The Independent National Electoral Commission (INEC) has prohibited the use of external web cameras for voter registration after acknowledging that artificial intelligence-generated images infiltrated the national register of voters. Consequently, the electoral agency instructed its Director of Information and Communication Technology (ICT) to transition to an integrated app-based camera mechanism that restricts the importation of photographs from external systems.
Professor Joash Amupitan, the INEC Chairman, announced these sweeping changes during a press briefing held in Abuja on Monday. He revealed that the security compromise stemmed from compromised administrative credentials, noting that certain passwords had been misused by authorized personnel. This announcement coincided with the removal of 1,609,553 invalid records from the voter database and the identification of 54 staff members across 10 states linked to registration infractions, as the country prepares for the presidential election scheduled for January 16, 2027.
How did the unauthorized pictures infiltrate the system?
During the briefing, Professor Amupitan explained that the commission successfully mapped the digital pathways utilized to introduce the AI- generated images into the voter register. He emphasized that system breaches often rely on compromised credentials, stating that it takes a single vulnerability to compromise security.
"Some of that access came from authorised persons," Professor Amupitan stated, highlighting the risks associated with delegated administrative privileges and advanced digital manipulation tools. To counter this, the commission has overhauled its capture protocol to eliminate external image sourcing.
"It is what is on the app that will take picture," he stressed, cautioning registration personnel against utilizing external web addresses to import images into the database.
When did the controversy begin?
The database discrepancies first came to light in October when the preliminary register was published online, prompting widespread public criticism over unusual profile photographs shared across social media platforms. INEC formally acknowledged these observations the following day, later confirming that specific vulnerabilities originated from internal registration officers.
The revelations prompted immediate public scrutiny and demands for accountability. Civil society groups, including the Socio-Economic Rights and Accountability Project (SERAP), called for an independent inquiry, while political figures such as Atiku Abubakar formally requested transparency regarding the origin of the photographs, the individuals responsible, and the security checks that failed.
Which personnel are involved in the breach?
INEC's internal technical audit revealed that select registration officials intentionally bypassed established operational protocols, exploiting provisions originally designed to accommodate exceptional cases such as individuals with disabilities. Professor Amupitan confirmed that 54 personnel have been identified as complicit and are currently facing administrative disciplinary measures alongside potential criminal prosecution.
While the investigation progresses, the commission has yet to specify the total volume of AI-generated photographs identified or the exact number of credentials compromised. Furthermore, authorities have not clarified whether the 54 disciplined staff members were directly responsible for uploading the synthetic images.
Responding to inquiries regarding the suspects, Professor Amupitan confirmed their employment status with the electoral body. "We are not covering anything," he affirmed, noting that independent security and law enforcement agencies are conducting parallel investigations.
As part of preventative measures, the commission approved a specialized artificial intelligence governance framework developed in partnership with the International Foundation for Electoral Systems and the UK High Commission. This initiative aims to fortify the agency's ICT infrastructure and cybersecurity posture ahead of upcoming electoral activities, alongside confidential security upgrades.
Despite these technological interventions, the electoral body acknowledged that database sanitization remains ongoing. Professor Amupitan cautioned that purifying the ongoing 2025/2026 registration cycle alone would not entirely resolve legacy database issues, as historical duplications spanning from the 2011 to 2023 registers would persist into the Final Register scheduled for official publication on December 15.