- Civic-tech group Charchagram says ECINET's public code has a setting that could hide two voter-roll tools from West Bengal officers. Auditors found no similar exclusion for other states.
- The audit cannot show whether the setting was used or when it was added. The Election Commission did not respond to the Hindustan Times questionnaire.
- Any system that decides who sees what in a public process needs a record of who changed it and why. Leaders should ask for that record.
When software decides which official sees which screen, a permission setting becomes policy. If that policy lives only in code, outsiders cannot tell when it changes. An audit of India's election portal shows why that matters.
What the audit found
Civic-tech initiative Charchagram audited ECINET, the Election Commission of India's portal for election officials. The audit points to a setting in the portal's code. That setting could keep two voter-roll tools away from officers in West Bengal. The Hindustan Times (HT) reported that the auditors saw nothing like it for any other state.
The affected users are Electoral Registration Officers (EROs) and their assistants. Under the Representation of the People Act, 1950 (Section 13B), the voter list for a constituency is the ERO's to draw up and keep current. MediaNama notes that limiting their tools could therefore touch those legal duties.
The first tool is View Enumeration Form Details. It lists each enumeration form with the elector's name and voter ID, the uploaded documents and the booth-level officer's recommendation. The second is a dashboard where officers track and clear notices and hearings.
Saurav Rajput of Charchagram examined the portal on October 2, 6, 7 and 9. HT said the setting was still visible in code he pulled on October 19. Rajput told HT, "West Bengal is separately hard-coded in the codebase and excluded from it."
How a login page gave this away
Before an officer signs in, ECINET's login page sends the browser a large script file. The Wire published part of the audit. It says the file includes screen names, menu names, labels and data-request addresses meant for officials. Those addresses are called API paths.
The auditors say they used no password and called no API. In the excerpt's words, they "only read files the site serves to everyone".
The code also holds the message "View Enumeration Form Details is not enabled for selected state". The Wire reads that as a sign that access can be switched on or off for each state. Charchagram told The Wire that the software has the means to "give or withhold access by state".
Code like this can mean two things. A menu item may be hidden in the browser. Or a server may refuse to send the data. The reports do not say which applies here. A reader should not assume either.
What the audit cannot show
The auditors cannot tell whether anyone used the restriction. They also cannot say when it was added, HT reported. Rajput told The Wire the team cannot say "whether these features have been used". MediaNama says it has not independently verified the findings.
The Election Commission did not answer HT's questionnaire. Its September 26 press note described officer access as role-based and tied to their legal powers. The note also announced a review panel led by the Senior Deputy Election Commissioner. An outside expert from an IIT or IIIT would sit on it. The note did not say if the panel's report would be public.
Earlier, the Indian Express reported that two Election Commissioners, Sukhbir Singh Sandhu and Vivek Joshi, put objections on paper 14 times across ten months. Reportedly, these dealt with pulling the voter-roll database into one central place. They also dealt with patchy access to ERONET, since folded into ECINET, in some states.
The idea: a switch is a decision that needs a record
The lesson here is simple. A setting that can include or exclude a state is a decision waiting to be made. Whether anyone made it is a separate question. Only a log can answer that.
Think of a bank vault. A lock on the door is ordinary. What counts is the book that shows who opened it, when, and on whose signature. The audit points to a lock. It cannot see the book.
The same code includes a way to disable a State Nodal Officer's account. It also flags certain voters as VIP, with a gold icon beside their names, and offers a downloadable list of them. The code does not reveal the VIP criteria. Each feature is a power over who can see or do what. Each needs an owner and a trail.
Questions for any team running a public-duty system
MediaNama lists open questions on this case. They apply well beyond it.
First, can the team show every change to user access, with who approved it and when? MediaNama asks whether such changes on ECINET are logged. It also asks whether those logs feed the review committee's work.
Second, is every location-specific or group-specific rule written into an order or procedure? MediaNama asks what the state-wise setting is for. It also asks which procedure governs it.
Third, does the system refuse access on the server, or only hide screens? Ask for a test, not an assurance.
Fourth, what can an outsider see before login? The Wire reported that Charchagram had earlier flagged personal details of officials and contractors in ECINET's public code. The Commission then corrected the coding errors.
Code can show that a power exists. Only records can show whether it was used.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: MediaNama.
