Data security fears: INEC assures 2023 election results safe

The Independent National Electoral Commission has said its 2023 election results remain intact and securely stored on Amazon Web Services, following concerns over the expiration of inecelectionresults.net, a domain previously hosting the INEC election results portal.

The commission’s Director of Information and Communication Technology, Lawrence Bayode, clarified in a chat with The PUNCH, while responding to a post by MundX Analytics, a Nigerian elections data and analytics company.

MundX alleged that INEC allowed the domain used to deliver some 2023 polling-unit result sheets through the INEC Results Viewing Portal to expire, and it was acquired by a firm, which redirects users to an advertising website.

But Bayode said the expired .net domain did not host INEC’s election data, explaining that the commission had migrated from the domain to its current .ng platform, while the actual election results were stored separately on Amazon Web Services.

“Who said we have our data on that domain? So, it means that they don’t know what they are saying. It’s a platform that we no longer use. It’s a .net, and at some point, we migrated from that .net to .ng. Even on this current .ng, our data is not on that domain. We don’t put our data on domains,” he clarified.

According to the ICT director, the problem arose because some old links to result sheets were still pointing to the discontinued domain.

“Our data is not on that domain. Our data is on AWS. The only thing is that when you go to that domain, some of the results at that time are pointing to that domain, to that dot net domain,” Bayode said.

He explained that INEC did not renew the domain because it was no longer in use following the migration to the .ng platform.

“So if we stop using that link and we migrated to .ng, because when you create a domain, and you stop using it, it will get to a point where they will put that domain for sale, and because we no longer use that domain, I think it got expired because we don’t use it again. So, there is no need for us to renew a domain that we no longer use,” he pointed out.

Bayode also dismissed any suggestion that INEC’s election data had been acquired by another person or organisation, insisting that the results remained intact.

“Nobody acquired our data. Nobody acquired our link. Our data is our data. And it’s still intact. The data is there,” he said.

He disclosed that the commission became aware that some result links were still pointing to the old domain while preparing its platform for the Osun State governorship election.

According to him, INEC subsequently directed its technical team to identify the affected links and ensure that they pointed to the commission’s current .ng platform.

“We told them to run it and ensure that they are pointing to the right domain, which is the .ng. That is the right domain that we are using now,” Bayode noted.

He, however, stressed that the .ng domain itself did not contain the election results.

“And because we are using that .ng now, it doesn’t mean that our result is on that .ng domain that we are currently using. Our result is not on that domain.

“Our result is on AWS, and it’s stored in an S3 bucket on AWS. That is where we store our results. So, it is stored on S3 on AWS,” he said.

Bayode said INEC had used Amazon’s Simple Storage Service to store election results since the commission began deploying IReV.

“All our results are there on that bucket. They are there from 2023. Since we started using IReV, it is a Simple Storage Service on AWS. That is where we store all our results.

“So we don’t put our results on a domain. Who on earth would put their result on a domain? Which domain?” he asked.

However, while INEC maintains that its underlying election data remains secure, MundX’s complaint centred on the accessibility of result sheets through old links associated with the discontinued domain.

In its post on X, the analytics company alleged that INEC no longer controlled the .net domain, which it said had been used to host links to hundreds of thousands of 2023 polling-unit result sheets on the IReV portal.

MundX said the domain was dropped after expiring on April 25, 2025, and was subsequently registered by another client.

It further claimed that at least 470,619 result records pointed directly to the expired domain, leaving hundreds of thousands of result sheets inaccessible through their original IReV links.

“INEC no longer controls the domain. It used to host hundreds of thousands of 2023 polling unit result sheets on the IREV portal, and Nigerians who keep those records are now being redirected to advertising websites,” MundX said.

“For the 2023 general election, INEC used inecelectionresults.net to host results sheets linked from its official IREV portal.

“But on April 25th, 2025, the domain was dropped after it expired. At 6.37 pm, the same day, it recorded a new registration through NameBright. Someone outside of INEC had gotten control of it.

“Today, the domain is connected to a commercial domain parking system designed to monetise internet traffic through advertising and redirects. A pathway to Nigeria’s election record has become a pathway to advertisements. This is what Nigerians now experience.”

The company said it had contacted INEC more than a month earlier over the issue and urged the commission to restore affected links and secure its election-results infrastructure.

“More than a month later, nothing has been done. The results sheets remain unavailable, the redirects continue, and Nigerians still have no explanation. INEC’s responsibility did not end when these results were uploaded.

“It includes preserving them, protecting them, and ensuring that Nigerians can access them. We ask INEC to please take their job seriously, restore the results sheets, repair the links, secure the infrastructure, and explain how a domain connected to Nigeria’s election results was allowed to expire and pass out of your control. Nigeria’s election records are public evidence. Public evidence should never be allowed to expire,” the company said.

Attempts by our correspondent to access the site failed as it indicated it was for sale.

Following the conflicting positions, The PUNCH contacted MundX for further clarification of its findings.

Responding by email on Tuesday, the company’s founder, Martin Uwakwe, clarified that the investigation did not find a database containing voters’ personal information, biometric data, Permanent Voter Cards or the voter register on the affected domain.

