On 29 April 2026, the Office of the Registrar General, under the Ministry of Home Affairs, floated a Proprietary Article Certificate (PAC) bid on GeM for 96 Esri ArcGIS licences for Census 2027. A PAC rules out competition on the product. The authorising file is seven years old, carried forward from 2019. On 10 June 2026, the contract went to Corporate Infotech Private Limited at ₹14,38,74,322, after four Esri India resellers bid the same product within a 0.95 percent spread under a reverse auction with H1 elimination. The approving authority is the Registrar General and Census Commissioner of India, currently Shri Mrityunjay Kumar Narayan, whose approval is dated 3 March 2026, with finance-wing concurrence recorded by Note No. 411 of 24 April 2026.The scope ties Esri India into the Houselisting Block Creator, the Census Thematic Mapper and the Digital District Census Hand Book across every State and Union Territory. The ArcGIS platform is developed in Redlands, California, by Esri Inc., which retains a substantial stake in Esri India and controls the licence activation and security patch stream. Census 2027 will process personally identifiable data on 145 crore Indians, including caste, religion, disability, gender identity, cooking fuel and household composition, which the Information Technology (Reasonable Security Practices) Rules 2011 classify as sensitive personal data requiring a documented security practice.The ArcGIS Server family in which the procurement sits carries a current track record of exploitation. In October 2025, ReliaQuest documented a China state-sponsored actor assessed with moderate confidence to be Flax Typhoon running inside an ArcGIS Server as a covert web shell for over a year. Three high-severity CVEs have been disclosed between 2024 and 2026, and twelve CVEs were patched in a single August 2024 bundle. The public record carries no independent cybersecurity oversight for this specific deployment, no CERT-In clearance, no NCIIPC designation, no independent security audit, and no Standard Operating Procedure for the ArcGIS Server service account. Who is checking that the mapping backbone of 145 crore Indian records is secure is a question the public record does not yet answer. IFF has filed RTIs with the Registrar General and written to the Registrar General and Esri India seeking comment.BackgroundThe Census of 2027 covers an estimated 145 crore Indians, and it is the first one carried out on smartphonesThe Census of India is the one dataset the Union government is constitutionally obliged to collect every ten years. The Census of 2027 covers an estimated 145 crore people and is the first digital Census, carried out on smartphones by enumerators who, as the Press Information Bureau release records, will “collect and submit data directly through Mobile App, using her/his smart phone”. The Census 2027 field work began nationally on 1 April 2026 under the Union government two-phase schedule, with Self-Enumeration beginning on 1 April 2026 and the Houselisting and Housing Census phase following, on timelines that are staggered across different States and Union Territories. NewsOnAir records that the Houselisting Operation “will also include geo-tagging of buildings and assigning a unique identification number to each structure”. New data categories include digital access, gender identity, climate-induced migration, cooking fuel, and the first full caste count since 1931. IFF has a pending representation before the Ministry of Home Affairs separately flagging that the Census 2027 household schedule asks for a sweep of invasive personal details, including Aadhaar numbers, that is disproportionate to the constitutional mandate under Article 246 read with Entry 69 of the Union List and that the Houselisting Operations/Population Enumeration schedule provides no corresponding safeguards. This procurement scrutiny piece sits alongside that representation. The Centre’s schedule, announced in June 2025, sets March 2027 as the reference date. For the first time, this Census will be a fully geospatial dataset, built on a GIS platform chosen and procured by the Office of the Registrar General and Census Commissioner of India (ORGI), a specialised office under the Ministry of Home Affairs.What this software actually is, and what the alternatives look likeEsri ArcGIS is a Geographic Information System (GIS) software suite developed by Esri Inc. of Redlands, California. In plain words, GIS software holds, projects and analyses the digital layer that connects a map to the records attached to the places on it, a building to its address, an administrative boundary to the ward or district inside it, a block to the households counted in it. For a decennial Census, the GIS stack is the spine on which four distinct Census 2027 workflows are built. First, the Houselisting Block Creator, which cuts the country into enumeration blocks small