INEC, DSS Probe Alleged Voter Data Leak After Atiku’s Demand For Answers

The Independent National Electoral Commission (INEC) and the Department of State Services (DSS) have launched separate investigations into the alleged unauthorised disclosure of voter information from the commission’s Continuous Voter Registration (CVR) database, amid concerns raised by former Vice President and African Democratic Congress (ADC) presidential candidate, Atiku Abubakar.

In a statement issued on Tuesday by the National Commissioner and Chairman of the Information and Voter Education Committee, Mohammed Haruna, INEC confirmed that it had commenced a comprehensive investigation into allegations of unauthorised access to its voter registration database and the subsequent release of information relating to a candidate who participated in a recent political party primary in the Federal Capital Territory (FCT).

The electoral body said preliminary findings showed there was no external breach of its database or information technology infrastructure.

According to INEC, authorised registration officers participating in the ongoing nationwide CVR exercise were granted controlled access to specific sections of the system to perform official duties, including registering new voters, processing transfer requests, and updating voter records.

The commission disclosed that its audit trail enabled investigators to identify the user account used to access the information. It added that relevant personnel had been questioned and that all units connected to the incident were cooperating with the probe.

INEC explained that investigators were examining all technical, administrative, and operational aspects of the matter to determine responsibility and establish whether internal access-control protocols were breached.

“Preliminary findings from the commission’s audit trail so far, however, indicate that there was no external breach of the CVR database, no hacking incident, and no unauthorised external access to the commission’s ICT infrastructure.

“Rather, the information in question was accessed through valid user credentials assigned to personnel participating in the ongoing CVR exercise but released without authority,” the commission stated.

INEC further clarified that the incident involved the retrieval of a specific voter record and did not compromise the wider voter registration infrastructure or the personal information of over 90 million registered voters.

Reaffirming its commitment to data security and confidentiality, the commission said it remained dedicated to transparency, institutional integrity, and the protection of voters’ personal information.

It also revealed that the DSS had independently commenced an investigation into the matter and pledged full cooperation with security agencies, warning that anyone found culpable would face appropriate legal action.

The commission urged the public and the media to avoid speculation while investigations were ongoing, assuring Nigerians that its final findings would be made public.

LEADERSHIP reports that Atiku had on Tuesday said INEC’s explanation had raised more questions than answers, arguing that the admission that voter information was accessed using valid official credentials pointed to a possible internal compromise.

In a statement issued by his Senior Special Assistant on Public Communication, Phrank Shaibu, Atiku said the key issue was how information stored in a restricted electoral database ended up in the public domain.

“INEC’s statement has moved this issue beyond conjecture. The commission has now confirmed that voter information was accessed using credentials assigned to personnel participating in the ongoing CVR exercise, and that this information was released without authority.

“What Nigerians want to know is simple: how did information that resides within a restricted electoral database find its way into the hands of political actors and their associates?” he asked.

The former vice president maintained that the absence of an external cyberattack did not reduce the seriousness of the matter.

“The fact that there was no external hack does not diminish the gravity of the incident. If anything, it raises even more troubling questions about internal controls, institutional safeguards, and the possibility of political interference,” he said.

Atiku also questioned the role of Lere Olayinka, spokesman to the Minister of the Federal Capital Territory, Nyesom Wike, who publicly released the information that sparked the controversy.

“What makes this entire episode impossible to ignore is that the information in question did not emerge from a whistleblower, an investigative journalist, or an anti-corruption agency. It was publicly released by Mr Lere Olayinka, spokesman to the Minister of the Federal Capital Territory, Nyesom Wike,” he stated.