Well, I'm pretty close to the source, so I thought I'd write about it.

Some time ago, the Liberal party of the province decided they'd use a high-tech voting system, fairly simple in structure. They would contract with the local telco, Maritime Tel and Tel, to use a phone/computerized phone system so that people could vote from the main leadership convention here in Halifax or from regional rallies (where they had banks of phones installed) or from home using their touch-tone phones.

The method:

• (1) Each candidate got a 1-900- number.
• (2) Each card-carrying Liberal would get a PIN and instructions.
• (3) Come convention day, each Liberal could dial the number for the candidate of his or her choice, the candidate's recorded voice would state for whom that vote was about to be cast, and request the Liberal to enter the PIN.
• (4) After entering it, a short message recorded by the candidate would thank the Liberal for his or her vote, and hang up.

Everything went wrong.

A chronology:

• 12:30 Voting begins. However, voters do not get the thank you after entering their PIN.
• 12:35 Confusion takes the throne, and reigns for the rest of the day. Some telco reps said that your vote was registered even if you didn't get a thank-you. Others said that the votes were being counted, don't worry.
• ~1:00 Voting is suspended while everyone works things out.
• 1:40 The electoral officer announces that all votes will be cancelled, and that voting will begin again at 2:30.
• 2:00 A kid with a scanner calls the Canadian Broadcasting Corporation to tell them that he has a recording of the Party's conversation with the telco via cellphone, giving the results so far. The CBC passes the report up their hierarchy, trying to decide if it's a faked report. The kid calls back thirty seconds later with the contents of their conversation with an Executive Producer, also by cellphone. The CBC decides to run the story.
• 2:30 Voting begins again. Callers are instructed that unless they get the thank-you message, their vote has not been counted. Some people get a thank-you on the first try, others try for 20 or 30 times. In a desperate move, the telco cuts down on the number of circuits into the system, to no avail. Voters now have busy signals as well as no acknowledgements to deal with; they report that the far end phone either sends the thank-you within a few seconds, or does nothing for about ten minutes before hanging up.
• 3:00 Voting is extended until 4:00. Many voters complain that their PIN is being rejected. Officials say to never mind, just try to vote again in this case.
• 4:00 Fewer than half the conventioneers have voted. Voting is extended until 5:00.
• 5:00 Voting is extended until 6:30.
• 5:30 Reports begin arriving that members have been able to vote twice.
• 6:30 The convention is called off.

Anyone with a programmable dialler could have voted for many, many Liberals if he knew the format of the PINs. Given the profoundly bad management we saw, I wouldn't be surprised to see them as six-digit numbers ranging from 100001 to 107290; there were 7289 registered voters. This prospect hasn't even been discussed yet in the local media.

There was no backup voting system for this, the inaugural use of the system. The telco convinced the Party there was no need for it -- the telco (the newspaper report says) reminded the Party that it handles hundreds of thousands of calls a day, and there was no possibility of the system failing.

Operationally, there was either a bug in the voting software, or it was incapable of handling the volume of traffic, causing it to fail to thank-you most of the time. And, of course, the kid with the scanner telling all just added icing to the cake.

It was not a great day for the telco, or for the Liberal Party. There hasn't been any discussion of responsibility, but there sure will be next week! The convention cost hundreds of thousands of dollars, and it was entirely a wasted effort.

Daniel MacKay, NOC Manager,
NSTN Operations Centre, Dalhousie University,
Halifax, Nova Scotia, Canada <daniel@nstn.ns.ca> 902-494-NSTN

[The METHODS paragraph above was lightly edited by PGN for clarity.]
[This case was also reported by Richard Taylor of AECB, Aidan Evans <AE@AC.DAL.CA>, and
<parnas@triose.eng.McMaster.CA> (Dave Parnas).]
[Another example of a case for public key encryption? PGN]

[ Risks Digest Volume 13, Issue 56, 9 June 1992]

[ICS comment: PIN is an acronym for Personal Identification Number. PINs are usually chosen at random by an independent authority, and throughout the process of selection and issuing the PINs special care is -- or should be -- exercised to minimize the possibility of leakage of PINs to other than the individual for whom each is destined. The random selection algorithm should be designed using care to avoid any pattern that could be used by anyone who has one PIN to calculate, or to guess with some chance of success, any other PIN for the particular event. The worst case scenario is when a group of PINs consists of a series of consecutive numbers; nearly as bad is when a list of PINs is selected by a simple mathematical method, such as consecutive multiples of 7, or of any other number. There is a considerable literature on how PINs can be selected to minimize the opportunity for someone with a few genuine PINs to be able to improve, beyond purely random chance, their ability to figure other PINs within the same event. It is by no means a simple matter. We have no information on what method MT&T used to generate the PINs for this vote-by-phone exercise. As far as I know (and I followed this story closely at the time) the method of PIN selection was never mentioned in the local media.]

