The Timeline: Six Systems, One Pattern
WAYBACK MACHINE CDX + CACHED PAGES
OWL queried the Internet Archive's Wayback Machine for every URL ever cached under elections.am and all its subdomains. The result was 19,654 unique entries spanning from 2000 to 2025. Across that archive, we identified six distinct web systems that exposed voter personal data to the public internet -- each one built, deployed, and eventually abandoned or restricted, only to be replaced by another system that repeated the same pattern.
System 1: voters.elections.am (2003-2004)
The CEC operated a dedicated subdomain at voters.elections.am with a PHP application that let anyone search voters by region. The homepage presented a clickable map of Armenia's 11 marzes (provinces). Each marz link led to a search form at marz.php?db=N with input fields for:
- azganun (surname / family name)
- anun (first name)
- hajranun (patronymic / father's name)
A separate Yerevan-specific page at yerevan.php added a district dropdown. The system returned matching voter records. First cached by the Wayback Machine on September 19, 2004.
System 2: 2003.elections.am (2003)
For the 2003 presidential election, the CEC published complete voter data organized by marz and TEC (Territorial Election Commission). URL pattern: 2003.elections.am/?marz=N&tec=N&go=voters. Yerevan alone (marz=14) had over 30 TECs numbered 57 through 93+, each with its own voter list page. The cached pages from March-November 2003 confirm the system was live throughout the entire election cycle.
System 3: votersreg (2007-2018)
From at least 2012 through 2018, www.elections.am/votersreg/ operated a voter registration lookup. OWL's analysis of the cached ASP.NET page (Wayback timestamp: 20120327025215) detected personal data fields including: birth date, phone number, name, district, and street. The system was publicly indexed -- the CEC's own meta tags set <meta name="robots" content="all"> and <meta name="googlebot" content="index,follow">, explicitly inviting search engines to crawl and index the voter registration pages.
System 4: ElectionService.asmx -- the API (2017)
This is the most technically concerning finding. On April 3, 2017, the Wayback Machine cached www.elections.am/ElectionService.asmx -- a Microsoft ASP.NET SOAP web service with two public methods:
GetVoterByAddressHtml-- returns voter records matching a given addressGetVoterYByAddressHtml-- a variant of the same lookup
The cached WSDL page shows a standard ASP.NET auto-generated interface with a test form: an address input field and an "Invoke" button. No login. No authentication token. No rate limiting. Anyone with an HTTP client could have queried the service for voter records at any address in Armenia. This is not a hypothetical vulnerability -- it is a fully functional, publicly documented API endpoint that the CEC deployed and the Wayback Machine preserved.
System 5: search.elections.am -- Passport Search (2017)
A separate subdomain at search.elections.am contained a search interface with a passport number input field. Only 10 Wayback captures exist for this subdomain, suggesting it was either short-lived or quickly restricted once someone noticed. The cached page confirms that the CEC built and deployed a system capable of looking up citizens by their passport ID -- on the public internet.
System 6: Register / YerevanRegister (2021-2025)
The most recent system, at www.elections.am/Register and www.elections.am/YerevanRegister, exposed voter data fields including: birth date, full address (district, street, apartment number), and name. The system uses modern APIs: GetRegisterRegions returns a list of Armenian regions for a dropdown, GetRegisterCommunitiesByRegion returns communities within each region. Wayback cached the page as recently as March 2025 with the "PageFor/Voter Lists" feature still active. This system was running under the Pashinyan government.