enough for one enumerator to cover. Second, the Boundary Management module, which keeps those blocks consistent as administrative boundaries shift. Third, the Census Thematic Mapper, which turns the raw Primary Census Abstract into map-based tabulations on housing, amenities, demographics and the caste count. Fourth, the Digital District Census Hand Book, which publishes maps and amenities data at district level for the Union government, the States, researchers and the public. The scope committed in the Additional Terms and Conditions annexed to this bid runs across all four workflows and ties them explicitly to PM GatiShakti and the National Geospatial Policy 2022.The alternatives to a commercial Esri ArcGIS deployment are neither hypothetical nor foreign. Bhuvan, built and run by the National Remote Sensing Centre under the Indian Space Research Organisation, is India’s own geospatial platform and already hosts administrative boundaries, satellite imagery and thematic layers at district and village level. QGIS, PostGIS, GeoServer and GRASS GIS form a mature open-source GIS stack that other government units in India and elsewhere have deployed for boundary management, tabulation and public map publication. The MeitY Policy on Adoption of Open Source Software for Government of India, notified by Office Memorandum No. 1(3)/2014-EG-II dated 30 March 2015, requires every Government organisation implementing e-Governance applications and systems to adopt Open Source Software as a preferred option, with the reasoned basis for any closed-source choice recorded in writing. No such reasoned finding on why QGIS, PostGIS, GeoServer or GRASS GIS was ruled out for Census 2027 appears on the public record of this procurement.Who owns the mapping backbone mattersThe Registrar General chooses the mapping stack. The ORGI Map Division’s own page on censusindia.gov.in records that the Division has been using GIS since the late 1990s to speed up map production, and Esri’s branding has sat on that stack since at least Census 2011. Esri India’s own in-house magazine ArcIndia News Vol 4 Issue 2, covering the Houselisting and Housing Census of 2010 and 2011, states in print that “Houselisting and Housing Census is completely based on ESRI GIS technology” and quotes the then Registrar General and Census Commissioner Dr. C. Chandramouli IAS saying that “Geo-spatial technologies provide an effective tool for complete coverage”. The 2010 and 2011 cycle was built on 33 digital capital-city maps, a village-level database covering some 600,000 villages, ward-level town maps, and GIS-based thematic maps on housing, amenities and assets. All of that work ran on Esri’s platform. The PAC file now being renewed in 2026, with the XII-027/23/2019-MAP reference carried forward, is the latest approval in a dependency that is at least fifteen years and two Census cycles old.The breach that happened on this exact platformIn October 2025, the security research team at ReliaQuest published a detailed account of a year-long compromise of an unnamed organisation’s ArcGIS Server by a group ReliaQuest assessed with moderate confidence to be the China state-sponsored actor Flax Typhoon. The Hacker News reported on 14 October 2025 that the group had, in the researchers’ words, “cleverly modified a geo-mapping application’s Java server object extension (SOE) into a functioning web shell” on a public-facing ArcGIS server, and had maintained covert access for “over a year” before detection.BleepingComputer confirmed that the attackers tunnelled covert traffic over outbound HTTPS on port 443 to make themselves appear to be inside the victim’s internal network, and remained undetected for “more than a year”. ReliaQuest’s own technical write-up adds the operational detail of a renamed SoftEther VPN executable (bridge.exe) placed in the Windows System32 directory, a persistence service that restarted it on every boot, and a hard-coded key designed to lock out other attackers so that only Flax Typhoon could use the backdoor it had built. The Register’s coverage of 14 October 2025 and Security Affairs’ write-up place the attribution on Flax Typhoon as a China state-sponsored actor.United States officials have publicly identified the Beijing-based Integrity Technology Group as linked to Flax Typhoon, and ReliaQuest attributes this specific ArcGIS campaign to the Flax Typhoon group with moderate confidence.What Esri said in response, and what it did not sayEsri’s own position on the ArcGIS Server intrusion is set out in its trust blog Understanding ArcGIS Server SOE Compromise, first published on 14 October 2025 and last updated on 14 May 2026. Esri’s account is that the issue “does NOT affect ArcGIS customers by default” and that the custom Server Object Extension was “NOT the initial source of compromise”. Esri describes a chain of configuration lapses on the victim’s side, including an ArcGIS Server