"YOU have no business asking them to fill Form 6 because the system didn't allow you to do it on Form 8." With this one sentence, on 30 September, a division bench of the Bombay High Court at Goa, Justices Valmiki Menezes and Amit Jamsandekar, put its finger on the key issue of the Special Intensive Revision (SIR). The SIR has left out more than 13 crore voters, and their only way back is to lie and claim they are first-time voters.

The case before the Court was that six members of the Salgaoncar family in Goa had moved house within the same constituency. At the directions of the booth-level officer, they filed Form 8, the statutory form for a change of address. As the Election Commission's software would not accept Form 8 during the SIR, their names were deleted. The Election Commission's remedy: they should now file Form 6, the form for first-time voters, and lie that they had never been on the rolls. Paresh Salgaoncar refused and went to court instead.

At the outset, the bug in the system is not the Electronic Voting Machine (EVM), which is a far simpler device akin to a calculator and much easier for outside experts to test. Yes, serious questions remain about the powers of the Chief Election Commissioner: whether the Commission must decide by majority when there is no consensus, and whether the Chief Election Commissioner can take key decisions on his own. But the issue here is even more basic. Whatever Parliament legislates, the EC decides, and whatever the courts rule, the electoral roll that decides who may vote is finally generated by a software system, ECINet. If the architecture and code in the ECINet system do not permit what the law requires, the code running the system becomes the law!

Lawrence Lessig made this argument a quarter century ago in Code and Other Laws of Cyberspace https://archive.org/details/codeotherlawsofc0000less. According to Lessig, there are two kinds of code: the code that legislatures write, and the code that programmers write; in the digital world, the second increasingly governs the first. His concern then was copyright. Today, when banking, welfare, tax compliance, and now the electoral rolls run on remote servers, the question that matters most for democracy is this. Who writes the code? Who tests it against every case the law contemplates? And who answers when the machine overrides the law?

The scale of what is at stake is now public. According to Election Commission data reported on 30 September, 13.3 crore names have been removed from draft rolls under the SIR. Of these, 21 per cent, or 2.8 crore, are recorded as deaths and 7.5 per cent, or 1.01 crore, as multiple enrolments. The remaining 71.5 per cent, roughly 9.5 crore people, fall under the catch-all of "absent, permanently shifted or other reasons". That is where the “logic” of the machine bites. The CEC proceeded on the principle that anyone whose record showed a "logical discrepancy" was presumed ineligible unless proven otherwise. In a country where 20 per cent of adults are not literate, where close to 30 per cent of the population are migrants for work or marriage, and where crores live in rented rooms, shanties or with no fixed address at all, that presumption does not filter out fraud. It filters out the poor.

The software converts this presumption into permanent exclusion in four ways.

First, Form 6 is the only door back. Once the SIR roll is declared, ECINet permits additions only through Form 6. Under the Registration of Electors Rules, 1960, Form 6 is for a person applying to be enrolled for the first time. The declaration attached to the online form on ECINet still says exactly that. So a voter who has voted for thirty years, and whose name was dropped because a booth-level officer, for example, could not find her at home, must lie to the machine that she is a new voter to recover the truth that she is an old one. The 9.5 crore people in the "absent or shifted" category are now being told this is their only route back.

Second, the Goa case shows that this is in the architecture itself, and not an accidental coding error. After a Supreme Court order, Electoral Registration Officers (EROs) in Goa examined 97 flagged voters and found them eligible for inclusion. The software had no option to record that decision or to restore the names. The Goa Chief Electoral Officer's office wrote to the Commission eight times asking for a rollback option. None was provided. The 97 stayed off the final roll of February 2026. The Commission's eventual answer was to send booth-level officers door to door to collect Form 6, and 81 of the 97 have now filled it. The ERO is the statutory authority under the Representation of the People Act, 1950 for enrolling voters. In Goa, the statutory authority was overruled by the code in the machine; the code became law regardless of what the letter of the law stated.

Third, the dissent came from inside the Commission itself. According to the Indian Express, Election Commissioners Sukhbir Singh Sandhu and Vivek Joshi recorded written objections on at least 14 occasions over 10 months. Their point was precisely the one Lessig made. Form 6 and Form 8 are "prescribed statutorily" and "cannot be altered without amendments in the Registration of Electors Rules, 1960". Sandhu called the altered Form 6 "unauthorised/illegal" and asked for its removal. Both warned of the "gradual centralisation of the electoral roll database", asked for an audit of who holds the credentials to change it, and questioned the limits placed on state officials' access. They wrote to the Cabinet Secretary about changes in oversight of the Commission's IT division made without their knowledge, and copied their letter to the Chief Election Commissioner Gyanesh Kumar.

Only after the deletion figures became public did the Commission, in its press note of 26 September, promise a committee with an IIIT expert to review ECINet "for compliance with election laws and rules". The roll of the world's largest electorate was built, deployed and used to delete 13.3 crore names before anyone checked whether the software complied with the law.

Fourth, there is the issue of centralisation itself. Under the 1950 Act, the roll is prepared and finalised by officers on the ground, who must hear a person before deleting them. ECINet has replaced this with what the Commission calls "role-based access": the field officer can do only what the central system has been programmed to allow. Deletions are mass-produced by algorithmic flags; restorations however are restricted in violation of the law. The Bombay bench saw the consequence. It said, "You cannot delete anybody without a hearing. That's the law as we understood it." The Commission's counsel pleaded "shortcomings in the software". That is the entire point. The shortcoming in the software is de facto the law now.

Is this incompetence or something more deliberate? Evidence supports a darker reading. But the structural argument here does not depend on intent. A system whose default is to delete, whose recovery path requires a false declaration, and whose exception cases were never tested, will purge the poorest regardless of who designed it and with what intent. The question is who decided the architecture, who signed off on the test cases, and why the two Commissioners who asked questions were ignored 14 times!

The history of electoral purges by database is not reassuring. In Florida in 2000, a private contractor, DBT Online, which later became a part of ChoicePoint, produced a list of some 58,000 alleged felons to be struck from the rolls. The matching rules were loose, the list was disproportionately black, and thousands of eligible voters were turned away. George W. Bush carried Florida, and the presidency, by a mere 537 votes. No official was tried; the software had done it. India has its own precedent. When Aadhaar-based biometric authentication was made mandatory for rations, failures of the machine resulted in denials of food, and people died of starvation in Jharkhand with valid ration cards in their hands. In each case, the state's presumption that a citizen’s claim is fraudulent unless proven otherwise was written into code, and the code carried out exclusions at scale with deniability that no human could match.

A democratic architecture is not hard to describe. The decision of the statutory officer would bind the machine, not the reverse. Every exception the law contemplates, including the restoration of a wrongly deleted voter, would be tested before the system goes live. The source code, the design documents and the deletion logs, disaggregated by state and category, would be public, as the proceedings of Parliament are public. None of this is technically difficult. The free software movement settled long ago that code which governs the public, must also be open to the public.

The Chief Election Commissioner is now scrambling to do what he refused to do for ten months. But the same person and the same system that produced 13.3 crore deletions are being asked to undo them. The citizen's demands must therefore be concrete: a statutory correction route that does not require anyone to lie; publication of every deleted name with the reason for deletion; an independent audit of ECINet's code and access logs; and a Commission that functions by majority, with its minutes on the record.

Yes, there is indeed a bug in the machine. It is not in the EVM but in the software that decides who gets to stand in front of one.