The Infrastructure Behind It
DNS + CERTIFICATE TRANSPARENCY
OWL's passive reconnaissance -- combining Wayback CDX data with certificate transparency logs from crt.sh and DNS-over-HTTPS lookups -- identified 33 subdomains under elections.am, all hosted on three IP addresses in the 130.193.27.0/24 range. The CEC runs its own DNS servers (ns1.elections.am, ns2.elections.am) and its own mail server (mx1.elections.am). A Microsoft 365 verification TXT record suggests integration with cloud services.
| SUBDOMAIN | PURPOSE | WAYBACK URLS |
|---|---|---|
| voters.elections.am | Voter lookup by name | 14 |
| search.elections.am | Passport number search | 10 |
| lists.elections.am | Voter/candidate list management | 111 |
| e-lists.elections.am | Electronic voter lists | 19 |
| vad.elections.am | Voter Authentication Device mgmt | 10 |
| res.elections.am | File server (PDFs, Excel, docs) | 8,224 |
| 2003.elections.am | 2003 election archive with voter data | 859 |
| stream.elections.am | CEC session video recordings | 102 |
| dashboards.elections.am | Election analytics dashboards | 49 |
| elearning.elections.am | Commission e-learning platform | 467 |
| initiative.elections.am | Citizen petition platform | 565 |
| accreditation.elections.am | Observer/media accreditation | 20 |
| prelive.elections.am | Pre-production/staging (!!) | 274 |
The presence of prelive.elections.am (a staging/pre-production environment) with 274 Wayback-cached URLs means the CEC's test environment was publicly accessible and indexed by the Internet Archive. Staging environments frequently contain test data derived from production -- meaning real voter records may have been exposed through the test system as well.
They Tried to Hide It
LIVE SERVER RESPONSE
As of this investigation, res.elections.am -- the file server that hosted 8,224 URLs including voter list PDFs, election result spreadsheets, and audit documents -- now returns 403 Forbidden with an Armenian-language error page that includes <meta name="robots" content="noindex, nofollow">. The CEC became aware of the exposure and took the server offline.
But the Wayback Machine had already archived everything. The 19,654 URLs in OWL's dataset were cached between 2000 and 2025. Blocking access now does not remove the historical record. The voter data that was publicly accessible for two decades is preserved in the Internet Archive's servers, which are outside Armenian jurisdiction.
What Data Was Exposed
| DATA FIELD | WHICH SYSTEMS | YEARS |
|---|---|---|
| Full name (first + last + patronymic) | voters.elections.am, 2003.elections.am, votersreg, Register | 2003-2025 |
| Home address (district, street, apartment) | votersreg, ElectionService.asmx, Register, YerevanRegister | 2012-2025 |
| Birth date | votersreg, Register, YerevanRegister | 2012-2025 |
| Phone number | votersreg, cucak | 2012-2017 |
| Passport number (as search input) | search.elections.am | ~2017 |
| Voter registration district + precinct | All 6 systems | 2003-2025 |
The Voter Statistics Files
DOWNLOADED FROM WAYBACK MACHINE
OWL downloaded 30 Excel files from the Wayback cache of res.elections.am/images/doc/. Among them are voter count spreadsheets for every election from 2013 to 2021:
| FILE | ELECTION DATE | SIZE |
|---|---|---|
| e_voters18.02.13.xls | February 18, 2013 | 62 KB |
| e_voters06.12.15.xlsx | December 6, 2015 | 24 KB |
| e_voters02.04.17.xlsx | April 2, 2017 | 51 KB |
| e_voters09.12.18.xlsx | December 9, 2018 | 56 KB |
| e_voters05.04.20.xlsx | April 5, 2020 | 53 KB |
| e_voters20.06.21.xlsx | June 20, 2021 | 39 KB |
These files contain voter counts broken down by region and precinct. They are not individual voter records, but they are the statistical aggregates from which turnout and irregularity analyses are built. Combined with the voter list PDFs at res.elections.am/images/listsc/ (organized by TEC, with files like tec1_0001.pdf through tec1_0045.pdf), the complete election data infrastructure was publicly downloadable.
Why This Matters Before June 7
Armenia holds parliamentary elections on June 7, 2026. The same Central Election Commission that exposed voter data through six different systems over 20 years is running those elections. The sameelections.aminfrastructure -- on the same three IP addresses in the130.193.27.0/24range, with the same self-hosted DNS and mail servers -- will process voter registration, authenticate voters at polling stations (via the VAD system atvad.elections.am), and publish results.
