Why the ECINet needs an independent audit

When ECINet absorbed ERONet and amalgamated 40 other apps, the alarm bells hadn’t yet rung. When investigative reports revealed the extent of ECINet’s malfunctioning, the ECI responded with excuses, evasiveness, obfuscation. It’s only a technical glitch; it’s only a few errors; voters still have the right to appeal; mistakes can still be corrected… and so on, ad nauseum.

When over 13 crore voters found they had been deleted from the electoral rolls under the auspices of the SIR, the ‘faults’ seemed designed to exclude. It will take more than the measures hurried out by the ECI, more than a stage-managed audit, to restore the people’s faith.

Take our word for it: all is well. That, in a nutshell, is the stubborn defence of the Election Commission of India in the face of mounting evidence that the electoral system is broken, the commission has ceased to function independently, and the special intensive revision (SIR) of electoral rolls has been an unmitigated horror show.

In its 250-page affidavit filed in the Supreme Court, the ECI did not deny the allegations raised in the investigative report by the Indian Express on 23 September. It dismissed the petitions as ‘misconceived’ and said newspaper reports cannot count as evidence in court. The affidavit asserts that the ECINet cannot be manipulated and that only authorised officers — the electoral registration officer (ERO) and assistant EROs (AEROs) — can add or delete voter names.

There are several reasons why this is unconvincing. The affidavit itself admits that 89 voters in Goa were indeed ‘left out’ of the voter roll by the SIR. Stating that most of the names have since been restored does not answer two key questions. Why were they deleted? And why was the ERO not able to restore them in the first place?

If ECINet is truly not being remote-controlled from the ECI headquarters in New Delhi, the ERO should have been able to restore the wrongly deleted voters. In fact, he had repeatedly flagged his inability to do so and claimed to have sent eight reminders in seven days to Nirvachan Sadan. He brought the ‘glitch’ to the notice of ECI IT chief Seema Khanna but received no response.

Even more troubling are the allegations surrounding West Bengal, where the ECI claims it was unaware or uninvolved in the 16 lakh voter appeals filed to exclude names cleared during judicial scrutiny. The affidavit swears that the state CEO was authorised to act as per provisions in the Representation of the People Act and that the issue was never escalated to the ECI. It fails to explain a file entry in August 2026 by election commissioner S.S. Sandhu, which records the same CEO telling him she had no information on this matter and no idea how so many appeals were filed on identical grounds.

Then there’s the deafening silence surrounding the technical audit conducted by Charchagram, a civic-tech group that exposed a software feature in ECINet that could bar EROs and AEROs from reviewing voter enumeration forms and viewing the notice-and-hearing dashboard. When this was detected by the audit team on 19 October, the restrictive feature applied only in West Bengal. While the findings were reported by multiple media outlets, the ECI stayed mum.

Charchagram uncovered a feature to classify electors as ‘VIP’ voters and generate downloadable lists. Who counted as a VIP, and what were the implications? Answer there was none.

The affidavit is also economical when it comes to ECs Sandhu and Vivek Joshi writing to the cabinet secretary to register their unease about work being redistributed without their knowledge or consent. They note that their request for an audit of ECINet was halted by Maneesh Garg, an officer whose order they questioned. The affidavit states that the order (in July 2026) was never implemented.

But why was the order issued? How could Garg refuse to show a file to the election commissioners? What happened to Garg after his role was flagged? How and when was Garg posted to the ECI and at whose behest?

The fact that an audit of ECINet is being carried out by a committee of experts from IIT and the Indian Institute of Science is less than reassuring. The decision was taken only after the Indian Express report was published. Joshi had proposed an audit in May, Sandhu endorsed it in July and then again in August.

What we need is an independent audit, not a stage-managed one.

****

The concerns are legion: were notice requirements met, objections heard, reasons recorded and the right to appeal honoured? Documented defects in ECINet, digital forms, automated workflows, backend software processes make a strong case for an independent technical and legal audit to determine manipulation, whether errors were accidental and whether statutory safeguards worked.

The ECI’s narrow brief on verifying role-based access, data security and operational flexibility is unlikely to investigate documented translation and transliteration absurdities like Ramhit Yadav (Ram 'hit' Yadav) becoming Ram ne Yadav ko mara, the large-scale flagging of ‘logical discrepancy’ on trivial, frivolous and dubious grounds, or access-control mechanisms.

Nor is it likely to seriously investigate the staggering security vulnerabilities pointed out by independent researchers like Nisarga Adhikary or the objections of serving commissioners.

If, as the ECI would have us believe, the ECINet implemented every statutory procedure correctly, then every voter addition, deletion, restoration, discrepancy notice and access decision can potentially be reconstructed from logs and audit trails. If so, why object to an independent audit?

The ECI invoked exemptions under the RTI Act to withhold information about ECINet’s software (application, version and other technical details) on the grounds of ‘commercial confidence, trade secrets and intellectual property matters’. But critical public systems — banks, defence, aviation — regularly undergo rigorous security audits without public disclosure of proprietary code. Why exempt ECINet?

Election-security doctrine worldwide begins with the assumption that software cannot be trusted absolutely. The US system requires ‘software independence’, meaning an undetected software error should not be capable of causing an undetectable error in election outcomes.

Voting systems in several democracies are subjected to certification, penetration testing or independent review without surrendering intellectual property rights. Therefore, even if TCS, which was awarded the ECINet contract, legitimately retains intellectual property rights, this does not automatically preclude a confidential audit by CAG-appointed experts, CERT-In, a parliamentary committee, a court-appointed technical panel or an independent third-party assessor. A constitutional democracy requires citizens to be able to verify that electoral data are handled lawfully.

An audit does not presume wrongdoing. It seeks to establish whether wrongdoing, software error, procedural failures did occur — or if all was indeed well.