India's electoral system is increasingly dependent upon a vast digital infrastructure that processes the identity, eligibility, inclusion, deletion, migration and verification of hundreds of millions of electors. ERONET, its successor ECINET, databases, algorithms, field applications and cloud infrastructure are therefore no longer ordinary government IT. They constitute critical democratic infrastructure. Their reliability must be judged not merely by whether forms are processed or databases remain operational, but by whether the technology faithfully implements the law, preserves the authority of statutory officers, protects every consequential data transaction and permits complete reconstruction and correction of every decision.
Recent developments make such a holistic examination unavoidable. On September 26, 2026, the Election Commission itself announced that a committee headed by a Senior Deputy Election Commissioner and including an independent IIT/IIIT expert would review ECINET to "double-check" that it complies with the Acts and Rules. The Commission also acknowledged that "various upgradations" had already been made following inputs from State CEOs and said further flexibility required by field officers would be made operational.
That admission is significant. Continuous technological improvement is normal. But statutory compliance, lawful allocation of authority, access control, rollback, auditability and basic data integrity are not optional post-production enhancements. They are requirements that should ordinarily be embedded in the architecture, specified in the tender, tested during development, challenged during pilot, independently validated during acceptance and certified before nationwide deployment.
The statutory architecture must remain supreme
The legal architecture is clear about the role of the Electoral Registration Officer. The ECI's own voter-education material states: "ERO is the statutory authority for preparation & revision of electoral rolls and therefore he/she is solely responsible for every activity relating to the said process."
The ECI's Electoral Roll Manual similarly describes the ERO as the statutory authority responsible for preparing the electoral roll of the constituency. It also makes clear that the BLO's verification is not the final decision: the ERO/AERO must consider the material and dispose of claims and objections after due application of mind.
The constitutional and statutory architecture consequently creates a hierarchy: Article 324 gives the Election Commission superintendence, direction and control over elections and electoral rolls; the Representation of the People Act, 1950 assigns preparation and revision of constituency rolls to EROs; and the Registration of Electors Rules prescribe the procedures through which inclusion, correction and deletion are undertaken.
Technology can facilitate that statutory architecture. It cannot silently substitute itself for it.
That is why the central question raised by the recent controversy is so serious: does ECINET merely implement the lawful decision of the ERO, or can the software architecture determine whether the ERO's lawful decision can actually take effect?
Goa exposes the software-law mismatch
The Goa episode is perhaps the clearest test case.
Ninety-seven voters flagged for "logical discrepancies" were examined by the competent electoral authorities and reportedly found eligible for inclusion. Yet the software did not provide the EROs with an effective rollback facility to reverse the earlier deletion. Goa officials wrote repeatedly seeking restoration. According to reporting, eight communications were sent between February 11 and 17, while the final roll was published on February 21.
The problem is not simply the absence of a convenient button. It is an architectural defect.
A legally mature electoral database requires a controlled state machine:
valid → flagged → notice → adjudication → deleted → reviewed → restored
with every transition authenticated, authorised, logged and reversible.
A deletion without a tested restoration pathway is fundamentally incomplete. An ERO who has statutory authority to correct an erroneous decision must possess corresponding technological capability. Otherwise, the software becomes a constraint on statutory power.
The Goa CEO's reported observation is particularly revealing: there "has to be some mechanism in ECINET" to re-include voters at the ERO level.
The ECI now says 81 of the 97 voters have subsequently submitted Form 6. That facilitates their future inclusion, but it does not answer the underlying systems question: why did citizens whose eligibility had already been examined and accepted by the competent authority have to begin the enrolment process again because the technology could not implement the original decision?
The access-control question is even more fundamental
The most serious institutional issue concerns access to the electoral database.
Indian Express has reported that Election Commissioners Sukhbir Singh Sandhu and Vivek Joshi repeatedly raised concerns about what they described as gradual centralisation of the electoral-roll database. Joshi reportedly proposed an audit to establish that "no one, except the concerned statutory authorities, has credentials to make any change in the (voter) database." Sandhu subsequently recorded that state officials did not have "proper and complete access" and questioned whether the DG (IT) had legal authority to restrict the statutory authorities' access.
These are extraordinarily serious allegations because they concern the distinction between application administration and statutory decision-making.
There is nothing inherently improper about centralised infrastructure. Indeed, a national architecture can improve consistency, security and data quality. But centralisation must never create an unaccountable layer between a statutory decision-maker and the electoral record.
Every production system should therefore be capable of answering, transaction by transaction:
Who changed the record?
Under what role?
Under whose authority?
From which system?
Using which credentials?
Which software version?
Which rule or algorithm?
What was the previous value?
What became the new value?
Was the transaction reversible?
Who approved it?
Is the audit trail immutable?
Without those answers, "role-based access" becomes an assertion rather than an independently demonstrable control.
Serious questions concerning Seema Khanna and the IT division
The role of DG (IT) Seema Khanna therefore requires particular scrutiny, not through assumption of personal culpability but through documentary accountability.