The pattern documented here is not a single incident. It is a structural failure: the CEC builds voter data systems, deploys them to the public internet with no access control, keeps them running for years, and only restricts access after the data has been archived by third parties. The fact thatres.elections.amnow returns 403 Forbidden is not a fix -- it is an acknowledgment that the exposure happened. The question for June 7 is whether the current voter authentication and result-publishing systems have the same design flaw, and whether anyone is checking.
How We Found This
OWL queried the Wayback Machine CDX API (web.archive.org/cdx/search/cdx?url=elections.am/*&matchType=domain) for every URL ever cached under the elections.am domain. The result was 19,654 entries. We then fetched 21 key cached pages via Wayback replay to confirm the presence of personal data input fields. We queried crt.sh for SSL certificate transparency logs and performed DNS lookups via Cloudflare's DNS-over-HTTPS service. All traffic was routed through Tor. No live elections.am server was probed, scanned, or tested -- every finding in this article comes from publicly archived content on the Wayback Machine and public DNS/certificate records.
Election Data Files -- Free to Download
30 FILES RECOVERED FROM WAYBACK CACHE
DOWNLOADABLE DOCUMENTS
EVIDENCE FILES
All documents below have had metadata stripped (exiftool + mat2 + custom OLE scrubber). Files are mirrored from OWL and preserved independently on archive.org.
- Voter Counts 2012
Number of registered voters by region -- 2012 election - Voter Counts Feb 2013
Voter counts by region -- February 18 2013 election - Voter Counts Dec 2015
Voter counts -- December 6 2015 election - Voter Counts Apr 2017
Voter counts -- April 2 2017 parliamentary election - Voter Counts Dec 2018
Voter counts -- December 9 2018 snap election (Pashinyan) - Voter Counts Apr 2020
Voter counts -- April 5 2020 - Voter Counts Jun 2021
Voter counts -- June 20 2021 snap election (Pashinyan re-election) - Election Results 2012
Full election results by marz -- May 6 2012 parliamentary - Election Results Feb 2013
Full results -- February 18 2013 presidential - Election Results Apr 2017
Full results -- April 2 2017 parliamentary (1.0 MB) - Election Results Dec 2018
Full results -- December 9 2018 snap election (1.1 MB) - Audit Statement 2012 Municipal
Financial audit statement -- May 6 2012 municipal elections - Audit Statement 2012 Presidential
Financial audit statement -- 2012 presidential runoff - Voter Counts 2012
Number of registered voters by region -- 2012 election - Voter Counts Feb 2013
Voter counts by region -- February 18 2013 election - Voter Counts Dec 2015
Voter counts -- December 6 2015 election - Voter Counts Apr 2017
Voter counts -- April 2 2017 parliamentary election - Voter Counts Dec 2018
Voter counts -- December 9 2018 snap election (Pashinyan) - Voter Counts Apr 2020
Voter counts -- April 5 2020 - Voter Counts Jun 2021
Voter counts -- June 20 2021 snap election (Pashinyan re-election) - Election Results 2012
Full election results by marz -- May 6 2012 parliamentary - Election Results Feb 2013
Full results -- February 18 2013 presidential - Election Results Apr 2017
Full results -- April 2 2017 parliamentary (1.0 MB) - Election Results Dec 2018
Full results -- December 9 2018 snap election (1.1 MB) - Audit Statement 2012 Municipal
Financial audit statement -- May 6 2012 municipal elections - Audit Statement 2012 Presidential
Financial audit statement -- 2012 presidential runoff
Sources: Wayback Machine CDX API query for elections.am/* (19,654 entries). Certificate transparency via crt.sh (33 subdomains). DNS via Cloudflare DoH. 21 cached pages fetched via Wayback replay. 30 Excel/XLS files downloaded from Wayback cache of res.elections.am. All data from publicly accessible archives. No live server was probed or scanned. OWL does not publish individual voter records -- this article documents the systems that exposed them, not the data itself.