52

Over the last few days, I've been hearing often about the petition to (pratically) "repeat" the Brexit referendum and I noticed that it is an online petition.

I noticed that the "sign petition" form just requires name, email address, and postcode, and then you'll receive an email to confirm your signature.

Is this system secure? Can't someone just create a bot that will fill the form continuously (and confirm the email) using a different address each time? Looking at the privacy page, it also appears that it doesn't even have a captcha system, and the email verification is the only "system" to prevent bots.

Last but not least it doesn't have a system to ensure that the signer is British.

12
  • 10
    On a side note, this is not a petition system just for a second Brexit vote. It is a system used for any question Brittish citizens want to raise in parliament.
    – Anders
    Jun 27, 2016 at 8:02
  • 1
    Breitbart (take with a pinch of salt though still plausable) linked to a pastebin script that used python mechanize and automatically created throwaway email accounts and signed the petition with them. It has various screenshots of people on twitter encouraging its use / giving out postcodes. Unfortunately the script has now been removed but it was mirrored at archive.is/pzULl
    – Stu W
    Jun 27, 2016 at 13:10
  • 1
    Security isn't yes-or-no, and the answer depends on what threats you consider in-scope, so it'd be more helpful if you stated your threat model. See our help center: "Security is a very contextual topic: threats that are deemed important in your environment may be inconsequential in somebody else's, and vice versa. [...] To get the most helpful answers you should tell us: [...] * who uses the asset you're trying to protect, and who you think might want to abuse it (and why) * what steps you've already taken to protect that asset * what risks you think you still need to mitigate".
    – D.W.
    Jun 27, 2016 at 21:11
  • 1
    Matt and PyRulez - a discussion on the pros and cons of paper vs electronic voting can happen on Information Security Chat - not here in comments.
    – Rory Alsop
    Jun 28, 2016 at 16:20
  • 2
    Given that some 30,000 votes came from IP addresses associated with the Vatican City (Pop. 800), I'm gonna offer a cautious "no".
    – Richard
    Jun 29, 2016 at 11:51

9 Answers 9

77

The petitions site is purely a mechanism to see whether there may be high enough numbers to support something, and if so, that something will be discussed in Parliament.

There are some checks and balances (for example 80,000 fake votes were identified and removed) but there is no need for a strong level of trust here, as nothing is decided by any of these petitions.

For the re-doing of the European Exit referendum, there are around 4 million signatories, and even with some level of fraud, the government already knows that it is something they need to discuss.

In summary - can it be trusted to the level required for this purpose? almost certainly. Can it be trusted to have no fraud? No.

1
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Jun 28, 2016 at 7:16
20

General comments

Can you be 100% sure that every signature is from a real person? No. Can you take some precautions to make it harder to cheat? Yes.

Here are some things that the British government could do (no idea if they actually do it):

  • Require a successful CAPTCHA after X attempts from the same IP.
  • Rate limit by IP. Sure, five persons in the same household might want to sign up, or 10 persons on the same company network after they had a chat about it at lunch. But if you get 100 signatures in a steady pattern you can be fairly sure someone is trying to inflate the numbers.
  • Do geolocation of the IP and correlate with the entered post code. Most people would do this from home without a VPN or proxy. If you get 90% of the signatures matching, you can be fairly safe most of them are legit.
  • Look for pattern in the data. If there is a strange spike in signup during two hours, and those signups have different characteristics than others, it might be because someone rented a botnet during that time period.
  • When the petition reaches a limit, pick a random selection of signers and try to verify them. This could be done e.g. by emailing them and asking them to call from a UK phone number listed on the name they used in the petition. This would give you an upper limit estimate on how large percentage of the signatures are fake.

Could a smart attacker with a botnet overcome these things? Possibly, but it does raise the bar.

Case study

Stu-W linked to a Python script used to automatically sign the petition. The script has a number of weaknesses that could be easily used to filter out the forgeries:

  • The post code is a constant hard coded into the script (SW1A 0AA). Even if individual users would change it, a large number if signatures from the same post code in a short time would be a dead giveaway.
  • The emails used are generated with the Python tempmail module, that is just a wrapper for the temp-mail.ru service. So just filtering out domains used by them would do the trick.
  • The name is just a bunch of randomized characters like "ûqv knzõâ".
  • All the posts would be from the same IP address. So just rate limit or filter out IPs with more than X signatures in Y time from the database.
  • There is no attempt to set a believable User-Agent header.

In other words, this script is rather dumb. Even though it could be used to sign the petition, that does not mean that the obviously fake signatures will not be filtered out later. Just because you submit does not mean you will get counted.

8
  • 5
    Beware of IP geolocalisation! Most large companies have a single connection point to real internet, and as it is a firewall, only this IP will be used, even if the actual user location is at the other end ot the country. Jun 27, 2016 at 14:34
  • 3
    @SergeBallesta I am not saying all cases where the geolocation does not match should be filtered out. I am suggesting it could be used as a sanity check on the data set as a whole.
    – Anders
    Jun 27, 2016 at 14:38
  • 4
    Not only is the post code a constant, it's the postcode of the Parliament itself! Nobody actually lives there, as far as I know.
    – crazyscot
    Jun 28, 2016 at 4:48
  • 1
    @siimsoni Hence my first sentence. If the conversation in comments is correct it was actually used, though.
    – Anders
    Jun 28, 2016 at 20:47
  • 2
    @crazyscot Actually, the Speaker's House (apartment) is there, in the Elizabeth Tower. Jun 29, 2016 at 10:57
15

I don't know if this is how things are done in Britain, but this is how things are done in the Netherlands whenever a petition is submitted to the government:

  • A random sample of the signatures is taken;
  • These signatures are verified (I think they call people to ask if they've signed);
  • the resulting ratio of valid:invalid signatures is then applied to the whole petition.

