There is a distinct kind of digital trust that citizens extend without a second thought: when you look up a court case, book a medical appointment at a public hospital, or file a complaint through a State portal, you assume the platform on the other side is configured to safeguard what you send. This week, we put that assumption to the test.
On September 20, 2026, we ran Mozilla HTTP Observatory scans across five digital services of the Ecuadorian State — portals where citizens directly interact with the justice system, public healthcare services, and government contact channels. The results follow below.
The Results
Five services scanned on the same date. The highest score was 70. The lowest, 0.
| Service | URL | Grade | Score | Failed / Passed | Citizen Data Processed |
|---|---|---|---|---|---|
| Attorney General's Office (Fiscalía) — Case Inquiry | fiscalia.gob.ec | F | 10 | 5 / 5 | 🔐 Judicial records |
| Contacto Ciudadano | contactociudadano.gob.ec | F | 0 | 4 / 6 | 🔐 Complaints and requests |
| IESS — Medical Appointment System | app.iess.gob.ec | F | 20 | 4 / 6 | 🔐 Health data |
| ARCSA — Sanitary Regulation Apps | aplicaciones.controlsanitario.gob.ec | D | 35 | 4 / 6 | Sanitary registrations |
| Ministry of Public Health (MSP) | salud.gob.ec | B | 70 | 2 / 8 | Public health information |
Three out of the five services received an F grade. The group average is 27 out of 100 — the exact same score we recorded two weeks ago when scanning 17 municipal portals across Ecuador. Two distinct sectors, the exact same number.
What Failed — and Why It Matters
HTTP Observatory audits eight header categories. These were the most consistent points of failure across all five services:
The 100% failure rate for CSP across all tested services is not a coincidence — it is a structural pattern. We saw it across municipalities. We see it again here. It reflects default configurations that are simply not being enforced at the web server or reverse proxy layer across vast parts of Ecuador's public digital infrastructure.
A Detail That Should Not Be Public
X-Powered-By: PHP/8.1.32 in its HTTP response. The institutional portal of the MSP returns PHP/8.4.4. Disclosing exact runtime versions in production headers presents a fingerprinting risk: it gives any attacker scanning for known CVEs a precise starting point. Suppressing it requires a single line of server configuration.
Three Services, Three Categories of Sensitive Data
What sets this cohort apart from a generic government site audit is the nature of the data traversing these platforms.
The Fiscalía's case lookup portal (Consulta de Noticias del Delito) processes records directly tied to individuals' legal status. The IESS appointment system processes personal health data. Contacto Ciudadano handles citizen complaints — which frequently contain identifying details, personal statements, and sensitive narratives.
Under Ecuador's Organic Law on Personal Data Protection (LOPDP), this is not incidental. It meets the formal statutory definition of sensitive data.
Art. 6 — Special Categories of Sensitive Data
Health data, genetic information, judicial and criminal records, and data relating to an individual's legal standing are classified as sensitive. Their processing demands reinforced technical and organizational safeguards.
Art. 37 — Data Security Obligations
Data controllers must implement technical safeguards that ensure the confidentiality, integrity, and availability of personal data[cite: 1]. A missing HSTS header, cookies sent without the Secure flag, and the total lack of CSP are concrete technical deficiencies directly pertinent to this legal duty.
The LOPDP applies to public entities without exception. The Superintendence of Personal Data Protection has been active since 2023 and has initiated enforcement actions — including regulatory sanctions in 2025 against LigaPro (~$250K) and the Ecuadorian Football Federation (~$200K). Ecuador maintains some of the highest statutory penalties in the region for non-compliance: up to 2% of annual turnover for severe infractions.
We do not state that these portals have experienced a breach or that data has been leaked. What these scan findings establish is that their present configuration fails to meet the technical baseline mandated by the LOPDP for the classifications of data they process[cite: 1]. The law does not wait for an incident to occur before imposing duties — it mandates preventive security controls in advance.
Why the MSP Portal Earns a B While Others Score F
The institutional portal of the MSP (salud.gob.ec) passes eight of ten Observatory checks, earning a Grade B with 70 points. The IESS appointment system and the Fiscalía case lookup fail between four and five checks, earning an F.
The difference between a B and an F in HTTP Observatory is rarely a matter of budget. It is almost always a matter of configuration.
The MSP portal runs on nginx with a deployment that enables multiple defensive headers by default. The two checks it fails — CSP and SRI — are widespread gaps, but the architectural baseline is solid. Portals receiving an F lack core fundamental headers that can be added directly at the web server or reverse proxy level without touching a single line of application source code.
This mirrors the findings we reported on the Municipality of Quevedo two weeks ago. Quevedo was the sole municipal portal to achieve a passing grade — not because of superior custom infrastructure, but because it routes traffic through Cloudflare, which injects protective headers by default. The MSP attains a comparable outcome through deliberate nginx hardening. The pattern indicates that the gap is not capital investment in technology — it is configuration hygiene.
Methodology
observatory.mozilla.org.
This report is the third release in UrbaDigital's September 2026 series. Earlier editions covered 17 municipal GAD portals (September 8) and 20 public university domains (September 15). A consolidated cross-sector report will be published on September 29.
Is Your Portal Configured This Way Too?
We run HTTP Observatory and benchmark your technical posture against the technical requirements of the LOPDP. You receive an actionable findings briefing and a prioritized remediation roadmap — at no cost.
Request an Evaluation
