INEC probes internal leak of voter data, rules out hacking of CVR database

The Independent National Electoral Commission, INEC, has launched an investigation into the alleged unauthorised disclosure of information from its Continuous Voter Registration, CVR, database, while insisting that there was no external breach or hacking of its systems.

The electoral body said preliminary findings from its audit trail indicate that the information in question was accessed using legitimate credentials assigned to personnel participating in the ongoing nationwide CVR exercise and was subsequently released without authorisation.

INEC disclosed this in a statement issued on Tuesday by its National Commissioner and Chairman of the Information and Voter Education Committee, Mohammed Kudu Haruna, following reports circulating on social media and in sections of the media alleging unauthorised access to the Commission’s voter registration database.

The controversy reportedly stemmed from the publication of information relating to a candidate who participated in the recent primaries of a political party in the Federal Capital Territory, FCT.

According to the Commission, it has taken the allegations seriously and immediately commenced a comprehensive investigation to ascertain the circumstances surrounding the incident.

INEC explained that as part of the ongoing CVR exercise, authorised registration officers were granted restricted access to specific sections of the voter registration system to enable them carry out official functions such as registering new voters, processing transfer requests and updating voter records.

The Commission stressed that such access is strictly limited to official duties and is normally withdrawn at the conclusion of the exercise.

It revealed that its preliminary audit trail had already identified the specific user account through which the information was accessed.

“As part of the investigation, relevant personnel have been questioned and all units connected to the incident are cooperating fully,” the Commission said.

INEC noted that investigators are examining the technical, administrative and operational aspects of the case to determine whether there was any violation of internal access-control protocols and to establish individual responsibility.

The electoral umpire, however, sought to reassure Nigerians that there was no evidence of a cyberattack on its systems.

“Preliminary findings from the Commission’s audit trail so far indicate that there was no external breach of the CVR database, no hacking incident and no unauthorised external access to the Commission’s ICT infrastructure,” the statement said.

Rather, the Commission maintained that the incident involved the retrieval of a specific voter record through valid credentials issued to personnel engaged in the voter registration exercise.

INEC further clarified that the matter under investigation does not suggest any compromise of its broader voter registration infrastructure or the personal information of more than 90 million registered voters in the country.

The Commission reiterated its commitment to protecting voter information, stressing that the security, confidentiality and integrity of electoral data remain a top priority.

It also disclosed that the Department of State Services (DSS) has independently commenced its own investigation into the matter.

INEC pledged full cooperation with security agencies and vowed to ensure that anyone found culpable faces appropriate sanctions and possible legal action.

The Commission urged members of the public and the media to avoid speculation while investigations are ongoing, assuring Nigerians that the outcome of the probe and any corrective measures taken would be made public in due course.

The development comes amid heightened public scrutiny of electoral processes and data security as political activities ahead of future elections continue to gather momentum across the country.