☆☆☆ Insider access, weak audit trails fingered as sources of breach. ☆☆☆Public demands transparency.
By: Our Special Correspondent.
For millions of Nigerians, the voter register is the one line that stands between them and their right to vote, but that line seems to have been crossed.
Multiple sources within and outside the Independent National Electoral Commission, INEC, have confirmed to this newspaper that the Commission’s central database – housing voter biometrics, polling unit data, and CVR records was compromised in a breach that is now the subject of a joint probe by the EFCC, ICPC, and DSS.
The development has triggered anger and anxiety across the country, with civil society groups, political parties, and ordinary voters asking one question: If INEC’s data isn’t safe, is our democracy?
Cybersecurity experts and INEC insiders who spoke on conditions of anonymity told This Newspaper that the breach likely followed a mix of insider access and technical lapses.
Our findings reveal that, key scenarios under investigation include: *Privileged user abuse by data administrators and ICT officers who had the previledged access and rights to Automated Voter Registration System, AVRS, backend without proper authorization tickets.
Another possibility is that, phishing attacks or shared passwords may have exposed logins to the CVR online portal and IReV upload system.
Preliminary findings suggest changes to voter records were not fully tracked with user ID, IP address, and timestamp, making it hard to immediately pinpoint culprits.
A senior investigation officer told our correspondent that, it might have bern a case of backup vulnerabilities, in which, unencrypted backup drives containing voter data from 2023-2025 CVR exercises are also being traced.
“The voter register is INEC’s crown jewel,” said a cybersecurity analyst familiar with the probe, and rhat, once insiders or attackers get admintrative access, they can add, delete, or move voters between polling units.
In this situation, the damage may be silent until election day.
For now, INEC has not confirmed the full scope of the investigation, but has admitted that, it is working with security agencies to establish the facts, behind the hack, with, spokesman of the FCT Minister, Lere Olayinka, being the focal ppint of investigation.
On the streets and online, the mood is tense, with Nigerians pouring out their anger abd fears, that, names might disappear from the register or their votes may be manipulated.
The Nigeria Civil Society Situation Room called “a direct threat to electoral integrity” and demanded INEC to publish a forensic audit within 14 days.
The dominant sentiment, has been that of distrust, as many voters fear their names, NIN, phone numbers, and biometrics may be sold or manipulated ahead of the 2027 elections.
Political parties remain polarized, with the ruling party officials insisting INEC must be allowed to investigate, even as opposition parties allege the breach was del8berate and not accidental.
Sources at the EFCC headquarters in Abuja confirmed a special task force has been constituted, with the DSS handling the national security implications, and the ICPC probing possible financial inducements.
So far, our correspondent gathered that, Servers, BVAS backend logs, and backup drives have been forensically imaged, several INEC ICT staff and two vendors with adminstrative access have been sent on administrative leave.
This action according to the electoral body, is without prejudice, to the eventual outcome of investigations.
INEC has formally notified the Nigeria Data Protection Bureau under the Data Protection Act 2023, as required for data breaches, while a Tier-1 cybersecurity firm approved by NITDA is conducting an independent audit of the database integrity.
An EFCC source told this us that, the antigraft agency is tracing audit logs, IP addresses, and financial flows to accertain, Who may have made the change, and or authorized it, to be identified.
*Research findings reveal that, under the Electoral Act, Section 119, which covers illegal registration/alteration of voter records attracts two years imprisonment or a ₦500,000 fine.
Section 127 stipulates that, tampering with election materials/data transmitted via IReV/BVAS could attract three years imprisonment.
Further findings reveal that, under the Cybercrimes Act 2015, in section 8, unauthorized alteration/deletion of data could l3ad up to five years with ₦10m additional fine.
In section 6, unauthorized access to computer system, could fetch up to three years, with ₦7m fine.
And for INEC staff, it means, outright Dismissal, forfeiture of pension, and blacklisting from public service under Public Service Rules. Upon conviction, it also means ten years jail term, and disqualification from contesting elections.
And yet under the Nigeria Data Protection Act 2023, INEC itself risks a fine of up to 2% of annual revenue if found negligent. Individuals who leaked personal data can be sued by victims, ie, any illegible Nigerian voter can sue.
Barr. Festus Ogun, a constitutional lawyer, said on the issue, that, “This is not just an IT issue. It’s about sabotaging democracy. The courts will likely treat it as a serious offense.”
As investigators sift through terabytes of logs, one fact is clear: public trust is also on trial.
For INEC, the next 30 days will determine whether Nigerians believe the Commission can protect the one database that protects their vote. For those culpable, the law, once it catches up, may be less forgiving than the court of public opinion.
INEC Voter Register of 93.4m registered voters as of 2023, the agencies probing the breach, including, EFCC, ICPC, DSS, NDPB, mdy test their capabilities at rekindling public confidence in public institutions and attendant national security.
