The official website of the Independent National Electoral Commission (INEC) hosted dozens of gambling and casino-related articles, raising questions about the security of the electoral body’s digital infrastructure ahead of the 2027 general elections.
The discovery was made by an X user, Martin Uwakwe, known for analysing public-sector digital infrastructure, election data and government websites.
|
|
In a post on X, using the handle @mundus01, Mr Uwakwe said he found about 28 gambling and casino pages hosted directly on INEC’s official website.
He stressed that the pages were not links from INEC’s website to gambling platforms, but actual articles published under the Commission’s domain.
|
|
|
|---|
One of the pages he identified was “inecnigeria. org/discover-the-excitement-of-instant-casino-france/,” hosted on the INEC domain.
According to him, most of the pages were published under the WordPress author name “Ajuma Achor.”
He said he subsequently found that a person with the same name, Ajuma Achor, had worked with Interra Networks, a technology vendor that had worked on INEC’s website.
Mr Uwakwe said the person’s LinkedIn profile appeared to indicate that she left Interra Networks some years ago.
Although the pages have been deleted, Mr Uwakwe said they had been archived by the Wayback Machine despite their subsequent removal from INEC’s live website.
“Even though these pages have now been deleted, they were already archived on the Wayback Machine. We need a thorough independent audit of INEC’s technical infrastructure.”
PREMIUM TIMES reviewed the archived links provided by Mundus and confirmed that the casino-related pages had been published and hosted on INEC’s website.
Some of the archived pages include: articles promoting or discussing online casinos and gambling, despite having no apparent connection with the electoral commission’s mandate.
The discovery raises questions about how the content was uploaded to the website and who had, or still has, publishing access to INEC’s content-management system.
Mr Uwakwe said he could not establish exactly how the pages came to be published.
He identified two possible explanations.
“Either INEC’s website has been compromised for a long time without anyone noticing, possibly through an old or compromised publishing account; or someone with access to INEC’s website is abusing that access to publish casino content, potentially as paid SEO placements,” he said.
Mr Uwakwe argued that the incident should prompt questions about the wider security of INEC’s digital infrastructure, particularly with the 2027 elections approaching.
“If someone can quietly publish dozens of casino pages on INEC’s official website, then the bigger question is: what stops that same access from being used on election day to publish false information, fake results or a misleading announcement capable of causing chaos across the country?” he asked.
He said removing the pages was not enough and called on INEC to establish how the content got onto the website.
“This needs more than deleting the casino pages. INEC needs to determine who has publishing access, how these pages got there, and whether that access still exists,” he said.
Meanwhile, in an earlier post, Mr Uwakwe said he had privately contacted INEC with detailed information about the vulnerability on INEC Result Viewing Portal (IReV) but received no acknowledgement.
“I noticed a major vulnerability in the @inecnigeria IReV portal that can affect the 2027 General election and reached out to them with detailed information. It has now been three days, and I have even sent a follow-up, but I have received no acknowledgment, not even a simple ‘Received.’”
“More concerning, nothing appears to have been done to address the vulnerability I discovered,” he wrote.
Speaking with PREMIUM TIMES, he confirmed to that what was discovered on the IReV portal is a “completely different issue.”
Asked what the discoveries were, he said, “I don’t want to make it public so bad actors don’t take advantage of it, that was why I reached out to INEC directly, and the director of ICT has assured me they are working to fix it ASAP. I will keep monitoring and possibly escalate if it doesn’t get fixed.”
INEC ICT director ‘responds’
In a fresh post on Thursday, Mr Uwakwe said he had received a response from INEC’s Director of Information and Communication Technology explaining steps being taken to address the vulnerabilities he identified in the IReV portal.
“I woke up to a detailed message from the Director of ICT at INEC explaining what they are doing to fix the vulnerabilities I identified in the IReV portal,” he wrote.
“Hopefully, they can get this sorted as soon as possible.”
Mr Uwakwe also clarified that the website and casino issue was not the problem he had initially reported privately to INEC.
“Also, just to clarify: the issue with the website and casino links wasn’t what I raised with them privately a few days ago,” he said.
According to him, he discovered the casino pages only after publicly posting about INEC’s failure to respond to his earlier email concerning the IReV vulnerability.
“It was after I made the post about INEC not responding to my email that I discovered the casino links. Since I didn’t get a response regarding the IReV issue, I felt there was no point going that route, hence the post that has now went viral,” he said.
READ ALSO: 2027: INEC to clean up voter register, release details of new political parties
INEC silent
PREMIUM TIMES contacted the INEC spokesperson, Mohammed Haruna, through telephone calls and WhatsApp messages, to seek clarification on the casino pages, the “Ajuma Achor” WordPress account, who had access to publish content on the commission’s website and whether the incident was being investigated.
The newspaper also sought to know whether INEC was aware that the pages had been hosted on its official website and whether the commission had conducted, or planned to conduct, a security audit of its digital infrastructure.
There was no response to the enquiries as of the time of filing this report.
The casino pages have since been deleted from the live website, but their existence in archived records means the incident remains traceable.
Discover more from Premium Times Nigeria
Subscribe to get the latest posts sent to your email.