If enough of the signatures on the petition are valid, the petition has to be taken into consideration by the parliament.

Since the threshold on UK petitions is 10,000 to be considered by the government and 100,000 to be considered for debate, only 0.3% (consideration) / 2.7% (debate) of 3,677,062 signatures would have to be valid.

1
  • After said sample is taken, does the team / agency / government whatever take the time to sample a larger portion of the votes (or even all of them) for some better precision, or do they normally accept the sample as is? I'd assume the sample is typically close enough anyway Jun 27, 2016 at 16:14
3

You cannot match postcode to IP location, I use Plusnet in the UK and it shows up as being in Dundee (several hundred miles away) from me when I check my location according to location. So it cannot be using that to check.

Similarly, you don't need millions of email addresses, just 1 with many aliases - assuming the email address is actually checked.

I doubt that petition site was built with fraud verification in mind as until recently the petitions were for mostly trivial matters. Its probably just a simple web form using an email response and a duplicate-checker for postcode and name (multiple people could live at the same place)

3

For the governement tool :

I see one interesting point : there is a map showing the distribution accross the votes : http://petitionmap.unboxedconsulting.com/?petition=131215.

We can see here that the votes have been made accross all the country, and the distribution seems to follow ppopulation density (more votes on London,...). An elaborate bot could have mimic that, but that fast ? This seems unlikely.

This will still require to provide 4Billions of different mail addresses. Most of provider perform checks, and if you use one or two mail domain that aren't widely used and protected against bots, you can still detect and discards those votes.

Furthermore it's a government tools, so they can have quite some checks around it, (ban proxy IP by detecting lot of same IP, ...) but i don't know them.

So i think this petition using the government tool seems like trustable as generating so many votes considering , mail addresses, postal code repartition seems hard to do in the short amount of time it has been since the first results.

EDIT : Answering to D.W comments : since the OP is wonering if the government tool is reliable regarding the one petition with 4000000 votes, what i was saying there is in this case, it is definitively reliable, fakes votes will be filtered well enough to not be so representative.

Now if you asked for a 10k votes it's possible that fakes votes can be too representative to be trustworthy.

3
  • While interesting, comments are not for extended discussion; this conversation has been moved to chat.
    – Rory Alsop
    Jun 27, 2016 at 11:49
  • This answer does not appear to answer the question that was asked. The question that was asked is: "is the petition system secure against attack?". This answer appears to be trying to answer the question: "do the results of a particular petition drive appear to be trustworthy?" -- but that's a different question.
    – D.W.
    Jun 27, 2016 at 21:14
  • @D.W. Well what i'm saying in te end is that petition on the petition system from which the OP asked this question seems to be trustworthy enough regarding the facts. As pointed Rory, you can have some 10 thousands fake votes but the government tools seems to provide fair enough relability for petition with 4000000 votes to be trustworthy. Now if you asked for some 10k votes, i'd say it's possible that there is enough fake votes to be not so reliable.
    – Walfrat
    Jun 28, 2016 at 7:11
2

While the answer would be 'no', in this case it doesn't matter. All it is, is in 'indicator'. It doesn't need to be trusted to be 'looked at'.

If someone were to do internet-voting, then this system would be a very, very bad idea to use.

2

They can verify the name and post code against the electoral roll. When they say 80,000 fraudulent names removed, I expect those are the ones that don't match (I don't know this for sure).

However, this is flawed because much of the electoral roll is public.

6
  • 1
    Also, the electoral roll itself has extremely weak security. Getting on the electoral roll essentially boils down to putting a name, address, and signature on a form. There's no verification of the name, address, or even whether or not the person is a British citizen. Jun 28, 2016 at 14:21
  • And a correction: all of the electoral roll is public. You can opt to have your name excluded from use for marketing purposes, but anyone can inspect the entire roll at any time. Jun 28, 2016 at 14:23
  • 1
    The form only requires to be a British citizens or a UK resident. Not to be in the electoral roll. So the electoral roll can't be used to eliminate invalid signatures.
    – dolmen
    Jun 28, 2016 at 17:32
  • @JonBentley - How can I view the unedited roll? It's not intended to be public, but if you know a way, that would be interesting!
    – paj28
    Jun 28, 2016 at 18:00
  • @paj28 It absolutely is intended to be public. You can view it by contacting the electoral registry office for your borough. It's usually located in your council's headquarters, town hall, or possibly a library. See here for details of viewing it and here for the opt-out which is what might be causing the confusion. Jun 28, 2016 at 18:36
1

It's not just technical security you have to consider. No online voting system is a secret ballot; there is no way to eliminate social pressure to vote a particular way. A dominant member of the household can bully other family members into signing, or simply use their email addresses to do it himself.

0

You can't make it failproof, but you can increase the amount of parameters to take into account so the maximal percentage of cheat becomes statistically insignifiant.

Still, I live in France, have been to Wales once for a week or so in my whole life, and just signed the petition as a londoner that lives at 1 Jamaica St. My web browser has no permission to use geolocation but I did not use any VPN or proxy so I can be spotted. With one or two more proper precautions, I could have been considered as a fully legit londoner, but I am only one individual among our hole species.

Whether petitions are reliable or not depends on your statistical considerations and definition of reliability.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .