New Delhi: Nineteen-year-old software engineer Nisarga Adhikary, known for identifying security lapses in the CBSE’s online marking system, says that he wrote to the Election Commission and CERT-in, India’s Computer Emergency Response Team in July – spotlighting negligence and loopholes in the security apparatus of the ECI website, apps, and overall digital machinery. “They seemed like very rookie mistakes, not oversights,” he told The Wire. His findings assume significance against the backdrop of serious questions on the central control of the ECI’s software used to conduct the special intensive revision of rolls.However, CERT-in as well as the ECI “ghosted him,” Adhikary said, until a reporter from the Hindustan Times reached out to the agencies, following which he received a response from CERT-in, saying that one of the issues he had flagged had been resolved. According to him, it was the most minor of the lot. In an email, which The Wire has seen, Adhikary laid out a framework of error, at the core of which lies a crucial finding. There is next to no protection that exists to preserve the personal details of election officers across nearly all states. Adhikary says in the email that there is no authentication, no CAPTCHA validation, or session cookies. Security reports of this nature use a certain rating standard, and Adhikary found it to be 9.1 on the CVSS (Common Vulnerability Scoring System), which means “critical.”“One of the critical vulnerabilities was that anyone can view personal details like name, phone number, emails etc. of ECI officials across almost all the states, and then another was that the whole encryption layer of the whole app was broken – the encryption was totally a facade. There are other severe vulnerabilities too,” Adhikary told The Wire over messages. The unguarded personal data consists of first names and last names, official designations, election officer type, role identifiers, and account status. According to Adhikary, the access was instantaneous. Moreover, he explained that the decryption key was embedded in the ECI app, which contains a number of different portals. This effectively means that what is fed into these apps can be extracted and decrypted by anyone, including those with malafide intentions. “The app-layer encryption used across the platform is obfuscation only, not a real security boundary — any party with the public APK [Android Package Kit] can decrypt captured traffic and construct valid forged requests,” reads the email sent by Adhikary. While there is an HTTPS, it is a layer of protection that only comes into force if people are using the same wifi connection. Essentially, a hacker will only read a jumbled mix of data, and not actual information, if you are using the same Wifi. He refers to at least eight segments overall the ECI ecosystem that have been impacted, including the ECI’s Suvidha portal, which is supposed to ferry candidates through the nomination process, ECORE which helps nodal officers, and the ECI’s seizure app which is used to track data on items that have been seized during the electoral process. This vulnerability poses a real threat. “Social engineering, phishing attacks, and successful phishing attempts can lead to something very sinister,” he said.