INEC investigates internal access to CVR record after candidate’s details surface online
Election, INEC ballot box
Abdullateef Fowewe
The Independent National Electoral Commission (INEC) has launched a formal investigation after allegations spread on social media and in some media outlets that information from its Continuous Voter Registration (CVR) database was accessed without authorisation and used to publish details about a candidate in a recent political party primary held in the Federal Capital Territory.
This was made known in a statement signed on Tuesday by Mohammed Kudu Haruna, National Commissioner and Chairman of the Information and Voter Education Committee (IVEC).
“We take this allegation seriously and have immediately commenced a thorough investigation to establish the facts,” said Haruna.
INEC said the ongoing nationwide CVR exercise grants controlled access to specific components of the CVR system for authorised Registration Officers to register new applicants, process transfer requests and update voter records.
That access, the commission stressed, is restricted to official duties and withdrawn at the conclusion of the exercise.
Preliminary audit-trail evidence identified the user account through which the contested information was retrieved.
“Accordingly, relevant personnel have been questioned, and all units connected with the incident are cooperating fully with the investigation,” INEC said, adding that it is examining technical, administrative and operational factors to determine individual responsibility and whether internal access-control protocols were breached.
The commission’s early findings indicate there was no external breach, hacking incident, or unauthorised access from outside its ICT infrastructure.
Instead, INEC said the record in question was accessed using valid credentials assigned to personnel involved in the CVR exercise but that those credentials were used “without authority.”
INEC emphasised the incident involved the retrieval of a single voter record and did not point to a compromise of the broader voter registration infrastructure or the personal data of more than 90 million registered voters.
“The Commission wishes to state categorically that it takes the security, confidentiality and integrity of voter data with the utmost seriousness and remains committed to transparency, institutional integrity, and the protection of voters’ personal information,” Haruna said.
The Department of State Services (DSS) has also opened an independent probe into the matter, the commission noted.
INEC said it will continue to cooperate fully with security agencies and will refer anyone found culpable for appropriate legal action.
Members of the public and the media were urged to “disregard unfounded speculations” while investigations continue.
INEC promised to keep the public informed of final findings and any measures taken in response to the incident.
