By Peter Emmanuel |
From email linkage tests to disputed timestamp claims, a detailed review of INEC’s findings shows where the evidence stands and where it falls short by Development News Network.
The issue began with a screenshot circulating on social media. It showed an X account bearing the name of Joash Amupitan engaging in political conversation. Within days, it spread widely, drawing public criticism and raising questions about the neutrality of the country’s electoral umpire, the Independent National Electoral Commission (INEC). The commission initially denied any link to the account before ordering a forensic investigation into the claim.
When INEC released its report on April 20, 2026, dismissing the account as fake, the intention was to bring closure to the controversy. But a closer reading of the findings shows that while the commission addressed some aspects of the allegation, several critical questions remain unresolved.
The development has now gone beyond a single viral post, raising broader concerns about how public institutions in Nigeria interpret and respond to digital evidence. It also echoes recurring challenges seen since the 2023 Nigerian general election, as well as similar misinformation-driven disputes during elections in Kenya in 2022 and Ghana in 2020, where screenshots, altered posts, and competing online narratives complicated official communication and public trust.
As the screenshots gained traction, the issue escalated from online debate into a reputational challenge for INEC. The commission initially denied any link to the account before commissioning a forensic investigation. On April 20, 2026, it released a four-page report outlining five key findings intended to discredit the claim.
However, a detailed examination of those findings reveals a pattern of conclusions that are, in several instances, either overstated or based on incomplete interpretation of digital evidence
Timestamp Interpretation and Platform Behaviour Under Editing Conditions
One of the central points in INEC’s report concerns a viral reply attributed to the account, which the commission describes as “technically impossible.”
“All the alleged posts, replies, or statements attributed to him on X (Twitter) are fraudulent, forensically unverifiable, technically impossible, and part of a coordinated disinformation,” the report stated.
According to INEC, the reply appeared to have been posted before the original tweet it responded to. On that basis, the commission concluded that the interaction could not have occurred and therefore did not exist. The report presents this as one of its strongest technical findings in dismissing the account’s activity.
However, the interpretation of this conclusion depends on how X structures and displays post interactions. The platform allows users to edit posts after publication, and when edits are made, the visible structure of a thread is updated to reflect the most recent version of the post.
In such cases, replies made to earlier versions of a post remain attached to the thread, but the timestamps displayed publicly correspond to the edited version of the post rather than the original one at the time of interaction. This can create a situation where a reply that was made in a correct sequence appears inconsistent when viewed against the updated post.
As a result, what appears to be a chronological mismatch may not necessarily reflect the original order in which the interaction occurred on the platform. Instead, it reflects how edited content is rendered in the current version of the thread.
The report by INEC does not provide a detailed breakdown of edit history logs, version-by-version reconstruction of the post, or technical evidence showing how the thread appeared before and after edits were made.
Internet Archive Findings and the Question of Digital Coverage
INEC further states that no archived records of the account were found on the Internet Archive’s Wayback Machine prior to April 2026.
The report presents this as supporting evidence that the account did not exist during the period under investigation.
However, the Wayback Machine does not provide complete coverage of all X accounts or posts. Its system depends on automated crawlers and publicly accessible snapshots. Many accounts, particularly those with limited visibility, restricted access, or low engagement, may not be archived.
The key findings of INEC states: “The wayback machine searches show zero records of @joashamupitan on X (Twitter) before April 2026.” Under the verdict, it was considered as corroborating evidence.
The report does not include crawl frequency data, archival coverage scope, or verification of whether the account was publicly accessible during relevant time periods when archival attempts would have been made.
The absence of archived data is recorded in the report, but no additional technical explanation is provided regarding the limitations of the archival process.
Account Renaming, Privacy Changes, and Parody Label Classification
Another key finding in INEC’s report is that the account was renamed, set to private, and labelled as a parody account on April 10, 2026.
The timing of these changes is noted as occurring shortly after the screenshots gained public attention.
“On April 10, 2026, the same day the screenshots went viral, @joashamupitan was renamed to @sundayvibe00, set to private, and labelled ‘Parody Account’,” the report states. “This is consistent with deliberate impersonation and damage-control.”
X allows users to change account usernames, modify privacy settings, and apply descriptive labels such as “parody” without requiring identity verification from the platform. These changes can be made by the account holder at any time.
The report does not provide attribution data identifying who carried out these changes. It also does not provide information on whether the account had undergone similar modifications prior to the controversy or whether control of the account changed over time.
As a result, the report documents changes in account configuration but does not establish the identity of the individual responsible for those modifications.
Cross-Platform Impersonation Patterns and Identity Misuse
INEC also identifies multiple accounts on Facebook and Instagram using Amupitan’s name and image.
