We audited the web security of 8 transactional digital platforms of the Ecuadorian State using Mozilla HTTP Observatory, a free, public tool that evaluates 10 web security controls and assigns a score from 0 to 100. These are not informational portals: they are the systems where citizens enter their national ID numbers, register bank accounts, consult tax records, and manage their digital identity. The result is the most critical across the entire series: an average of 25.0 out of 100, 4 out of 8 platforms with an F rating, and none achieving Tier A or B.
This is not a minor technical issue. The evaluated platforms aggregate the population's most sensitive data: identity, socioeconomic status, tax history, registered voting addresses, and social security records. With the Organic Law on Personal Data Protection (LOPDP) fully in force and the Superintendence of Personal Data Protection (SPDP) actively conducting audits, each finding represents, potentially, a documentable regulatory non-compliance[cite: 1].
The Data That Matters
- 0 out of 8 platforms achieves even Tier B in web security.
- 100% fail Content Security Policy (CSP), the control that prevents malicious scripts from executing in the citizen's browser when visiting a State portal.
- DATA593 and the ANT portal receive 0/100, the lowest possible score. DATA593, launched on September 1, 2026, centralizes data from more than 10 public institutions and debuts with the worst technical score of the entire series.
- Both CNE platforms (main portal and polling place query) score 10/100 each. The voter roll of ~13 million citizens operates behind this infrastructure.
- GOB.EC, the single gateway to 2,500 public procedures, serves its login page with the header Cache-Control: max-age=600, public, allowing authentication responses to be cached by intermediary proxies.
- Quipux, the State-wide document management system in place since 2008, exposes its exact version (6.5.7) in the login footer.
What Technology Does Each State Platform Use?
In addition to the score, we identified the server or technology stack exposed by each platform. In several cases, the visible technology alone reveals years of accumulated technical debt.
- The ANT portal uses Java Server Pages (.jsp) with charset ISO-8859-1, an early-2000s technology, to serve driver's license and vehicle registration lookups for all motorists nationwide.
- The top-scoring platforms (SRI and Quipux) barely reach 50/100: the State's strongest technical posture amounts to a bare pass.
Why DATA593 Represents the Most Critical Finding
DATA593 is the most significant platform examined in this analysis. Launched on September 1, 2026, by the Ministry of Infrastructure and Technology, it centralizes records from more than 10 public bodies into a unified ecosystem: national ID, driver's licenses, university degrees, social security records, voter registration, and more. With only 14 days in production at the time of the scan, it scored 0 out of 100.
The State's Newest Platform Debuts with the Weakest Security Posture
The failures occur across multiple vectors simultaneously: no Content Security Policy (exposure to script injection), no HSTS (absence of HTTPS enforcement), cookies missing Secure / HttpOnly / SameSite attributes (a -40 point penalty, the highest within the Observatory), and no X-Frame-Options (exposure to clickjacking). Furthermore, the server reveals its exact version: nginx/1.30.3.
Why Quipux Represents a Systemic Risk
Quipux is not an outward-facing citizen portal: it is the administrative documentary backbone of the Ecuadorian State. Memorandums, official letters, resolutions, and inter-ministerial contracts have traversed this system since 2008, and its login interface uses citizen ID numbers as the access credential.
18 Years of Technical Debt with Version Exposure in the Footer
The login footer states "Version 6.5.7 · 2008–2026". Disclosing the precise release allows malicious actors to target known vulnerabilities tied to that version. A legacy PHP stack, a path revealing login.php, and no visible multi-factor authentication mean that a single compromised credential grants access to official governmental correspondence.
The Regulatory Context: Exposure Under the LOPDP
These platforms handle citizen identity records, socioeconomic profiles, tax information, voter registration, and social security memberships — precisely the categories of information protected with the highest scrutiny under the LOPDP[cite: 1].
Three statutory articles connect directly to our findings[cite: 1]:
Special Categories of Data
The LOPDP grants heightened protection to data revealing socioeconomic status, health, and union or institutional affiliations. IESS and DATA593 centralize these exact categories: a score of 0/100 across these systems is not merely a technical defect, but a potential breach of the statute's most stringent article.
Security of Personal Data
Demands technical measures commensurate with operational risk and aligned with the state of the art[cite: 1]. CSP, HSTS, and proper cookie flags are free, universal web standards established over a decade ago; their complete absence across 100% of these platforms is difficult to justify during an SPDP audit.
Data Protection by Design and by Default
Requires that security controls be embedded into systems from inception[cite: 1]. DATA593 illustrates the opposite: a platform designed in 2026 to consolidate national citizen identities that debuts with a 0/100 grade during its opening weeks of public operation.
Legal Precedent: Sanction Against LigaPro
This exposure is no longer theoretical. In January 2026, the SPDP sanctioned the Liga Profesional de Fútbol del Ecuador (LIGAPRO) with a fine of USD 95,502.63 for failing to implement data protection by design in its Fan ID application. Public entities are not exempt: an incident in DATA593, the IESS, or the CNE voter roll could trigger concurrent proceedings from the SPDP, the State Comptroller General's Office (Contraloría General del Estado), and other oversight authorities.
The Good News
The initial phase of technical remediation —enforcing CSP, HSTS, X-Frame-Options, and setting proper cookie flags— carries zero software licensing costs and can be completed in under 30 days per platform by in-house IT staff. It represents the fastest way to minimize the attack surface while generating verifiable compliance evidence ahead of any inquiry from the SPDP or Contraloría.
What to Do Now?
- Centralized HTTP header policy: The Ministry of Infrastructure and Technology must define an enforceable minimum baseline (CSP, HSTS, X-Frame-Options, and secure cookies) as a deployment prerequisite rather than an optional enhancement.
- Immediate security audit of DATA593 prior to scaling its user base further.
- Stack modernization for Quipux: Strip version disclosures from the footer, enforce multi-factor authentication, and initiate an upgrade path away from legacy PHP components.
- Appoint Data Protection Officers (DPOs) within each public body, accompanied by documented and testable incident response workflows.
This sectoral study was conducted by Urbadigital, utilizing the auditing engine of WebPerformance Report (webperformancereport.com) to gather and verify the web security telemetry of the 8 transactional state platforms evaluated.
We invite you to participate in this initiative: sign up here to subscribe to the weekly report and receive public-sector vulnerability assessments across Ecuador.
