A civic tech group’s audit of the Election Commission of India’s ECINet portal says the platform’s publicly served code contains a “VIP” category of voters, a one-click option to download that list, and provisions to disable state-level officers. The group, Charchagram, also says the code bars only West Bengal’s Electoral Registration Officers (EROs) and Assistant EROs (AEROs) from reviewing voters’ enumeration forms.
Charchagram first released its findings in a four-part video series from 28 September. On 20 October, The Hindu and other media reported on the West Bengal provision and the state-level access controls. Karvaan India spoke to Charchagram founder Dipti Arora and data scientist Saurav Rajput about how the audit was done and what it can and cannot prove.
How the audit began
Charchagram describes itself as a civic tech builder. Its main project is RTI Gram, a tool to simplify filing Right to Information applications and build a database of them. The team also reviews technology issues in governance.
Rajput, an alumnus of IIT Delhi and IIM Calcutta, said the ECINet audit followed reports in The Indian Express and by The Reporters’ Collective, which quoted booth-level officers saying they had been asked to mark “VIP” voters. The team wanted to know whether the portal’s front-end code held anything concrete.
“Code can only tell you what is on the website,” Rajput said. Read alongside the media reports, he added, the findings begin to make sense.
What the code shows
Charchagram points to four findings.
VIP voters. The code separates voters into normal citizens and “VIPs.” An official logged in under their credentials can see the VIP list and, Rajput said, download all VIP voters in one click.
Access that can be switched off. According to The Hindu’s report on the audit, ECINet has a state nodal officer management section with a disable action, and a pop-up warns that a disabled officer can no longer access the application. The code also carries a message saying the enumeration form view is not enabled for a selected state, which suggests access can be turned on or off state by state.
A West Bengal exception. Media reports said the audit found a feature barring EROs and AEROs only in West Bengal from viewing enumeration forms and the notice-and-hearing dashboard. No such exclusion was found for any other state, and the feature was present in code fetched as recently as 19 October.
Officials’ details in the open. Internal contact details of senior officials and developers were visible in the code, Rajput told Karvaan India. Karvaan India is not publishing them.
What changed after the videos
Charchagram published its first video on 28 September and its second a day later. By 2 October, Rajput said, the portal had begun blocking automated access, a standard measure that stops tools such as AI assistants from reading a site’s code. The third video followed on 7 October, and he said the exposed details were hidden within 18 hours. The group has kept copies of the earlier and later code.
Two of its four videos were restricted in India. Both have been visible again since a day before the interview.
Provisions, not proof
Rajput repeated one point throughout: the audit shows a feature exists, not that it was used.
“In isolation we can’t prove anything, but obviously these things exist,” he said. He cannot say when the West Bengal restriction was introduced or why, and he acknowledged that someone could argue it was added only recently.
The audit has other limits. Rajput told the media that “server-side enforcement isn’t visible to us.” He also said he had no access to earlier versions of the code. He read only the front end, and told Karvaan India that a skilled specialist could find more. One media report said it could not independently verify the audit.
The Hindu notes that Rajput first located the state-access feature on 28 September, and that the portal itself launched in January.
Why West Bengal matters
The provision lands on one of the most contested electoral exercises in the country. According to media reports, the special intensive revision in West Bengal ended with the disenfranchisement of 2.71 million people. The Supreme Court invoked Article 142 in February to hand hearings to judicial officers, and made EROs and AEROs responsible for satisfying them on documents.
Supreme Court advocate Harshit Anand told the media that denying EROs and AEROs access to forms would cut against those directions in West Bengal’s context, and could impede the judicial officers who rely on their reports. Reports also recalled that Trinamool MP Abhishek Banerjee alleged in February that EROs could no longer monitor AEROs on ECINet.
The Hindu noted that the audit comes after Election Commissioners Sukhbir Singh Sandhu and Vivek Joshi raised objections to centralising ECINet. Congress general secretary Jairam Ramesh said on X that ECINet and the Commission’s IT division had overruled the statutory authority of EROs. These remain allegations.
“Coding 101”
Rajput said hard-coding officials’ details into a front end shows weak standards. “This is coding 101,” he said, and asked how citizens can trust the system with voters’ data if it cannot protect its own officials’ information. He also questioned how much is invested in such portals. These are his opinions, not findings of the audit.
Arora said the findings show how easily technology lets the system look past constitutional values. A toggle or colour code makes sorting people simple, she said, but behind it sit large questions about who counts, answered by a “technocratic approach.”
What remains unanswered
The Commission has not publicly explained, in the reports reviewed, why ECINet divides voters into VIP and normal categories, why state officers can be disabled, or why only West Bengal’s EROs and AEROs are excluded. One media report said the Commission did not respond to its questionnaire.
Charchagram, which did not report its findings to the Commission, says it is preparing a long-form video and has shared its audit with journalists.