[Richard included extracts from a Canadian Press article by Alan Jeffers in The Ottawa Citizen, Sunday, June 7, 1992, not included here, along with the following comment:]

Again on CBC Radio this morning: there is now talk about having to run the entire campaign over again since the candidates who were listed as faring badly in the cellular telephone message are protesting that this disadvantages them in a new polling. A second campaign would severely drain the resources of the party and would put them at a disadvantage in subsequent elections. RPT

Richard P. Taylor, Ottawa, Canada.

[ Risks Digest Volume 13, Issue 56, 9 June 1992]

This is a follow-up on the huge local vote-by-phone fiasco. In RISKS-13.56 I wrote about the vote-by-phone system contracted from the telco by the Liberal Party for their leadership convention, following Murphy's Law.

On June 8th, the telco held meetings with the Liberal Party, and with the media. As always, there's a little second guessing to do about what the press releases mean. Here's what they say:

• The system was composted of two software packages which had never been tested together at high call volume. "All I can say, is it never occurred to anybody in my staff, and it never occurred to me." said Colin Latham, the vice-president of business services for Maritime Tel and Tel.
• The first part of the system [presumably the touch-tone answering /selection system] was capable of handling 78,000 calls an hour.
• The second part of the system, "set up to receive the caller's 8-digit PIN" proved much slower. [I'd guess that this was the interface to the databases that kept track of votes and who had voted. -dm]

Also, the telco says when voting was restarted, "some rogue information stayed in the system, causing some voters to be rejected." [They didn't reset the who-had-voted list, perhaps? -dm]. On the day of the fiasco, the telco initially blamed the problem on a missing line of code in the software, but they say now that that was a mistake. The problem of people being able to vote twice hasn't been mentioned.

The telco says the Liberal Party won't be charged for the services rendered on Saturday. [Like the power utility burning down your house with a million volts by accident, and saying ``Don't worry, you won't be billed for the electricity.'' -dm]

150 telco employees were recruited to test the system, [compared to 8000 voters in the real system! -dm] on Thursday the 11th, and it apparently worked. The telco reduced the number of incoming lines to cut down on system load.

The Liberal Party has decided to have another go at the vote-by-telephone system in a few days, but there won't be another convention. The telco will be posting a 350,000$Cdn performance bond on the system, and there will be a paper-ballot backup system on hand.

Some candidates have asked the telco for partial reimbursements of their campaign costs on the basis that disclosure of the numbers (leaked via the kid with the scanner listening to the cellular conversations) have destroyed their chances of winning. The telco claims that the numbers leaked (numbers of calls recorded to each of the candidate's phone number) bear no relationship to the number of votes that had been collected or would have been collected.

Daniel MacKay, NOC Manager,
NSTN Operations Centre, Dalhousie University,
Halifax, Nova Scotia, Canada 902-494-NSTN daniel@nstn.ns.ca

[ Risks Digest Volume 13, Issue 58, 15 June 1992]

After an initial failure on June 6, the Liberal Party of Nova Scotia held a primary June 20 to elect its next leader: 94% of the 7416 delegates voted, all with touch-tone phones. Typical turnout for Canadian elections is 60-70%.

The Liberals were issued Personal Identification Numbers (PINs) by mail. For each of 2 ballots, voters called one of five 900 numbers corresponding to their choice of leader, and then keyed in their "PIN number". The computer then checked their number off so they couldn't vote again. John Savage won on the second ballot with almost 53% of the vote.

The service was provided by Maritime Telephone & Telegraph and cost each voter 50 cents. The eight-digit PIN numbers enabled one to vote from any billable touch-tone phone: if you didn't have touch- tone, you'd borrow your neighbour's. Absentee voting was as simple as picking up the phone, wherever you were.

With this success, the Canadian government is considering a national referendum by phone on the results of their Constitutional Convention, within 6 months.

The Federal Voter Assistance Program of the Pentagon is now considering voting by phone for servicemen, who had voting by fax from the Persian Gulf. But a $300 fax machine is overkill when a $10 touch-tone phone will do. The Program called the Voting by Phone Foundation of Boulder for their initial information.

The Voting by Phone Foundation is now in a petition drive to put a charter amendment on November's Boulder City ballot. If passed Boulder would become the first city in the U.S. to offer the option of phone voting. Please call [Evan at] (303)444-3596 to help.

The Foundation is holding a demonstration of voting by phone from now until the November 3rd election. Anyone may call (303)444-3596, 24 hours a day. If you are registered to vote in Boulder, you will be asked to enter your last name and birth date for identification. This limits you to one vote, although not as effectively as the random PIN number to be used for real elections. A different question will be asked every 2 weeks, and presidential [... rest lost in transmission (truncated by Evan's mailer?)]

[ Risks Digest Volume 13, Issue 63, 8 July 1992]

Return To Page: History Index
Return To Home Page

Latest revision: 1997 November 22