EC online portal designed to centralise voter deletions from BJP headquarters, Congress alleges

The Congress on Thursday alleged that the Election Commission’s online portal for voter registration and related services was designed to “centralise all deletions and additions from the Bharatiya Janata Party headquarters”.

The allegation came after the Hindustan Times reported that a security researcher had in July flagged vulnerabilities in the poll panel’s voter-services website and ECINET application to the Election Commission and the country’s cyber-security agency, CERT-In.

He had warned that the flaws could expose election officials’ contact details and allow attackers to access or forge data on the application.

Nisarga Adhikary emailed CERT-In on July 8, copying the Election Commission’s complaints address. Nearly three months later, on Monday, Hindustan Times sent questions to both agencies about his findings and did not receive a response.

However, on the next day, CERT-In replied to Adhikary, saying one vulnerability had been fixed and work on the others was “under progress”. It was not clear when the reported fix had been made.

A critical vulnerability indentified by the researcher involved a server that could return the names and mobile numbers of election officials without requiring a login or CAPTCHA security test. He said the information could potentially be collected across states, districts, constituencies and different officer roles.

The latest allegations come amid protests about the Election Commission’s handling of the special intensive revision...

Read more