I watched the Election Commission’s latest disclosure about cyberattacks on counting day with a mix of relief and unease. Relief, because officials say the systems held; unease, because over 68 lakh malicious attempts — aimed at the results portal and related election infrastructure — is a clear reminder that our democracies now run on code as much as on ballots.
Context: what happened
On counting day, the Election Commission reported an extraordinary volume of hostile traffic and probing against EC platforms including the results portal and ECINET — a consolidated suite of election applications. The Commission said these attempts were detected and mitigated, and that the broader ECINET system handled tremendous legitimate load as well as the attacks EC counters over 68 lakh cyberattacks on poll day.
This episode is not unprecedented: recent years have seen recurring campaigns of probing, DDoS, data-exposure bugs and targeted leaks around elections globally, and India has not been immune to data-exposure vulnerabilities in election-related portals India's Election Commission fixes privacy flaws.
The attacks: shapes and scale
From public reporting we can infer a mix of activity:
- Massive automated probing and volumetric DDoS-like hits designed to overwhelm web portals and obscure legitimate traffic.
- Targeted scanning for application-layer flaws or misconfigurations that could expose voter data or administrative controls.
- Credential-stuffing, opportunistic bot traffic, and social-engineering campaigns aimed at human operators rather than just infrastructure.
The reported figure — over 68 lakh (6.8 million) attempts — combines domestic and overseas sources and sits alongside extraordinarily high legitimate traffic. That makes detection and discrimination harder: defenders must separate a flood of interested voters and counting agents from malicious actors trying to mask themselves as legitimate clients.
Likely sources and motivations
Motivations usually fall into predictable categories:
- Disruption: to sow confusion on result day, erode trust, and create headlines that call electoral integrity into question.
- Espionage/data theft: to harvest personally identifiable information or internal logs that can be weaponised later.
- Political signal operations: hacking or leaking selectively to shape narratives and undermine confidence.
Attribution is rarely precise in real time; attacks often route through proxies, botnets and cloud services across multiple countries. Past patterns suggest a mix of hacktivists, opportunistic cybercriminal groups, and state-aligned actors using affordable tools to amplify impact.
EC response and security measures taken
According to the Commission, layered defenses worked: traffic filtering, rate-limiting, segregation of critical services, multi-factor administrative access, and real-time monitoring stopped adversaries from affecting counting. ECINET’s design — consolidating applications and streamlining authentication (including QR-based access controls for authorised counting personnel) — both increased resilience and created high-value targets that needed robust protection ECINET reporting details.
But disclosures about prior portal vulnerabilities show why continuous security hygiene matters: patching, third-party code reviews, and independent audits must be routine, not ad hoc EC RTI portal fix.
Implications for electoral integrity and public trust
Two effects matter most:
- Operational risk — If a results portal or administrative service is impaired, timely publishing of results can be delayed, causing chaos at the ballot counting centres and in the public square.
- Perception risk — Even unsuccessful attacks can be weaponised as proof of system failure. Distrust spreads faster than technical facts.
Democratic legitimacy depends on both the reality of secure procedures and the public’s belief in them. A well-handled cyber incident that is poorly communicated becomes a political crisis.
Expert reactions (summary)
Cybersecurity professionals typically applaud layered defenses and real-time monitoring, but caution that infrastructure must be stress-tested under election-like loads and in adversarial simulations. They recommend continuous red-team exercises, zero-trust admin controls, and hardened supply-chain vetting for third-party election software.
What this means for future elections
We should expect these attempts to increase in volume and sophistication. Attackers are learning to blend malicious traffic with legitimate user behaviour, to buy botnet capacity on demand, and to weaponise leaks and social networks. Election authorities must treat cybersecurity as central to election planning — not an afterthought.
Clear recommendations — policymakers, election authorities, citizens
For policymakers:
Fund continuous security: dedicated budgets for election cyber-defence, independent audits, and a national-level SOC that can surge capacity on result days.
Strengthen legal frameworks for accountable disclosure, cross-border takedowns and sanctions against services that enable attacks.
For election authorities:
Adopt ‘red-team’ exercises that simulate DDoS + application attacks under real traffic conditions.
Harden authentication and admin access with hardware-backed MFA, immutable logging, and rapid rollback capabilities.
Segregate public-facing results dashboards from internal administrative systems and keep critical backstops offline or on air-gapped channels where possible.
Invest in transparent communications: be ready to explain what was attacked, what failed (if anything), and what was done to fix it.
For citizens:
Demand transparency: ask your election body how they protect results and why certain safeguards exist.
Be sceptical of sensational claims on social media; rely on official channels for result updates during counting.
Protect your own accounts — use strong passwords and MFA — because election-related disinformation often begins with compromises of personal accounts.
My closing note
I have long argued that digital transformation of elections is unavoidable and valuable, but that technology must be accompanied by continuous security and clear public communication (see my earlier reflections on digitisation and election security).Thank You, Shri Sushil Chandra
This 68-lakh attempt episode should be a wake-up call: the systems survived this time, but survival alone is not sufficient. We must harden, rehearse, fund and explain — because the health of our democracy now depends as much on good engineering and public trust as it does on civic participation.
Regards,
Hemen Parekh
Any questions / doubts / clarifications regarding this blog? Just ask (by typing or talking) my Virtual Avatar on the website embedded below. Then "Share" that to your friend on WhatsApp.
Get correct answer to any question asked by Shri Amitabh Bachchan on Kaun Banega Crorepati, faster than any contestant
Hello Candidates :
- For UPSC – IAS – IPS – IFS etc., exams, you must prepare to answer, essay type questions which test your General Knowledge / Sensitivity of current events
- If you have read this blog carefully , you should be able to answer the following question:
- Need help ? No problem . Following are two AI AGENTS where we have PRE-LOADED this question in their respective Question Boxes . All that you have to do is just click SUBMIT
- www.HemenParekh.ai { a SLM , powered by my own Digital Content of more than 50,000 + documents, written by me over past 60 years of my professional career }
- www.IndiaAGI.ai { a consortium of 3 LLMs which debate and deliver a CONSENSUS answer – and each gives its own answer as well ! }
- It is up to you to decide which answer is more comprehensive / nuanced ( For sheer amazement, click both SUBMIT buttons quickly, one after another ) Then share any answer with yourself / your friends ( using WhatsApp / Email ). Nothing stops you from submitting ( just copy / paste from your resource ), all those questions from last year’s UPSC exam paper as well !
- May be there are other online resources which too provide you answers to UPSC “ General Knowledge “ questions but only I provide you in 26 languages !
No comments:
Post a Comment