According to reporting based on internal communications, Deputy Election Commissioner Sanjay Kumar wrote to Khanna in November 2025 that the statutory functions of ERO, DEO and CEO "were to be strictly exercised by them and no one else" and that "IT systems must be in strict compliance with the law, without any exception." In January 2026, he reportedly again asked her to ensure that the IT system did not restrict the ERO's discretion.
Yet the Goa rollback problem subsequently occurred, with the CEO's office repeatedly seeking technical intervention and a Deputy Election Commissioner reportedly telling Khanna that the "IT system cannot block necessary action" pursuant to Supreme Court directions.
If these communications are authentic and their chronology is confirmed, they raise serious questions of technology governance and managerial control within the IT division under Khanna's charge.
The investigation must determine whether:
1. the IT division knew that ERO functionality was restricted;
2. the restriction was intentional, accidental or an architectural oversight;
3. Khanna had authority to impose or remove such restrictions;
4. the restriction was documented and approved;
5. the risk was formally escalated;
6. corrective action was technically feasible but not implemented;
7. the production system was accepted despite a known statutory-control defect; and
8. the eight Goa requests were acted upon, deferred, rejected or technically impossible to execute.
This is a matter for records, logs, source-code history, change tickets and responsibility matrices, not speculation about an individual.
"Logical discrepancy" requires algorithmic accountability. The term "logical discrepancy" itself demands technological scrutiny.
If software identifies an apparent mismatch between a present voter and historical electoral data, the system should specify its matching logic, thresholds, confidence levels, exception conditions and human-review requirements.
A proper algorithm-governance framework should maintain:
- algorithm version;
- rule/parameter version;
- input datasets;
- matching methodology;
- false-positive and false-negative testing;
- threshold validation;
- independent testing;
- human-review requirements;
- audit logs;
- change history;
- rollback capability.
The Supreme Court has recognised that the statutory process involves notice, hearing and an ERO's enquiry and decision before final deletion. The technological architecture must therefore preserve, rather than compress or circumvent, that procedural safeguard. The Supreme Court's recent observation that notices issued to more than 33 lakh Delhi voters appeared "mechanical" and its request that the ECI consider additional filters further underline the importance of testing the logic generating such notices.
Procurement may contain the original defect. The investigation must therefore move backwards from visible failures to the procurement documents.
The critical questions are whether the tenders and work orders expressly required : legal-to-system traceability; canonical data architecture; statutory authority mapping; role-based access; segregation of duties; privileged-access management; immutable audit trails; algorithm validation; negative testing; data reconciliation; rollback; disaster recovery; independent security testing; independent acceptance; source-code governance; change management; vendor accountability and exit arrangements.
A defective Scope of Work can produce a technically successful but institutionally defective system. If rollback was not specified, tested and accepted, its absence may originate in requirements engineering rather than coding. If ERO authority was not mapped to system permissions, the defect is architectural. If central administrators possessed powers inconsistent with statutory authority, the defect is governance and access-control design.
If these risks were known during pilot but production proceeded regardless, the defect becomes one of acceptance governance.
A complete forensic audit is now essential
The ECI's new review should therefore be much broader than a software inspection. It should reconstruct the complete chain:
law → requirements → tender → contract → architecture → development → algorithms → access-control design → testing → UAT → pilot → acceptance → deployment → change management → incidents → corrective action.
The audit should independently examine ERONET, ECINET, databases, interfaces, cloud infrastructure, source-code governance, access logs, algorithmic modules, configuration changes and all production privileges. It should specifically reconcile every consequential electoral transaction and determine whether the final database state corresponds to the lawful decision of the competent authority.
The investigation should also establish whether special administrative features, including reported "Mark VIP" functionality, alter workflow, verification or deletion safeguards for particular categories of electors. Administrative prioritisation is not inherently improper; substantive differential treatment would require a very different legal justification. Towards a corrected electoral technology ecosystem India does not need less technology. It needs better engineered, legally subordinate, independently assured technology.
The corrected architecture should establish one authoritative electoral data model, immutable transaction histories, statutory-authority-based permissions, dual control for consequential changes, complete auditability, algorithm registers, independent validation, tested rollback, continuous reconciliation, disaster recovery, transparent change management and a clear separation between infrastructure administration and statutory decision-making.
Every electoral record should have a complete digital provenance. Every consequential decision should be reversible where legally appropriate. Every privileged user should be identifiable. Every algorithm should be versioned. Every software change should be tested.
Every statutory function should have a corresponding technological capability and no IT administrator, however senior, should possess technological power that exceeds the authority conferred by law.
The ECI's decision to "double-check" ECINET is therefore an opportunity to do something much larger than repair individual defects. It should commission a genuinely independent Legal, Information Architecture, Data Architecture, Cybersecurity, Algorithmic, Procurement and Systems-Assurance Audit of the entire electoral technology ecosystem.
The objective should be simple but uncompromising : The electoral roll must remain the product of lawfully exercised statutory authority, while technology serves as its transparent, secure, auditable and reversible instrument. Never the other way around.
[Major General Dr. Dilawar Singh, IAV, is a distinguished strategist having held senior positions in technology, defence, and corporate governance. He serves on global boards and advises on leadership, emerging technologies, and strategic affairs, with a focus on aligning India's interests in the evolving global technological order.]