Manager interface exposed to the Internet without multi-factor authentication, and an ArcGIS Server service account whose permissions had been “raised to full administrator/root for troubleshooting and was never reset”.The firm issued no patch for the incident, because the SOE extension mechanism it exploited is a designed-in feature of the product. Esri’s recommended mitigations are configuration disciplines the customer must enforce every day. Do not expose the management interface to the Internet. Enforce multi-factor authentication. Deploy a Web Application Firewall. Apply security patches “within 30 days of their release or earlier”. Every one of those recommendations places the operational security burden on the Indian customer. None of them is a vendor-supplied fix. In short, Esri’s own account of the ReliaQuest incident treats it as a customer configuration failure and transfers the compliance load to the Indian buyer.Other recent CVEs on the same product familyThis is not the only vulnerability on the ArcGIS stack in the past eighteen months. CVE-2025-1068, a high-severity untrusted search path vulnerability in ArcGIS AllSource 1.2 and 1.3 (CVSS 3.1 base 7.3), lets a “low-privileged attacker with write access to the local file system” place a malicious executable in a location searched by the application, with successful exploitation yielding “code execution under the victim’s account” with access to local files, network shares, saved credentials and GIS project data.Esri issued related patches for ArcGIS Pro 3.3 and 3.4. In August 2024, Esri shipped a single Portal for ArcGIS security update bundle patching twelve CVEs, including the high-severity CVE-2024-38040 Local File Inclusion flaw. CVE-2026-69224 is a separate information disclosure vulnerability in Portal for ArcGIS 12.0 and earlier, which Esri notes occurs only under “difficult to reproduce” circumstances.The practical implication for Census 2027 is in the product line being bought. The bid procures ArcGIS Enterprise Advanced (4Core) and the Indo ArcGIS Developer Builder with Portal for Jumpstart Services, which is the same ArcGIS Enterprise and Portal product family in which the Flax Typhoon-attributed compromise and the Portal CVEs sit. If the Census mapping backbone is to escape the same configuration failures ReliaQuest documented, the operational security burden will rest with the Registrar General and not on the vendor.What the Flax Typhoon-attributed compromise means in practiceThree outcomes follow from the ReliaQuest incident, and all three are the ones that matter for a decennial Census of 145 crore Indians.One, a public-facing ArcGIS Server, which is a core product in the family the Registrar General has now bought, has been proven capable of being turned into a covert long-term backdoor by a sophisticated state-sponsored actor using the product’s own designed-in extension mechanism, with the attacker remaining undetected for over a year. Two, the vendor’s response to that incident ships no patch and instead loads the mitigations onto the customer’s own operational security practice, which is a reasonable technical position but transfers the risk to the Indian buyer. Three, ReliaQuest’s write-up documents an attacker who installed a renamed SoftEther VPN executable (bridge.exe) and a persistence service that restarted it on every boot, which is the operational pattern of a long-term collection platform rather than a smash-and-grab. On a mapping backbone that is to be deployed across every State and Union Territory Census Directorate for the Houselisting and Population Enumeration phases of Census 2027, that outcome is not a theoretical risk. It is a documented pattern that has already run for over a year on the exact platform the Registrar General has now locked itself into.Who actually owns the code, and who holds the keysEsri India Technologies Private Limited describes itself as a majority Indian-owned company. In August 2022, Agendra Kumar, the Indian Managing Director of Esri India, consolidated his holding in the company to over 51 percent, with Esri Inc. of Redlands, California, retaining the remaining stake (CXOToday coverage).The ArcGIS platform itself is developed by Esri Inc. in Redlands, California, which also controls the release cycle for security patches and the My Esri licence-management portal.The United States CLOUD Act and the supply chain for Census 2027The United States Clarifying Lawful Overseas Use of Data Act of 2018 (CLOUD Act) lets the United States Attorney General compel a United States technology provider to produce data held under its “possession, custody or control”, wherever that data physically sits. India has no bilateral executive agreement with the United States under the Act. The United States Department of Justice’s own CLOUD Act Resources page lists only the United Kingdom (3 October 2019) and Australia (15 December 2021) as