Rubaiyat Ali
The ongoing controversy surrounding the preparation of electoral rolls, Special Intensive Revision (SIR) and the conduct of the election process as a whole, has brought to the fore the very critical aspect of applying Information & Communication Technology (ICT) in the election process. Having worked for the National Informatics Centre (NIC), the nodal ICT organization of the Central Government , for a long 35+ years, and having led the NIC Assam State Centre’s Election Support Division in providing ICT services in three consecutive major elections – the Assembly Elections of 2021, The Parliamentary Elections of 2024 and the Panchayat Elections of 2025 – besides a number of other local body elections under the State Election Commission (SEC), this is an effort to present the intricacies of providing ICT support to elections and the pitfalls to avoid in the course of doing so.
In Assembly and Parliamentary elections, which are conducted under the direct supervision of the Chief Election Officer (CEO) of the respective states, ICT support is primarily provided by the Election Commission of India (ECI) through online applications developed centrally by the ECI. NIC acts as a consultant to the state and district administrations to ensure smooth implementation and operation of the ECI software providing operational training and technical troubleshooting. However, NIC also runs the online Polling Personnel Management Software (PPMS) developed by NIC Assam and other NIC software such as Force Deployment System and Eletraces which is an EVM tracking application. In the case of the Panchayat and other local body elections under the State Election Commission (SEC), NIC provided ICT support for the very first time in Assam to the whole gamut of electoral rolls updating and preparation, nomination filing along with affidavits, ballot box management and polling and counting personnel management. ICT applications were developed and implemented for each of these critical functional components of the election process.
Any election process is highly sensitive, and all officials involved carry a very high degree of responsibility and accountability. Application of ICT is a very effective way of ensuring accountability because almost all work done in a software can be linked to and tagged to the person who executes that work. However, the most dangerous pitfall of any ICT initiative lies in the breaching of the demarcation between administrative and technical support responsibilities. This can happen in a variety of scenarios – an administrative official such as a district commissioner asking the technical person to do administrative work on her/his behalf in the system, or a technical person deliberately getting involved in administrative work. In both the cases unauthorized work is done by violating user credentials. In the first instance, the user credentials are willingly handed over, and in the second instance, the user credentials are stolen or bypassed.
At this point it is important to understand the importance of what is called the User Management Module. All ICT applications have user management modules through which each user is given access to the application by assigning an unique user name which is secured by multi-level authentications such as passwords, One Time Password (OTPs) and even Aadhaar-based verification. The person who has access to the user management module can deny access to already active users or curtail their roles and privileges. User credentials can be stolen by manipulating the user management system to change or override the password and the phone number to which the OTP is sent. Aadhaar-based verification is more difficult to breach, but it is also more difficult to implement, and in an election environment of high work pressure, users complain that dealing with so many authentication levels is time consuming and clumsy. Some would want to do away even with the OTP!!
The solutions are simple. Every user should be educated on the importance of credentials, that safekeeping of credentials is the responsibility of the user concerned, and accountability for all deeds or misdeeds done through the account rests on the user. In case work is to be delegated, then a formal account should be created in the name of the person who will be doing the work. Every viable application can make this provision available at all levels of users. An ironclad user management system with access only to officially-identified personnel can effectively plug not only unauthorized access to any account but also pinpoint responsibility in case of any deviance. In case of highly sensitive work such as in elections, it is preferable to provide system root access, which is the master access, only to persons authorized by the user department. Access to execute any technical system software work should be granted with due recorded approval by the root user under the guidance of a technical consultant such as NIC.
Access to the user management module should always be controlled by the user department, the Chief Election Officer (CEO) or the State Election Commissioner (SEC) so that the roles and privileges of users are properly allocated. A Block Level Officer (BLO) or a Electoral Registration Officer (ERO) should have access only to the roles and privileges assigned to them. With storage capabilities on the increase, there should be no problems in uploading scanned copies of crucial manual documents such as Speaking Orders to validate and augment the digital approvals done in the system.
Managing the database of the application is a major concern with its own pitfalls. Databases have to be maintained meticulously in what is termed as ‘database housekeeping’ to keep them at the best of their efficiency and safety levels. This cannot be done by administrative officials of the department, technical personnel either of the department or some other entity such as NIC. The trick is to identify trustworthy people and make them accountable for the work they do in the system itself. In some cases, it becomes necessary to provide direct access to databases to users for certain activities such as populating the data. In such situations access should be provided only through the frontend and after due recorded approval of the user authority, the Chief Election Officer (CEO) or the State Election Commissioner (SEC), to avoid getting entangled in unsavoury situations. Direct access to database through the backend should be allowed only in extreme contingencies, and that too after proper recorded administrative and technical approvals.
Last but not the least is the usual requests for transfer of data out of the system. This is one of the gravest pitfalls because once data is handed over to a third party outside the system, there is no knowing for what purpose it will be used. The solution is again very simple – make provisions for data to be transferred through the user interface of the system. Any user who wants to transfer data has to give a system-generated undertaking that s/he understands that the data is sensitive and is responsible for any breach or wrong use of the data.
The crux of the matter is that administrative and technical people should work in tandem respecting each other’s jurisdiction, and not trust anyone blindly. Add to that thorough formal User Approval Tests (UAT), not avoiding security and vulnerability audits in the name of time constraints, and you have ICT interventions that could really make life very easy, and the electoral process very transparent and trustworthy.
(The writer is former Head of NIC Assam. He can be reached at rubaiyatali@gmail.com)