Audit finds Bengal-specific access curbs in ECINET code

Audit finds Bengal-specific access curbs in ECINET code

The Election Commission of India’s (ECI) portal , ECINET, carries a feature that can bar Electoral Registration Officers (EROs) and Assistant EROs (AEROs) only in West Bengal from reviewing voters’ enumeration forms and viewing the notice-and-hearing dashboard, according to a third-party audit of the portal’s publicly served code.

No such exclusion for EROs and AEROs in the code for any other state was found. The audit –– conducted by civic-tech initiative Charchagram –– found the feature present in code fetched as recently as October 19.

But the hearings for the logical discrepancy process dragged on as ECI and the West Bengal government clashed over the rank of officers deputed to be EROs. He called it a violation of Sections 13B and 13C of the Representation of the People Act, which make the ERO responsible for preparing the rolls and place AEROs under the ERO’s control.

Trinamool Congress MP Abhishek Banerjee , on February 21, had alleged that EROs in Bengal were “no longer able to monitor” AEROs’ progress on ECINET in the conduct of SIR.

Feature blocks access to enumeration forms and hearing dashboard

“West Bengal is separately hard-coded in the codebase and excluded from it (for ERO and AERO). “We reviewed only the front-end JavaScript bundle that the site serves publicly. It loads before any login, and anyone can open it in a browser. To be sure, the audit only confirms restrictions imposed on the frontend.

The current build was introduced on October 16. Rajput said the feature has existed in the app at least since September 28, when he first saw it. The special intensive revision was the most contentious in West Bengal, where it resulted in the disenfranchisement of 2.71 million people. The exercise began on November 4 last year.

“The ‘View Enumeration Form Details’ is a general tile available to SIR Phase II landing page,” Rajput said. Rajput said the audit was limited to what the site served publicly. We called no endpoints and used no login or credentials at any point,” he said. “Server-side enforcement isn’t visible to us,” Rajput told HT. Asked if the rule existed in earlier builds, he said, “We don’t know.

We did not have access to earlier versions, so we cannot say whether the rule existed before or has changed.