The story so far:
The case of voter fraud in the Aland assembly constituency in Kalaburagi district in north Karnataka has emerged as one of the most well documented voter fraud cases, amidst a series of press conferences by Opposition leader Rahul Gandhi alleging widespread “vote chori” (vote fraud) in Karnataka, Maharashtra and Haryana.
Why is this case different?
Firstly, it was the Returning Officer (RO) of Aland constituency who lodged a complaint with the police in February 2023, alleging voter fraud, based on which an FIR was registered. The Election Commission (EC) itself alleged a malafide attempt to delete the names of 5,994 genuine voters from the electoral rolls, by providing false information.
Secondly, the investigation into the FIR by a Special Investigation Team (SIT) formed by the Government of Karnataka, has led to a chargesheet being filed against former Bharatiya Janata Party (BJP) MLA Subhash Guttedar from Aland and his son Harshananda Guttedar for allegedly hiring a private firm to target voters they suspected will vote for his rival and delete their names through forged Form 7s.
This is the first case where a clear link has been drawn to the BJP and “vote chori” allegations made by the Congress.
How was the fraud uncovered?
In 2018, veteran socialist and now Congress MLA from Aland, B. R. Patil, lost the seat to BJP’s Subhash Guttedar by a narrow margin of 697 votes. Mr. Patil was again the candidate for the seat from the Congress in the 2023 assembly polls, which he eventually won by 10,348 votes.
In February 2023, a Booth Level Officer (BLO) got a Form 7 application, which, to her surprise, sought deletion of the name of her brother from the voter list saying he had “shifted out.” The application was made in the name of a woman from the same village. When they checked, the woman denied making any application. Subsequently, a review of Form 7s from that village found that 40 such forms were forged.
Any voter of a specific assembly constituency can fill out a Form 7 seeking the deletion of names of other voters from the same constituency, after their death or if they have shifted out. These applications are sent to BLOs for an on-ground verification, after which they are processed. However, in most cases, BLOs blindly accept these applications without verification. In this case, the BLO’s brother, whose name was sought to be removed, tipped off Mr. Patil about the forged Form 7s in his village, saying all people whose names were sought to be deleted were Congress voters. This set off alarm bells, pushing Mr. Patil to complain to the EC and demand a thorough verification of all Form 7s.
How did the investigation proceed?
Mamata Kumari, Assistant Commissioner and the then RO of the Aland assembly constituency, tasked with the audit of Form 7s, in her eventual complaint to the Aland Police, said that there were 6,018 Form 7s in Aland assembly constituency between December 2022 and February 2023, of which only 24 were genuine while 5,994 forms were forged. She said that there was a conspiracy to disenfranchise genuine voters and sought a probe; an FIR was registered against unidentified individuals. The probe into the FIR was eventually transferred to the Criminal Investigation Department (CID) of Karnataka.
The EC shared data for over 5,700 forged Form 7s to the police, including the mobile numbers used to create login IDs and passwords on EC portals such as the National Voters’ Service Portal (NVSP) through which all forged Form 7s were submitted. It also provided IP logs. The CID got the Public Internet Protocol Detail Record (IPDR) from Telecom Service Providers (TSPs), which were in the IPV4 format and each IP address had over 200 users attached to it in the form of dynamic IP addresses. This meant probing over 8 lakh devices. To narrow down the search, the CID sought destination IPs and ports of the sessions through which these forged Form 7s were made. Despite at least 12 letters written by the CID to the EC seeking this data, the Commission did not respond, as reported by The Hindu on September 7.
Then, on September 18, 2025, Mr. Gandhi held a press conference in Delhi questioning the EC over the Aland vote fraud. Even though the Commission initially claimed that there was no wrongful deletion of voters in Aland, a day later, the Chief Electoral Officer of Karnataka conceded that there were “unsuccessful attempts” to delete voters and that the EC itself had lodged a complaint.
Following this, the government in Karnataka formed an SIT led by B. K. Singh, Additional Director General of Police (ADGP), Karnataka.
How was the case eventually solved?
As the EC did not share the destination ports and IPs, the SIT found another route. Sources said the SIT scrutinised some of the 24 genuine Form 7s made in Aland, identified their IP addresses and reverse engineered them to narrow down the search for the devices used to make the forged Form 7s.
The SIT found that many of the 5,994 forged Form 7s could be traced to a mobile internet connection of one Mohammed Ashfaq, based out of Kalaburagi. Ashfaq reportedly confessed to having submitted forged Form 7s, but said he was only working for his relatives, Akram Pasha and Aslam Pasha, who ran a “call-centre-like” firm in Kalaburagi which had a contract to make Form 7s. They were allegedly paid ₹80 for every forged Form 7. The Pasha brothers were then detained, questioned and their premises raided. The SIT claimed that they recovered multiple digital devices through which the forged Form 7s were made, which now forms the key evidence in the chargesheet the SIT has filed recently.
The trio reportedly said that they had a contract to do so from the then incumbent BJP MLA Subhash Guttedar, a four-time MLA from Aland, and his son Harshananda Guttedar, a three-time Kalaburagi Zilla Panchayat member. The SIT further raided their residences and that of their Chartered Accountant in Kalaburagi, and recovered digital devices and evidence of a money trail between the Guttedars and Akram Pasha. It is alleged that the Guttedars marked out voters they thought would vote for their rival and handed it over to Akram Pasha.
Additionally, the Guttedars were caught destroying evidence, including several bundles of voter lists stored at their Aland residence. They have been charged for destruction of evidence as well.
What was revealed in the course of the investigation?
In 2023, the EC had shared with the investigators as many as 64 mobile numbers using which accounts were created on the NVSP. It was through these accounts that the 5,994 forged forms were submitted. When a person creates an account on NVSP, s/he will have to key in his mobile number, which will be the Login ID, and get an OTP. This will lead the portal to verify the user, following which a password needs to be set.
The probe started with these phone numbers. The investigators found that the owners of these mobile numbers were from over 15 States of the country. None of them had either created these accounts or given out OTPs they received on their phones.
This puzzle was resolved when the Pasha brothers pointed the investigators towards ‘otpbazar.online’, a website which, for a price, sold credentials to carry out transactions online in such a way that it could not be traced back. Once one registers on the website paying a fee, it will give you a random mobile number, which could be used for any transaction online. Within minutes, the website will give you the OTP sent to that mobile number, sources said, using which the brothers reportedly opened the accounts on the NVSP.
Through the money trail between the Pasha brothers and the website, the SIT also tracked down Bapi Adya, the man running the website from the Nadia district in West Bengal, and arrested him. However, how he was able to give OTPs to random mobile numbers the website selected still remains a mystery. His website is just an Indian franchise of a U.S.-based website called ‘sms-activate.io’. The SIT has not been able to reach the servers of this website. However, they are taking steps to take down ‘otpbazar.online’, given its larger repercussions enabling cyber crime.
Is the voter portal compromised?
The chargesheet in the case lists six loopholes of the NVSP that the accused misused to make forged Form 7s, some of which have been fixed now.
Any mobile number and the OTP sent to it could be used to create an account and set the password.
Subsequent logins needed only the password and no OTP. Any number of applications could be made from these accounts. No alert was sent to either the person in whose name the application was being made or whose name was sought to be deleted from or added to the list. Moreover, there was no fixed session time on the portal.
Days after the press conference by Mr. Gandhi in September, 2025, the EC introduced a new e-sign feature, which mandates that those who make any applications online for addition, deletion or correction verify their identity through their Aadhar-linked mobile number.
While this will enhance security, there is no clarity whether all six loopholes flagged by the SIT have been fixed.