These accounts are described as impersonation accounts operating across platforms. The report suggests that such activity reflects a broader pattern of identity misuse within the digital environment.
However, the report does not establish a technical connection between these accounts and the disputed X account. There is no cross-platform metadata analysis or attribution linking the accounts together as part of a coordinated network.
Each instance is presented separately within the report without unified forensic correlation across platforms.
Forensic Methodology and the Absence of Public Technical Detail
Although the report is presented as a forensic investigation, it does not include detailed technical appendices or raw forensic outputs.
There is no publication of metadata analysis results, no device-level tracking data, and no disclosure of direct platform-level verification from X.
The report also does not indicate whether external forensic experts independently reviewed the findings.
The report does not provide a detailed breakdown of how the timing of public circulation compared to the timeline of internal investigation steps or verification stages.
The conclusions are presented in summary form, but the underlying datasets, forensic tools used, and methodological steps are not disclosed in the publicly available document.
Findings and Areas Not Fully Addressed in the Report Released By INEC
INEC’s report states that the account is not currently linked to Amupitan’s verified credentials and identifies impersonation activity across multiple platforms.
“The forensic evidence is comprehensive, multi-sourced, and unambiguous,” the report stated. “The posts attributed to Prof. Amupitan on X are fabricated. The account is a clear case of impersonation, and the surrounding activity points to coordinated disinformation effort intended to manipulate public perception.”
However, the report does not establish whether:
the account was previously linked to any verified credentials at an earlier stage the viral reply existed in earlier versions of the post prior to editing or whether the historical activity associated with the account corresponds to the screenshots circulating online.
These areas are not conclusively addressed in the public version of the report.
Expert View
A digital governance and OSINT analyst, Akíntúndé Babátúndé, who serves as Executive Director of the Centre for Journalism Innovation and Development (CJID), has raised questions over aspects of INEC’s statement on the disputed X account linked to Prof. Joash Amupitan, noting that while impersonation of public officials remains a known issue in Nigeria’s digital space, several of the commission’s forensic conclusions require further technical clarification.
He stated that the commission’s reliance on the “impossible timestamp” explanation does not fully account for alternative technical possibilities such as device clock inconsistencies, timezone mismatches, post-edit behaviour on X, or metadata limitations, all of which typically require forensic reconstruction rather than visual inspection of screenshots alone. He added that conclusions framed as “beyond reasonable doubt” would normally require explicit elimination of such factors.
“A credible forensic report rules these out one by one. This statement does not mention them. Citing AI and deepfakes without any pixel, metadata, or compression analysis is not forensics,” Akíntúndé noted.
In the absence of archived records from the Internet Archive (Wayback Machine), he noted that this is common in OSINT investigations and does not, on its own, establish that an account never existed. According to him, archival absence is generally inconclusive unless supported by crawl logs or platform-level data.
He also questioned the interpretation of failed email and phone recovery attempts, explaining that such results reflect current account recovery configurations on X rather than historical ownership, since credentials can be changed or removed over time.
On the BVN and phone number reference in the statement, he observed that while the commission acknowledges the number linked in BVN records returns the name “Joash Ojo Amupitan,” the report does not clearly explain how this connects to the disputed X account, leaving gaps in the evidentiary chain.
He further noted the account’s renaming to “@sundayvibe00,” its switch to private, and the application of a parody label on the same day the screenshots circulated, adding that such changes require clearer attribution of account control to determine whether they reflect impersonation, defensive action, or routine management.
Babátúndé also said that the presence of similar impersonation accounts across platforms like Facebook and Instagram points to a broader pattern, but does not directly confirm or disprove the authenticity of the X account without technical correlation.
“The data breach evidence is dismissed selectively. The statement acknowledges breach datasets show Prof. Amupitan’s identity connected to a Twitter account alongside Apple, LinkedIn, and Office 365, then argues this does not prove ownership of this specific handle. Fine. But it never asks the more obvious question: if he had some Twitter account per these records, which one was it?,” he stated.
On claims of possible AI-generated or fabricated screenshots, he stated that such conclusions would normally require metadata, pixel-level, or compression analysis, none of which were publicly included in the statement.
He further states that while INEC rejects the authenticity of the account, several of its assertions rely on the interpretation of digital behaviour rather than fully disclosed forensic evidence, leaving parts of the matter open to further clarification.
A Report Built on Technical Findings and Unresolved Historical Questions
The forensic report issued by INEC presents findings based on account linkage checks, timestamp analysis, archive searches, and identification of impersonation activity across platforms.
While the report addresses the current technical status of the account, several aspects related to historical activity, platform behaviour under editing conditions, and attribution of account control are not fully detailed in the publicly available document.
The case, therefore, remains defined by a combination of verified technical observations and unresolved questions relating to historical digital activity and platform interpretation.
Share this