He said the records involved were images or PDF copies of polling-unit result sheets previously published through IReV for public scrutiny.

Uwakwe also said MundX could not establish from the available evidence that INEC had “sold” the domain or that NameBright had purchased it.

• INEC registers 9.3m youths ahead of 2027 election – Amupitan
• Nasarawa was least endowed in 1996, now development hub — Jega
• Let Nigerians’ votes count in 2027, Kingibe urges INEC

Rather, he said, inecelectionresults.net appeared on a domain-drop list on April 25, 2025, and was newly registered later that day through TurnCommerce Inc., trading as NameBright.com.

He said the identity of the registrant was hidden behind a privacy service, while its nameservers are operated by AboveDomains, a commercial domain-parking provider.

According to Uwakwe, MundX’s audit directly confirmed 470,619 affected result records.

He said the company had found no evidence of a mass leak of voters’ personal information or a compromise of INEC’s BVAS or core election databases.

He, however, warned that whoever controls the domain could potentially collect information from people who follow old IReV links, including their IP addresses, timestamps, browser information and the particular polling-unit path requested.

“The larger risks are: loss of access to public election evidence; phishing, tracking, deceptive advertising or possible malicious redirects; the possibility of false documents being presented under a domain previously associated with INEC; damage to the perceived integrity and chain of custody of election records; and reduced public confidence in IReV ahead of 2027,” he said.

Uwakwe noted that the domain was registered until April 25, 2027, “meaning the exposure extends into the 2027 election cycle.”

He added that while the incident did not establish that any election result had been altered, “it creates an avoidable channel for disinformation and impersonation.”

MundX urged INEC to remove or replace every IReV link pointing to the legacy domain and restore the affected result sheets on storage and domains under the commission’s control.

Uwakwe also advised INEC to seek recovery or acquisition of the domain from its current registrant, where possible, and investigate the circumstances surrounding its expiry, renewal and vendor management.

Such an investigation, he said, should include a review of DNS, registrar, hosting and access logs.

On whether INEC could simply erase the data from the domain, Uwakwe explained that a domain name was only an address and not the underlying data store.

“Re-registering the domain would not automatically give the new registrant possession of INEC’s original files,” he said.

He added that INEC could not unilaterally delete content or access logs held by the current domain operator while it remained outside the commission’s control.

According to him, such action would require the cooperation of the registrant, registrar, hosting or advertising provider, or an appropriate legal order.

“The correct remedy is to stop the unsafe redirects, restore the authentic result sheets on controlled infrastructure, repair the IReV links and investigate whether any third party retained personal information from visitors,” Uwakwe said.

The Centre for Anti-Corruption and Open Leadership expressed concern about the possible implications of the affected links for ongoing litigation arising from the 2023 elections.

The organisation’s Chairman, Debo Adeniran, said the availability of polling-unit result sheets could become important where such documents were required as evidence in pending election-related cases.

“If those results from those polling units are needed as evidence and are no longer available, we will be worried that it will be difficult to dispense justice in such a case,” Adeniran said.

He said that even where the affected results were no longer required in court, their unavailability could still raise concerns about the preservation of election records in public archives.

Adeniran also urged INEC to strengthen its cybersecurity and monitoring systems, arguing that the commission should be able to detect and respond quickly to attempts to compromise its websites, portals or related infrastructure.

“It is very difficult to prevent, to totally prevent, hacking into their platforms, into the website, into the portals and all that, because the hackers themselves are ready,” he said.

He said INEC should therefore remain “extra vigilant” and ensure that its technical teams could detect and stop suspicious activity before it caused irreversible damage.

The CACOL chairman also said INEC needed to demonstrate that its migration from the old domain had been properly executed, rather than merely assuring Nigerians that the election data remained secure.

“What they need to assure us or to demonstrate is how reliable that migration is,” he said.

Adeniran noted that Nigerians should be able to independently access the results of elections conducted at the affected polling units, arguing that such accessibility was important for public confidence in the electoral process.

He added that election technology and infrastructure should not only be presented as secure but should be demonstrably reliable.

“It is not only to be said. It has to be demonstrated to be credible,” he said, adding that vigilance by INEC’s technical teams remained critical to protecting election records and maintaining confidence in the electoral process.

INEC’s current IReV platform remains accessible and provides election-result information for recent and previous elections, including the 2023 general elections and the 2026 off-cycle elections.

Weighing in, the National Publicity Secretary of the Nigeria Democratic Congress, Osa Director, warned Nigerians to be concerned about the 2027 general elections, declaring that the INEC remains the “greatest threat” to Nigeria’s democracy.

Director spoke against the backdrop of concerns raised over the accessibility of some 2023 election records on the commission’s former electronic results platform and INEC’s planned deployment of artificial intelligence in the 2027 elections.

“There is a need for Nigerians to be afraid of the 2027 election, even without this revelation. I have always maintained that the greatest threat to Nigeria’s democracy is INEC.

“We have to ensure that we compel INEC to do what is right by conducting a free, fair, transparent and credible election.

“We also need the international community to support us in this regard to pressure the commission. INEC remains the biggest threat to a free and fair election in Nigeria. I am not even saying this because of this latest revelation. I don’t trust INEC.”