Journalist Data Leak Exposes Election Commission Failings

As preparations for Bangladesh’s 13th National Parliamentary Election intensify, a serious breach in the Election Commission’s (EC) online application system has exposed the personal data of at least 14,000 journalists for approximately two hours. The leaked information included journalists’ photographs, signatures, National Identity (NID) numbers, office identification cards, and the approved lists of their respective media organisations.

International Criminal Tribunal prosecutor and IT security expert Tanvir Hasan Zoha described the incident as “a direct consequence of institutional negligence.” Speaking to Prothom Alo, he questioned, “How can a constitutionally mandated institution deploy a system with no data protection, access controls, or even basic security testing? The most critical concern is whether this sensitive information reached any third parties.”

Zoha further criticised the paradoxical situation: “Those who publicly champion digital security and personal privacy often hold such sensitive data in the most insecure manner.”

This breach occurred in the context of the EC’s first mandatory online application system for journalists to obtain election cards and vehicle stickers via pr.ecs.gov.bd. Following concerns raised by media professionals, the EC reversed the requirement last Thursday, opting to distribute cards manually. However, during the prior online application process, the system’s security flaws were already evident. On Saturday afternoon, around 4 pm, anyone accessing the website with “admin” in the URL could view complete applications, including names, mobile numbers, and NID details. Although the vulnerability was closed by the evening, the damage was already done.

Senior Secretary of the Election Commission Secretariat, Akhtar Ahmed, stated: “We received some calls in the afternoon but are still investigating how the breach occurred. We will conduct a detailed review at the office tomorrow.”

Experts emphasise the importance of rigorous security testing and robust protection of sensitive data before deploying any state-run digital system. B.M. Mainul Hossain, Director of Dhaka University’s Institute of Information Technology, commented: “Digital systems rely fundamentally on trust. When institutions fail to build that trust, public confidence in digital governance erodes, placing the entire digital transition at risk.”

Summary of Journalist Data Leak:

This incident starkly highlights weaknesses in Bangladesh’s digital security infrastructure, underscoring the urgent need for enhanced state oversight to protect both voters’ and journalists’ personal data.