New Delhi: A public code audit of ECINET, the Election Commission of India’s (ECI) officials’ portal, has identified features that allow select officials to enable or disable state-wise access to enumeration form details. The audit by Charchagram, a civic-tech initiative, also found a feature dedicated to West Bengal: Electoral Registration Officers (EROs) and Assistant EROs (AEROs) in the state can be restricted from accessing enumeration forms and the notices and hearing dashboard.The Charchagram audit does not establish whether these access controls were used, by whom or how frequently. Yet they go towards confirming recent reports by the Indian Express on the disquiet over how ECI has been conducting the Special Intensive Revision (SIR) of voter lists. The same study finds that voters could be marked as “VIP” on the portal. This feature, too, was observed during the audit, reflecting a report in The Reporters Collective, which first revealed VIP-tagging was possible on the portal.“At first, the Indian Express report made me curious, so I started with a basic scan of ECINET. As I dug deeper, I kept finding one thing after another. These are important public portals, and people need to know what is happening behind them,” said Saurav Rajput, data scientist and alumnus of IIT Delhi and IIM Calcutta on the Charchagram team who looked at ECINET’s protocols.ECINET was launched in January 2026 as a unified platform bringing together several applications used by election officials. The audit examined the portal on October 2, 6, 7 and 9. Rajput said he did not use passwords or ECINET’s application programming interfaces (API). His research relied on code that the website makes publicly accessible.Restricting state-level access to the siteCharchagram has revealed that the portal has a management section for State Nodal Officers (SNOs), and that this section has an option to disable an officer’s account. If this option is picked, a warning would come up, which says that disabling would stop that officer from accessing the application.The code also contains a message that reads, “View Enumeration Form Details is not enabled for selected state”. It follows from the message that a state can be allowed or disallowed from viewing the details on such forms. This message pops up when access has been withheld.Also read: ECI Was Warned Months Ago by West Bengal Tribunal Judges About Portal Glitches: ReportIt is unclear why such a control has been introduced on the ECINET portal, or how often it has been used. However, it does go to establish one of the central issues raised by the two Election Commissioners, Sukhbir Singh Sandhu and Vivek Joshi, that state-level election officers were struggling to access certain details they needed to effectively enumerate or include voters on the electoral rolls.“At present, we cannot say whether these features have been used, or prove how they have been used,” said Rajput, adding, “That is why there should be a proper standard operating procedure for every feature, and these should be made publicly available.”The Indian Express previously reported that Joshi and Sandhu had objected in writing 14 times over 10 months regarding the centralisation of the electoral roll database and the lack of proper access to ERONET (one of the applications subsumed under the ECINET portal) in some states.In particular, Election Commissioner Sandhu’s concerns about access to ERONET were informed by reports from state-level election officials who said they lacked “proper and complete access” to the portal.Restriction just for West Bengal officialsAccording to the audit, the portal’s code contains a rule that hides two sections from EROs and AEROs in West Bengal. In the code examined by Rajput, EROs and AEROs in other states are not subject to the same restriction. The two sections relate to individual voters’ enumeration form details and the portal’s notice and hearings dashboard.The individual elector screen contains information such as the voter’s name, electoral photo identity card number, constituency and polling-part details, the documents submitted and the BLO’s recommendation.The notices and hearings section is crucial for voters and election officers – it reveals at what stage a voter’s bid to be included on the electoral roll is. Notices and hearings occur (mostly) after voters have failed to make it to the draft list of electors in a state.Also read: Bengal’s Voter-Deletion Requests Were Processed Faster and Succeeded Far More Often Than Inclusion Claims, ECI Data ShowsWhy other states are allowed to access both notices and voter data but not EROs and AEROs in West Bengal is unclear from the information publicly accessible. Charchagram says it is impossible to tell the reasons from whatever data is available, but it does show that “the tools to give or withhold access by state exist in the software. That fits the claim that some states did not get full access”.‘VIP’ voters can be identified and a consolidated download is possibleOne of the audit’s key findings is that certain voters are considered “VIP”. The code examined by Charchagram indicates that these voters are marked with a gold symbol alongside their names on the officials’ portal. It is not clear what purpose this might serve; all it shows is that not all voters got the gold symbol.“What we know is that there are VIP tags segregating voters,” explains Rajput.The VIP marker appears on a “View Documents in Enumeration Form” screen, next to other indicators that relate to the voter’s record, such as whether a notice has been generated or whether the elector had been marked eligible.The portal also contains a feature to download a consolidated list of these VIP electors, organised by Assembly Constituency. The list can be narrowed by state, district, constituency and polling “part” number, according to the audit.“Ek button say saarey VIP ka data nikal saktey hain (at the press of a single button, the data of all ‘important’ voters can be downloaded),” he said.The finding complements the investigation by The Reporters’ Collective, which reported the presence of a “Mark VIP” module in the Booth Level Officer (BLO) application. According to that investigation, a BLO could recommend an elector for VIP status, and that recommendation would then move up an official review chain.Charchagram did not inspect the BLO application, but said that its audit has examined the other end of the chain – the officials’ portal – and how the VIP marker appears on it. It found that a list of voters could be exported.The criteria for marking a star against any voter are not known from the available information.How the research worked“When you open a website, the browser receives and processes code that determines how the page is displayed and behaves. In the case of the ECI portal, we found that certain information and functionality, which should ideally be restricted to authorised officials, appeared to be accessible without logging in,” said Rajput. “This is very, very bad quality coding” he added.The poor controls in the code itself allowed Rajput to view features like VIP marking and the warning message that would arise when an official disabled a SNO.Charchagram’s research explains the process it adopted.After a previous disclosure by the same outfit, the ECI had corrected errors in coding that had revealed certain personal information related to its officials and contractors – again without requiring a password-protected login. Yet, as is evident, that repair did not fix every other bug in the portal.Rajput described the situation as a “red flag”. “We have filed some RTIs, but we are not sure if we will get that information or not, but we can say that in terms of who gets access to what information on ECINET, there should be proper procedures, including when access is to be curtailed and why, so that there is transparency and decentralisation of power,” he said.For our full coverage on the SIR and the issues it has brought to citizens, click here.