The Election Commission of India’s (ECI) portal , ECINET, carries a feature that can bar Electoral Registration Officers (EROs) and Assistant EROs (AEROs) only in West Bengal from reviewing voters’ enumeration forms and viewing the notice-and-hearing dashboard, according to a third-party audit of the portal’s publicly served code.
No such exclusion for EROs and AEROs in the code for any other state was found. The audit –– conducted by civic-tech initiative Charchagram –– found the feature present in code fetched as recently as October 19.
But the hearings for the logical discrepancy process dragged on as ECI and the West Bengal government clashed over the rank of officers deputed to be EROs. On February 24, the top court noted that about 250 judicial officers were assigned about five million cases, which meant that the process could take up to 80 days. As a result, the court widened the pool of judicial officers and said only documents submitted on or before February 14 would be considered.
“It shall be the entire responsibility of the ERO/AERO to satisfy the presiding judicial officers of the documents referred to in paragraph 3(iii) above,” the court said.
Feature blocks access to enumeration forms and hearing dashboard
The current build was introduced on October 16. Rajput said the feature has existed in the app at least since September 28, when he first saw it. The special intensive revision was the most contentious in West Bengal, where it resulted in the disenfranchisement of 2.71 million people. The exercise began on November 4 last year.
“West Bengal is separately hard-coded in the codebase and excluded from it (for ERO and AERO). “We reviewed only the front-end JavaScript bundle that the site serves publicly. It loads before any login, and anyone can open it in a browser. To be sure, the audit only confirms restrictions imposed on the frontend.
“The ‘View Enumeration Form Details’ is a general tile available to SIR Phase II landing page,” Rajput said. Rajput said the audit was limited to what the site served publicly. We called no endpoints and used no login or credentials at any point,” he said. “Server-side enforcement isn’t visible to us,” Rajput told HT. Asked if the rule existed in earlier builds, he said, “We don’t know.
We did not have access to earlier versions, so we cannot say whether the rule existed before or has changed.
