🚀 go-pugleaf

The _Colorado Daily_ has once again proved they will print anything
without bother to check the facts.

Evan Ravitz (from context) is quoted as saying:

   [Ravitz] points to a recent Canadian ELECTION when citizens
   SUCCESSFULLY voted by phone.  (Emphasis added).

In the first place, it was a Liberal party primary, not an government-
run election for public office.  A political party can organize their
elections in any manner they please, as evidenced by the fact that
Jerry Brown won the Colorado Democratic primary yet Bill Clinton will
have the majority of delegates to the convention!  BTW, the voting
was limited to Liberal party members; it was _not_ open to the general
public.

In the second place, the election was a complete fiasco as the 
attached quotes from comp.risk demonstrate.  If Mr Ravitz considers
this a _success_, God help us!


Bear Giles
bear@fsl.noaa.gov

source:  comp.risk archives 13.56, 13.58
--------------------------------------------------------------------------

Date: Sun, 7 Jun 92 13:38:09 ADT
From: daniel@nstn.ns.ca (Daniel MacKay)
Subject: Vote-by-telephone disaster in Nova Scotia

Well, I'm pretty close to the source, so I thought I'd write about it.

Some time ago, the Liberal party of the province decided they'd use a high-tech
voting system, fairly simple in structure.  They would contract with the local
telco, Martime Tel and Tel, to use a phone/computerized phone system so that
people could vote from the main leadership convention here in Halifax or from
regional rallies (where they had banks of phones installed) or from home using
their touchtone phones.

The method:
 1) Each candidate got a 1-900- number.
 2) Each card-carrying Liberal would get a PIN and instructions.
 3) Come convention day, each Liberal could dial the number for the candidate
    of his or her choice, the candidate's recorded voice would state for whom
    that vote was about to be cast, and request the Liberal to enter the PIN.
 4) After entering it, the candidate would thank the Liberal for his or her 
    vote, and hang up.  

Voting was supposed to begin at 12:30, and take 90 minutes for the first
round.  If necessary, several voting rounds could be cast during the day.

Everything went wrong.

A chronology:
12:30	Voting begins.  However, voters do not get the thank you after
	entering their PIN.
12:35	Confusion takes the throne, and reigns for the rest of the day.
	Some telco reps said that your vote was registered even if you
	didn't get a thank-you.  Others said that the votes were being 
	counted, don't worry.
~1:00	Voting is suspended while everyone works things out.
1:40	The electoral officer announces that all votes will be cancelled,
	and that voting will begin again at 2:30.
2:00	A kid with a scanner calls the Canadian Broadcasting Corporation
	to tell them that he has a recording of the Party's conversation
	with the telco via celphone, giving the results so far.  The CBC
	passes the report up their hierarchy, trying to decide if it's a
	faked report.  The kid calls back thirty seconds later with the
	contents of *their* conversation with an Executive Producer, also 
	by celphone.  The CBC decides to run the story.
2:30	Voting begins again.  Callers are instructed that unless they
	get the thank-you message, their vote has not been counted.  Some
	people get a thank-you on the first try, others try for 20 or 30
	times.  In a desperate move, the telco cuts down on the number of
	circuits into the system, to no avail.  Voters now have busy
	signals as well as no acknowledgements to deal with; they report
	that the far end phone either sends the thank-you within a few
	seconds, or does nothing for about ten minutes before hanging up.
3:00	Voting is extended until 4:00.  Many voters complain that their
	PIN is being rejected.  Officials say to never mind, just try to
	vote again in this case.
4:00	Less than half the conventioneers have voted.  Voting is extended
	until 5:00.
5:00	Voting is extended until 6:30.
5:30	Reports begin arriving that members have been able to vote twice.
6:30	The convention is called off.

What went wrong?  System-design-wise?  Considering the PIN as a password --
each member knew only his -- there was no UID (member number) to PIN matching.
So anyone who knew your PIN could vote on your behalf.  So the problems of a)
PINs being rejected, and b) voting twice could easily be explained as people
making finger errors.  If you made a mistake with your PIN, either you got
someone else's number and voted for them, or you got rejected -- no way to
tell.  If you later went back and used your correct PIN after having used
someone else's, why, that would look a lot like being able to vote twice.
Users couldn't, of course, change their PINs.

Anyone with a programmable dialler could have voted for many, many Liberals if
he knew the format of the PINs.  Given the profoundly bad management we saw, I
wouldn't be surprised to see them as six-digit numbers ranging from 100001 to
107290; there were 7289 registered voters.  This prospect hasn't even been
discussed yet in the local media.

There was no backup voting system for this, the inaugural use of the system.
The telco convinced the Party there was no need for it -- the telco (the
newspaper report says) reminded the Party that it handles hundreds of thousands
a call a day, and there was no possibility of the system failing.