parties to signed executive agreements under the Act, with Canada and the European Union still in negotiations. India is not on either list.The Observer Research Foundation’s June 2022 paper on India’s proposed data protection law and the CLOUD Act examines what any future India-US agreement would need to cover and records that India continues to deliberate on a comprehensive data protection framework.On an on-premises ArcGIS Enterprise deployment of the kind the Registrar General is buying, Esri Inc. is not the direct holder of Census extraction data, because the data sits on infrastructure the Registrar General itself controls. The exposure IFF is flagging here is different and no less serious. The ArcGIS source code is developed and controlled by Esri Inc. in California. The licence activation and renewal flows run through Esri’s My Esri customer portal. The security patches that fix the CVEs above ship from Esri’s infrastructure outside India. Every one of those paths is a lever the United States government could reach through its own domestic legal process against a United States-headquartered firm, with no Indian notification channel under the Act.Whether a United States parent that retains a substantial stake in an Indian subsidiary, the source code to the software platform the subsidiary resells, and the security update stream, is “in control” within the Act’s reading, is a legal question India has not had to answer in a contested forum yet, and one on which the Union government has offered no public position with respect to Census 2027.The resale questionThere is a second order concern that goes beyond either the Flax Typhoon-attributed breach or the CLOUD Act. The ArcGIS stack is a commercial product. Its owner, Esri Inc., is a private United States corporation. There is no public commitment in the Registrar General bid or in the ATC on how India would retain control over the security patch stream, the licence renewal flows, or the underlying source code on which the Census of 145 crore Indians has now been built, in the event that Esri Inc. is acquired, merged, or subjected to United States export controls that affect its ability to supply India. The bid also does not contemplate the case in which Esri India itself is sold, in whole or in part, to a third party, Indian or foreign. The Make-in-India preference on the bid does not fix this, for reasons set out further below. The ATC contains confidentiality and non-disclosure clauses, requires a Malicious Code Certificate from the reseller, and declares that project artefacts are the “exclusive property of ORGI”. None of that reaches the ownership of the underlying platform.AnalysisThe bid, and what it buysThe bid was uploaded on 29 April 2026 and closed on 9 May 2026. The buyer is the Office of the Registrar General and Census Commissioner of India, department of Home, Ministry of Home Affairs. The beneficiary account is PAO Census MHA, New Delhi. The consignee named on the bid is Vidhi Govil at West Block-1, R.K. Puram, New Delhi. The item category is “Geographic Information System (GIS) Software (V3) (Q2) ( PAC Only )”.The quantity is 96 licences across four sub-items. Thirty-two Desktop Advanced upgrades, forty-nine Desktop Standard upgrades, eleven Enterprise Advanced upgrades, and four new Indo ArcGIS Developer Builder with Portal for Jumpstart Services licences with technical support. The approximate estimated value is ₹8,75,02,463 per annum. The upgrades are for two years and Item 4 is paid 25 per cent every six months over 2026-27 and 2027-28, which makes the two-year estimate roughly ₹17.5 crore. The ₹14,38,74,322 awarded value came in under that two-year estimate rather than above a one-year estimate. The Earnest Money Deposit is ₹52.5 lakh. The Performance Bank Guarantee is 5 per cent of the contract value for 30 months.What the award record showsThe award record, pulled from the award page on 27 October 2026, confirms the contract was awarded on 10 June 2026, exactly thirty-two days after the bid closed on 9 May 2026. Four bidders cleared the technical qualification stage, and every one of them was offering the same Esri India product. The item line on each of the four bids reads, verbatim, “Make, Indo ArcGIS-ESRI INDIA TECHNOLOGIES PRIVATE LIMITED, Model, Upgrade to Indo ArcGIS Enterprise Advanced (4Core)”. Each is marked “Qualified MII” (Make in India qualified). The four bids were as follows.L1, awarded, Corporate Infotech Private Limited, A-16 Basement, Jangpura Extension, South East Delhi, at ₹14,38,74,322. L2, UV Technologies Private Limited, Badarpur, Delhi, at ₹14.4 crore (plus ₹2.0 lakh over L1, a 0.14 per cent gap). L3, Nextdoor Infotech Private Limited, Malviya Nagar, Jaipur, Rajasthan, at ₹14.4 crore (plus ₹4.0 lakh over L1, a 0.28 per cent gap). L4, BMG Informatics Private Limited, Christian Basti, Guwahati, Assam, at ₹14.5 crore (plus ₹13.6 lakh over