, DIYF is the savior in this entire situation, you're quite wrong. The whole process, in fact, has exposed DYF's own questionable practices. Now, this is a part where it gets a tiny bit technical, so please do not zone out. I will try to keep it as simple as possible because we need to understand how this works.

You see, when deals like this take place between a company like DYF and a vendor, which in this case is data evolves, the norm is for the vendor to transfer the ownership of the project to the company. which means that the tech infrastructure for Digiata should be in DYF's name. But that did not happen. Ever since Digiatra began, the old app had been running on the package name,

I.N.dataEvolve.orgiahtra. A package name is the name of an Android app that uniquely identifies it on your device. Also, even the domain name of the old Digiata app ended with DataEvolved.in. Ronuk spoke to a cyber security expert based out of Hyderabad and the person told him that not only was this bad hygiene but also dangerous in terms of data protection. What this basically means is that data evolve, which was being run by a scamster,

could have easily extracted sensitive personal information from users. So, of course, to separate Digiathra from data evolve, the first thing to be done was to change the package name. They thought that would just do it and all users would have to do was to update the app. Now, here is where DYF's laxness backfired on it. Turns out, Google Play does not allow any change in package name, which is why DYF had no other option but to launch a new app with a new package name that did not involve the words data evolve in it.

And in all of this, guess who got the worst end of the stick? passengers and Digi Yatra's airport stuff. Also, it wasn't just about a new app. The cyber security expert explained it to us. Digi Yatra is a part of an elaborate airline ecosystem and the entire software ecosystem had to be altered. Oh, and also a technologist who goes by Kingsley J on X or Twitter also found that Digi Yatra's old app was sending passenger data

to data-in-evolves AWS service. servers and not DIYFs, which means that DIYF did not even have control over the flow of data. So because of all of this, Digiathra was forced to launch a new app. Now, like me, if you thought, Digiata will pay for this in terms of its user base. You are quite mistaken, my dear listener. The new app was downloaded more than 400,000 times in the first 15 days of its launch on the 1st of April. That is more than 10% of the old app's downloads. But here's a more important question that we should be asking. What happened to the data of the more than 3 million people

who were using Digi Yatra's old app? The cybersecurity expert had a rather grim view of this, which is probably true. They said that the data is now owned by the dubious data evolve and it can do whatever it wants with it. The Ken asked YF about the same and as expected, they did not respond. Daybreak is produced from the newsroom of the Ken India's first subscriber-focused business news platform. What you're listening to is just a small sample

of our subscriber-only offerings. A full subscription unlocks daily long-form feature stories, newsletters and podcast extras. To subscribe, head to the Ken.com and click on the red subscribe button on top of the Ken website. Today's episode was hosted by Snikta Sharma and edited by Rajiv Siyah.