ChennaiFloodUndersight — oversight for Chennai's flood-forecasting system

The flood machine, opened.

Chennai's ₹107.2-crore flood-forecasting system (RTFF & SDSS) publishes 7 PDF bulletins as its entire public record. Its own GeoServer quietly serves 344 data layers — 1.7 million sensor readings, flood footprints from 2005 and 2015, vendor contracts — to anyone who asks. We mirrored it, published it, and now we audit it.

344GeoServer layers (343 readable, anonymous)

1.72Msensor readings mirrored

7bulletins ever issued (Oct 2025 run)

0data license, API docs, or forecast archive

The open-data release — 2026-09-29

Sensor transactions

1.72M rows

SRG rain (1976→2026), AWS/ARG rain+met, AWLR river levels + 33 station registries with AMC vendor-expiry fields. Parquet, PII-scrubbed.

GIS layer pack

181 layers

Wards, drainage network, waterways, tanks, bathymetry, forecast ensembles, crowdsourced reports (identities stripped). GeoParquet.

Flood history

2005 · 2015 · 2020

NRSC 2015 flood extent (4,001 polygons), IRS 2005, GCC hotspots, ward depth tables, flood warnings.

Bulletins

7 PDFs

Every operational bulletin of the Oct 2025 run — observed rainfall, ECMWF/NCEPGFS forecasts, lake & river levels, street inundation maps.

Companion rescue of the dead predecessor portal: chennai-rain-gauges — 34,050 GCC zone-gauge readings (2020–2023) incl. Cyclone Michaung's 639 mm/24h peak.

What the mirror shows

Finding	Evidence
16 of 38 dashboard rain stations stale on census day; Nungambakkam & Meenambakkam-ISRO frozen at 2025-05-10	station table, 2026-09-29
Ward-level "forecast" is a static scenario dated 2021-08-11	layer property inspection
Machine-readable ARG feed bulk-frozen at Jan 2022 while dashboard reads 2026 — two pipelines	per-year row counts
Alert feed: zero rows ever served; no public API or RSS	API pulls
GeoServer sends three stacked `Access-Control-Allow-Origin` headers (+ `allow-credentials:true`) — every third-party browser app gets "Failed to fetch"; only the same-origin dashboard works	response header dump, 2026-10-03
GetCapabilities declares wrong bounding boxes for 236/344 layers (Chennai data placed near lon 2.7) while GetFeature coordinates are correct — GIS clients trusting declared extents misplace ~69% of the catalogue	GetCapabilities XML vs GetFeature samples, 2026-10-03
₹107.2 cr spent; no sanction order, contract split, O&M budget, or forecast-vs-observed record published	press figures + absence

Finding

Evidence

16 of 38 dashboard rain stations stale on census day; Nungambakkam & Meenambakkam-ISRO frozen at 2025-05-10

station table, 2026-09-29

Ward-level "forecast" is a static scenario dated 2021-08-11

layer property inspection

Machine-readable ARG feed bulk-frozen at Jan 2022 while dashboard reads 2026 — two pipelines

per-year row counts

Alert feed: zero rows ever served; no public API or RSS

API pulls

GeoServer sends three stacked Access-Control-Allow-Origin headers (+ allow-credentials:true) — every third-party browser app gets "Failed to fetch"; only the same-origin dashboard works

response header dump, 2026-10-03

GetCapabilities declares wrong bounding boxes for 236/344 layers (Chennai data placed near lon 2.7) while GetFeature coordinates are correct — GIS clients trusting declared extents misplace ~69% of the catalogue

GetCapabilities XML vs GetFeature samples, 2026-10-03

₹107.2 cr spent; no sanction order, contract split, O&M budget, or forecast-vs-observed record published

press figures + absence

Documents

Data mirrored from a public government portal (chennaifloodmonitor.tn.gov.in). Facts aren't copyrightable; our arrangements are CC BY 4.0; attribution everywhere; notice-and-takedown honored. Not affiliated with TNSMART/TN-DSS/WRD. Security findings go to CERT-In, not the feed.