ECINET Security Flaws Were Reported Months Before Election Commission App Faced Controversy

Security vulnerabilities in the Election Commission of India's ECINET platform had been reported to the country's cybersecurity agency months before the poll panel came under scrutiny over the functioning of the digital system, documents reviewed by news organisations show. Cybersecurity researcher Nisarga Adhikary reported multiple vulnerabilities to the Indian Computer Emergency Response Team (CERT-In) and the Election Commission on July 8. In a response dated October 6, CERT-In informed Adhikary that one of the reported vulnerabilities had been fixed, while work on the remaining issues was still “under progress”. The development comes as ECINET, the Election Commission's unified digital platform, faces questions over its security architecture and access to election-related information. The platform was launched to bring together more than 40 election-related applications and web services under a common digital ecosystem.

According to the response shared with Adhikary, CERT-In said the vulnerability described as “Client-Side Static Response Encryption (Hardcoded AES Key)” had been addressed by the concerned organisation. The agency asked the researcher to verify the fix from his end and confirm whether the vulnerability had been resolved. The response came almost three months after Adhikary's initial disclosure. The researcher told news organisations that he had approached the Election Commission as well as CERT-In after identifying the issues but said the response from the poll body was largely a standard acknowledgement. “CERT was the organisation I could report the problems to,” he said. The Election Commission had not immediately responded to requests for comment on the reported vulnerabilities.

One of the vulnerabilities identified by Adhikary was rated critical by him and concerned an API associated with the Election Commission's voter-services infrastructure. He alleged that a live ECINET API could return personal information relating to election officials without requiring conventional authentication. According to his account, requests could potentially retrieve officials' names and mobile numbers based on parameters such as state, district, constituency and role. Adhikary said he tested queries using limited parameters and deliberately avoided downloading actual datasets. He also alleged that the information needed to construct valid requests could be found in publicly accessible website code, raising questions about whether the server adequately verified the identity of the person making a request. The researcher said such a weakness, if exploitable as described, could potentially expose officials to targeted phishing, impersonation or unwanted communications. These remain allegations by the researcher and do not establish that the reported vulnerabilities were exploited or that election data was actually stolen.

Also Read: Rahul Gandhi Challenges Gyanesh Kumar, Says He Wants 100 FIRs Over Opposition’s Election Protest

The disclosures also covered the Android version of the ECINET application, which brings together several election-related services and modules. Adhikary said the app contained encryption keys and a fixed access token that could be extracted from the application. He further alleged that certain tokens, phone numbers and information in the observer module were stored without adequate encryption on the device. Another concern involved the verification of communications between the application and Election Commission servers. According to the researcher, some checks designed to ensure that the application was communicating with the genuine server were disabled or insufficient in certain traffic, potentially creating a risk on an untrusted network. He also claimed that two live cVIGIL endpoints returned valid responses without requiring an individual login. However, his disclosure did not allege that he had obtained or misused genuine citizen information or that the vulnerabilities had resulted in a confirmed data breach.

The ECINET platform was launched on January 22 as an attempt to consolidate more than 40 applications and digital services used in election administration. The Election Commission had previously said the platform would subsume services including cVIGIL and Suvidha 2.0, which together had accumulated more than 5.5 crore downloads. The Commission had also said cybersecurity testing was being carried out as part of the platform's development. Adhikary said he examined the official Android application available through Google Play on July 8. The application was subsequently updated several times, with the latest update he identified being released on September 30. The Commission on September 26 ordered a review of ECINET by a committee headed by a senior Deputy Election Commissioner and including an independent expert. The review came amid wider questions about the platform, although the vulnerabilities reported by Adhikary were not directly linked to the separate concerns that prompted that review.

The October 6 CERT-In response provides a timeline showing that at least some of the cybersecurity concerns had reached the government agency well before the recent controversy. CERT-In's statement that one vulnerability had been fixed, while other issues remained under progress, does not by itself establish the severity or exploitability of every issue reported by the researcher. It also remains unclear from the response when the reported fix was implemented and whether all the affected components have since been secured. The episode nevertheless highlights the challenges involved in securing a large election technology ecosystem that combines multiple applications, APIs and categories of administrative information. As ECINET continues to be used, the handling of vulnerability disclosures, independent security reviews and verification of fixes will remain important to determining whether the reported weaknesses have been comprehensively addressed.

Also Read: ‘How Long?’ Rijiju Questions Rahul Gandhi Over Opposition March To Election Commission