Audit finds Bengal-specific access curbs in ECINET code

The Election Commission of India’s (ECI) portal , ECINET, carries a feature that can bar Electoral Registration Officers (EROs) and Assistant EROs (AEROs) only in West Bengal from reviewing voters’ enumeration forms and viewing the notice-and-hearing dashboard, according to a third-party audit of the portal’s publicly served code.

The audit –– conducted by civic-tech initiative Charchagram –– found the feature present in code fetched as recently as October 19. No such exclusion for EROs and AEROs in the code for any other state was found.

HT couldn’t independently verify the audit. The exercise couldn’t ascertain whether the feature was used or when it was introduced. ECI did not respond to a questionnaire sent by HT.

Also read: ECI reverses stand on searchable electoral rolls; adds no safeguards against misuse it once cited

The audit –– carried out on October 2, 6, 7, and 9 –– by Charchagram data scientist Saurav Rajput found that the “View Enumeration Form Details” tile was available to officers on the SIR Phase II landing page, with an exception written into the code for West Bengal.

“The ‘View Enumeration Form Details’ is a general tile available to SIR Phase II landing page,” Rajput said. “West Bengal is separately hard-coded in the codebase and excluded from it (for ERO and AERO).”

The same exclusion covered the notice-and-hearing dashboard, a window designed to track, process, and clear notices and hearing actions related to voter registration and electoral roll revision.

The View Enumeration Form Details page lists each form with its constituency, part and serial number, the elector’s voter ID number and name, who submitted the form, the documents uploaded, and the booth level officer’s recommendation. It also holds documents labelled “ERO/AERO-Document” and “Hearing-Order”, and has buttons to send a form back to the BLO or flag an elector as a previous-SIR elector.

Rajput said the audit was limited to what the site served publicly. “We reviewed only the front-end JavaScript bundle that the site serves publicly. It loads before any login, and anyone can open it in a browser. We called no endpoints and used no login or credentials at any point,” he said.

To be sure, the audit only confirms restrictions imposed on the frontend. “Server-side enforcement isn’t visible to us,” Rajput told HT. Asked if the rule existed in earlier builds, he said, “We don’t know. We did not have access to earlier versions, so we cannot say whether the rule existed before or has changed.”

The current build was introduced on October 16. Rajput said the feature has existed in the app at least since September 28, when he first saw it. The special intensive revision was the most contentious in West Bengal, where it resulted in the disenfranchisement of 2.71 million people.