L1, a 0.95 per cent gap).The 0.95 per cent spread, which is unusually tight for Indian government procurement, is explained by the bid having been run as a reverse auction with H1-highest-priced-bid elimination enabled on GeM. Four resellers of the same OEM product will naturally converge in that structure. The point that matters for a Census story is not the tightness of the spread but the foregone conclusion on the product. Four firms spent time and money bidding, and all four ended up offering the single Esri India licence the PAC had already named.What a Proprietary Article Certificate is, and why it matters hereA Proprietary Article Certificate is the exception to the rule that government procurement must be tendered openly. Rule 166 of the General Financial Rules 2017 allows a PAC where the item in question can only be supplied by one firm, and where no suitable substitute exists. The certificate itself is a short form in which the officer records which of six pre-printed reasons applies.The PAC attached to this bid is dated 29 April 2026 and signed by VADUGURU V L N SARMA. The file reference is XII-027/23/2019-MAP, dated 7 April 2026. The competent authority named on the record is the Registrar General and Census Commissioner of India (RG&CCI), currently Shri Mrityunjay Kumar Narayan, whose approval is dated 3 March 2026. The finance wing’s concurrence is recorded on the PAC form at item 7 by Note No. 411 dated 24 April 2026. The date order on the record is therefore RG&CCI approval 3 March 2026, file reference 7 April 2026, finance wing Note No. 411 of 24 April 2026, PAC signed 29 April 2026. We will ask the Registrar General by RTI, not as an allegation, to produce Note No. 411 and PAC Annexure B, and to explain that chronology.The PAC form’s six pre-printed reasons are structured such that the officer is instructed to cross out options that do not apply. On the record, Box 6(a) (“it is the only firm manufacturing or stocking the item”) and Box 6(c-1) (reason for proprietary procurement) were ticked, with the reason recorded as “Upgradation of existing software licenses and procurement of new licenses are from the same OEM only”. Box 6(b) (“no similar article is manufactured or supplied by any other firm which could be used in lieu of the article under procurement”) was not ticked, and Boxes 6(b) and 6(c-2) were left in without being crossed out. The approving officer’s designation on the form is blank. The honest reading of this record is not that the Registrar General claimed no alternative to Esri exists. It is that the Registrar General did not claim it either way. The upgrade reason it did record is a reasonable one for upgrading existing licences, but it does not cover the four new Indo ArcGIS Developer Builder licences bundled into the bid, nor the two years of application development the ATC scopes under it. The approval history on the certificate shows exactly one prior PAC purchase from Esri India’s channel partner CIPL, dated 12 February 2024, which means the pre-2024 history of the Registrar General’s procurement of ArcGIS is not in the public record and will need an RTI to retrieve.The Make-in-India preference and how it becomes meaninglessThe Public Procurement (Preference to Make in India) Order of 2017, as amended on 4 June 2020, was built to tilt government procurement in favour of local suppliers. The GeM bid declares MII Purchase Preference as “Yes”, with a minimum local content threshold of 50 per cent for Class 1 suppliers and 20 per cent for Class 2. The MII order does operate on this bid. It bars non-local suppliers from participating, and the bid document records that only Class 1 and Class 2 local suppliers were eligible to bid. All four qualified bidders filed Class 1 or Class 2 self-certifications and are marked “Qualified MII” on the award record.That is not nothing, but it is also not what the MII order is popularly assumed to deliver. The MII certification binds the reseller’s local content percentage, which includes integration services and support labour performed in India. It does not bind the underlying software product, which continues to be developed by Esri Inc. in California, licensed through Esri India, and resold by whichever channel partner wins the auction. On this record, PAC combined with MII is a way of satisfying the MII order’s reseller-side preference while the product itself stays foreign. That gap deserves to be argued out in Parliament, not papered over in a procurement form.What the Additional Terms and Conditions actually commit toThe Additional Terms and Conditions attached to the bid are specific about what the four new Indo ArcGIS Developer Builder licences will do. They will provide, in the ATC’s own words, “maintenance and technical support” for the “HLB Creator (Web) Mapping Application maintenance and technical support during Houselisting Operations/Population Enumeration phases