INEC probes alleged voter data leak, identifies user account

The Independent National Electoral Commission (INEC) has launched an investigation into the alleged unauthorised access and release of information from its Continuous Voter Registration (CVR) database following the publication of details relating to a candidate in a recent political party primary election in the Federal Capital Territory (FCT).

 

INEC disclosed this in a statement issued on Tuesday by the National Commissioner and Chairman of the Information and Voter Education Committee, Mohammed Haruna.

 

According to the commission, the matter is being treated with utmost seriousness and a comprehensive investigation is underway to establish the circumstances surrounding the incident.

 

“The attention of the Independent National Electoral Commission has been drawn to allegations currently circulating on social media and in some sections of the media regarding the alleged unauthorised access to the Commission’s Continuous Voter Registration database and the subsequent publication of information on a candidate in the recent primaries of a political party in the Federal Capital Territory.

 

“The Commission takes this allegation seriously and has immediately commenced a thorough investigation to establish the facts surrounding the incident,” the statement said.

 

INEC explained that authorised registration officers participating in the ongoing nationwide CVR exercise were granted controlled access to specific components of the registration system for official duties such as voter registration, transfer requests and updates to voter records.

 

The commission noted that preliminary findings from its audit trail had identified the user account through which the information was accessed.

 

“The audit trail from the preliminary investigation has enabled the Commission to identify the user account through which the information was accessed. Accordingly, relevant personnel have been questioned, and all units connected with the incident are cooperating fully with the investigation,” it stated.

 

The electoral body said investigations were examining all technical, administrative and operational aspects of the case to determine responsibility and establish whether internal access protocols were breached.

 

However, INEC stressed that there was no evidence of external hacking or compromise of its systems.

 

“Preliminary findings from the Commission’s audit trail so far indicate that there was no external breach of the CVR database, no hacking incident, and no unauthorised external access to the Commission’s ICT infrastructure.

 

“Rather, the information in question was accessed through valid user credentials assigned to personnel participating in the ongoing CVR exercise but released without authority,” the commission said.

 

INEC further clarified that the incident involved the retrieval of a specific voter record and did not affect the broader voter registration infrastructure or the personal information of more than 90 million registered voters.

 

“The incident under investigation relates to the retrieval of a specific voter record and does not indicate any compromise of the Commission’s broader voter registration infrastructure or the personal data of over 90 million registered voters,” the statement added.

 

The commission reaffirmed its commitment to safeguarding voter information and maintaining the integrity of Nigeria’s electoral systems.

 

INEC also revealed that the Department of State Services (DSS) had commenced an independent investigation into the matter, adding that anyone found culpable would face appropriate legal action.

 

The development follows controversy surrounding the publication of voter information allegedly belonging to actor and politician Emeka Ike by Lere Olayinka, media aide to the Minister of the Federal Capital Territory, Nyesom Wike.

 

Ike, who contested for the AMAC/Bwari Federal Constituency seat under the Nigerian Democratic Congress (NDC), accused Olayinka of exposing his personal data from INEC’s portal and described the action as a breach of privacy and political misconduct.