Operationally, there was either a bug in the voting software, or it was
incapable of handling the volume of traffic, causing it to fail to thank-you
most of the time.  And, of course, the kid with the scanner telling all just
added icing to the cake.

It was not a great day for the telco, or for the Liberal Party.  There hasn't
been any discussion of responsibility, but there sure will be next week!  The
convention cost hundreds of thousands of dollars, and it was *entirely* a
wasted effort.

Daniel MacKay, NOC Manager, NSTN Operations Centre, Dalhousie University,
Halifax, Nova Scotia, Canada     daniel@nstn.ns.ca  	902-494-NSTN
 
   [The METHODS paragraph above was lightly edited by PGN for clarity.]
   [This case was also reported by Richard Taylor of AECB, Aidan Evans
      <AE@AC.DAL.CA>, and parnas@triose.eng.McMaster.CA (Dave Parnas).]
   [Another example of a case for public key encryption?  PGN]

------------------------------

Date: Mon Jun  8 13:46:17 -0800 1992
From: atomcon/I=R/S=TAYLOR/O=AECB.CCEA@mhs.attmail.com
Subject: Phone-in Voting in Nova Scotia

   [WARNING: ATTMAIL may reject this address.  It has been doing so for weeks
   for all RISKS mailings.  Richard included extracts from a Canadian Press 
   article by Alan Jeffers in The Ottawa Citizen, Sunday, June 7, 1992, not 
   included here, along with the following comment:]

Again on CBC Radio this morning: there is now talk about having to run the
entire campaign over again since the candidates who were listed as faring badly
in the cellular telephone message are protesting that this disadvantages them
in a new polling. A second campaign would severely drain the resources of the
party and would put them at a disadvatage in subsequent elections.  RPT

Richard P. Taylor, Ottawa, Canada.

------------------------------

Date: Mon, 15 Jun 92 10:27:45 ADT
From: daniel@nstn.ns.ca (Daniel MacKay)
Subject: Update on vote-by-telephone disaster in Nova Scotia (RISKS-13.56)

This is a follow-up on the huge local vote-by-phone fiasco.  In RISKS-13.56 I
wrote about the vote-by-phone system contracted from the telco by the Liberal
Party for their leadership convention, following Murphy's Law.

On June 8th, the telco held meetings with the Liberal Party, and with the
media.  As always, there's a little second guessing to do about what the
press releases mean.  Here's what they *say*:

 - The system was composted of two software packages which had never
   been tested together at high call volume.  ``All I can say, is it never
   occurred to anybody in my staff, and it never occurred to me.'' said
   Colin Lantham, the vice-president of business services for Maritime Tel
   and Tel.

 - The first part of the system [presumably the touchtone answering
   /selection system] was capable of handling 78,000 calls an hour.

 - The second part of the system, "set up to receive the caller's 8-digit
   PIN" proved much slower.  [I'd guess that this was the interface to
   the databases that kept track of votes and who had voted. -dm]

The *first* part of the system had a dead-session detection function, to keep
people from tying up phone lines.  However, when the second part of the system
started to slow down [transactions queued up?  -dm] the first module hung up
before the second part issued an acknowledgement.

Also, the telco says when voting was restarted, ``some rogue information stayed
in the system, causing some voters to be rejected.'' [They didn't reset the
who-had-voted list, perhaps?  -dm].  On the day of the fiasco, the telco
initially blamed the problem on a missing line of code in the software, but
they say now that that was a mistake.  The problem of people being able to vote
twice hasn't been mentioned.

The telco says the Liberal Party won't be charged for the services rendered on
Saturday.  [Like the power utility burning down your house with a million volts
by accident, and saying ``Don't worry, you won't be billed for the
electricity.'' -dm]

150 telco employees were recruited to test the system, [compared to 8000 voters
in the real system!  -dm] on Thursday the 11th, and it apparently worked.  The
telco reduced the number of incoming lines to cut down on system load.

The Liberal Party has decided to have another go at the vote-by-telephone
system in a few days, but there won't be another convention.  The telco will be
posting a 350,000$Cdn performance bond on the system, and there will be a
paper-ballot backup system on hand.

Sme candidates have asked the telco for partial reimbursements of their campain
costs on the basis that disclosure of the numbers (leaked via the kid with the
scanner listening to the cellular conversations) have destroyed their chances
of winning.  The telco claims that the numbers leaked (numbers of calls
recorded to each of the candidate's phone number) bear no relationship to the
number of votes that had been collected or would have been collected.

Daniel MacKay, NOC Manager, NSTN Operations Centre, Dalhousie University,
Halifax, Nova Scotia, Canada 902-494-NSTN               daniel@nstn.ns.ca