Stories
Congress Alleges Centralisation of Electoral Rolls After ECINET Security Flaws Exposed
- •The Congress party alleged that security vulnerabilities flagged in the ECI's ECINET application point to the centralisation of electoral roll changes from BJP headquarters.
- •Security researcher Nisarga Adhikary reported critical flaws in the ECI voter-services website and ECINET Android app to CERT-In and the poll panel on July 8.
- •CERT-In acknowledged and fixed only one hardcoded encryption key vulnerability on October 6, months after the initial report and following media inquiries.
- •Adhikary warned that the flaws could expose official contact details, allow SMS abuse, and leave cVIGIL endpoints accessible without proper login credentials.
- •The controversy coincides with separate concerns over Electoral Registration Officers losing access to the voter-roll database and internal disagreements among election commissioners.
Key Questions Answered
Security researcher Nisarga Adhikary reported vulnerabilities to CERT-In on July 8, 2026, including a server linked to the voter portal that could return election officials' names and mobile numbers without a login or CAPTCHA. He also found disabled communication checks and hardcoded encryption keys in the ECINET Android app, alongside live cVIGIL endpoints returning valid responses without individual logins. CERT-In later confirmed that a hardcoded AES key vulnerability had been fixed by October 6, 2026.
Congress and various state officials alleged that ECINET centralizes electoral roll changes and restricts Electoral Registration Officers (EROs) from properly accessing the database to carry out statutory additions and deletions. Reports highlighted issues like Goa officials failing to process additions after multiple attempts, while the ECI maintained that the platform is decentralised with statutory duties remaining with field personnel.
The Election Commission launched ECINET on January 22, 2026, as an integrated digital platform incorporating over 40 applications and web services like ERONET, cVIGIL, and Suvidha. While field officials retain statutory responsibilities, centralized cybersecurity is handled by the ECI, which previously countered millions of malicious hits during general assembly elections and counting days.