of Census 2027”. They will support the Census Management Platform’s Boundary Management module, the Digital Administrative Atlas, versions one and two of the Census Thematic Mapper for the Primary Census Abstract tabulation plan, and the Digital District Census Hand Book maps linked with amenities data. They will also cover “development of additional tools and applications, if any, for Census 2027 data dissemination activities”. The ATC ties the scope explicitly to PM GatiShakti and to the National Geospatial Policy 2022, and adds Story Maps and dissemination work. Delivery is to Census Directorates in every State and Union Territory, not only to ORGI headquarters. The ATC scope is boundaries, maps and tabulated data for dissemination. It does not route individual citizen records or caste responses through Esri’s software directly, which is a distinction worth keeping straight.The ATC warranty requires the vendor to apply patches “as per OEM’s latest release cycle”, which is a written contractual tie between the Census stack’s security posture and Esri’s own patch release schedule from California. The handover and knowledge transfer that would be needed to migrate to a different vendor is not contemplated. Nor does the bid consider the publicly available alternatives, including Bhuvan, the ISRO geospatial platform at the National Remote Sensing Centre, or the open-source QGIS ecosystem that other Indian government units have adopted for geospatial work. Two drafting anomalies in the bid file are worth flagging as RTI questions rather than allegations. First, the bid summary page declares “Arbitration Clause, No” even though the ATC itself contains a full arbitration clause. Second, Bid Clause 9 imports the Ministry of Petroleum and Natural Gas local-content policy notification of 17 November 2020 into a Census software bid, which is an unusual cross-reference for a Home Ministry procurement.The structural concerns with the way this bid was approvedThree structural concerns sit on the face of the record. First, the technical case for lock-in is not refreshed, only re-signed. The file reference XII-027/23/2019-MAP is a seven-year-old file carried forward into a 2026 approval under GFR Rule 166, which permits this but does not require it. There is no record on the bid of a second-opinion technical review from DPIIT, DST or an independent GIS panel on whether Bhuvan, QGIS or any other alternative was tested. Second, the finance wing’s concurrence by Note No. 411 is recorded on the PAC, but its content, what the finance wing actually examined and whether it tested the no-alternative claim, is not in the public record, which is why we will ask for Note No. 411 under RTI. Third, the only prior PAC purchase disclosed on the certificate is from February 2024, which means the pre-2024 history of Registrar General’s procurement of ArcGIS is not in the public record and will need an RTI to retrieve. Taken together, these three gaps do not mean the bid was unlawful. They mean India’s single most important decennial dataset has been renewed onto a United States-developed platform through an internal process whose independent-review layer is not visible on the public record, at the same time that the exact same platform has been documented by security researchers as having been used by a Chinese state-sponsored hacker group as a covert long-term backdoor.If a reader is wondering why this has gone under the radar, the answer is partly that geospatial procurement is treated as a technical administrative matter, and partly that ORGI is a small, specialised buyer. But the data at stake is the Census of India, covering 145 crore people. The entry point for critical scrutiny is here, at procurement, before the first smartphone is handed to the first enumerator.ActionsIFF has filed RTI applications with the Office of the Registrar General and Census Commissioner of India, seeking the full procurement file XII-027/23/2019-MAP, PAC Annexure B and the finance wing’s Note No. 411 of 24 April 2026, the past PAC approvals on Esri products going back to 2019, the technical case for ruling out Bhuvan and QGIS, the data handling agreement with Esri India for Census 2027 data, and the Esri India to Esri Inc. intra-group data sharing policy. We have also written to the Office of the Registrar General and Census Commissioner of India and to Esri India with specific questions to seek their views on this procurement. As of publication, no reply has been received from either. We will publish any reply (or continued silence) alongside this piece.Journalists and researchers who want to work on this, or on the wider pattern of MHA procurement locking into foreign-origin software, can write to us at policy@internetfreedom.in. Readers who want to support this work can donate to IFF or become a member.This article has been republished from the Internet Freedom Foundation‘s website.