April 13, 2006
Quarter poll still easy to manipulate

Mrs. Gregoire's1 online poll for the Washington State Quarter design, which was taken down earlier this week after Sound Politics reader Jeff Boly reported that it was being manipulated by a bot, is back online.

Vote for your favorite state quarter design, here. It's now more inconvenient for someone to vote twice from a web browser, but it's still pretty easy to manipulate. Readers D.T. and J.C.W. both e-mailed to explain how cheesy this thing is --

Here's how to hack this poll, too!
1. Go to http://www.governor.wa.gov/quarter/default.asp
2. Vote for your favorite non-Orca choice.
3. Close the page after you vote
4. From your Start menu, pick Run
5. type CMD and click OK
6. type CD COOKIES -- that's a space between CD and COOKIES
7. type START. (need the period after the word START – no spaces – then hit )
8. Sort the list by date.
9. The most recent entry in the list that you see is the cookie you have to delete to vote again.

For example, shark@www.governor.wa[1]txt (your mileage will vary)

10. Bring up Internet Explorer again and return to the governor.wa.gov page
11. Vote again!
12. Lather, rinse, repeat. Keep returning to the "Cookies" window to delete your cookie and fool Queen Christine's page into letting you vote again.

and
Using Konqueror, my Linux browser, I told it to accept the first cookie only. That allowed me to vote. I rejected the second cookie, the one to indicate that I voted. I got the screen thanking me for having voted, and by clicking the "back" button, I could repeat this again
and again. I could also vote multiple times by using multiple browsers, though that took longer to do than the first approach.

Fully automating this scam would be trivial. I wonder how much we paid to put
this "improved" poll up?

I'm not suggesting that anybody should do this. Why even bother? I'm only pointing that this poll is too easy to manipulate and its results should be taken with a giant grain of salt.


1 Joni Balter has always liked Mrs. Gregoire and always will lead the cheer for her, no matter how fiscally irresponsible she is. The fact that Joni Balter is throwing cold water on Dino Rossi today only confirms how much of a formidable presence she believes he'll be in 2008. Posted by Stefan Sharkansky at April 13, 2006 10:15 AM | Email This
Comments
1. I read that they're going to log IPs and reject all but the first vote from each IP address. So it's not quite as easy to manipulate as it seems. So, if you work somewhere with a shared IP, vote early to beat your co-workers!

Posted by: Jeremy on April 13, 2006 10:21 AM
2. And using Perl and the various Web Automation libraries, it would be very easy to write a script that ignores the cookie and allows one to vote continuously assuming there are no other layers of limitation. In other words, let's keep an eye on the totals, I am sure they will start going up again rapidly soon.

Posted by: Jeff B. on April 13, 2006 10:22 AM
3. It's better if they filter based on IP after the fact, but the drawbacks of that approach are:

1) A lot of people in large address translated envrions such as corporations with firewalls, and even homes with cheap SOHO firewalls won't be able to allow legitimate individuals on their own PCs to vote. And 2) it still might make for some noticeable abuse of the poll as it is being conducted, which will further cast the pollsters as inept.

Posted by: Jeff B. on April 13, 2006 10:26 AM
4. Oh, it looks like we never even get to see the results until they are released on May 1st. Well, at least that's in keeping with the way King County conducts its elections.

Posted by: Jeff B. on April 13, 2006 10:32 AM
5. Would a public info. request show who was "cheating"? It would be interesting to know.

Posted by: shaydo on April 13, 2006 10:39 AM
6. Tsk, Tsk, Tsk,

You missing the real agenda.

This is the first test of online voting, to be rolled out for '08.

I can see it all now.

Queen wins re-election by landslide:
Defeats Rossi by 30 million votes.
Republicans cry fraud!
Democrats say count every vote!
Denron says no evidence of fraud charge.
KCE finds 10 million votes on a server!
Judges Bridges rules unless a bot testifies that it voted illegaly and who it cast the votes for, the votes counts.


Posted by: JCM on April 13, 2006 10:39 AM
7. "shaydo": Would a public info. request show who was "cheating"? It would be interesting to know.

I believe that the web server logs should be available for public inspection. You should at least be able to tell which IP addresses were responsible for multiple votes.

Bear in mind though that some corporate networks, government agencies and large ISPs (e.g. AOL) proxy all web traffic through a small number of IP addresses.

Posted by: Stefan Sharkansky on April 13, 2006 10:43 AM
8. Stefan---
A giant grain of salt is called a BLOCK of salt.
B-L-O-C-K....as in Blockhead (which is what the person who designed this poll is!)
Gregoire will have her "insiders" rig this poll to get her own way....just like she did to get elected.
An old dawg like her will keep using the same old tricks dontchaknow!
Speaking of Election Fraud.....
How are those Transaction Logs looking Stefan?
Are you able to reconcile the Voter Registration Database between time periods using that log?
Are there any interesting entries??
How about the timing of some of these entries???
I'll bet "higher-ups" had the ability to "log-in" using underlyings ID's.
Good luck...throw us a bone out here in "Curiosity Land"!!

Posted by: Mr. Cynical on April 13, 2006 10:55 AM
9. the native american coin is going to win regardless. what is the point in voting.

Maybe that is how Chrissy is going to get the Tribes to ban smoking... "I gave you the state coin, now, pretty please make your casios non-smoking."

Ha!

Posted by: fdshsdjk on April 13, 2006 11:21 AM
10. It is rather odd that no "results" appear after a person "votes." Instead, I got this message:
Thank you for your participation.

We will post the results of the poll on May 1, 2006.

Will the "votes" from King County be the last to be "counted" this time?

I guess we'll just have to wait and see what's inside the black box.

Does anyone know which design is Gregoire's favorite?

Posted by: Micajah on April 13, 2006 11:22 AM
11. An easier way to revote by removing cookies is to do the following:

1. goto http://www.governor.wa.gov/quarter/default.asp
2. Vote for your favorite non-Orca choice.
3. Go back to previous page by pressing Back button.
4. Bring up Internet Options dialog (Tools --> Internet Options menu)
5. Press Delete Cookies button and exit out of Internet Options dialog.
6. Repeat #2 through #6.

Posted by: C. Oh on April 13, 2006 11:23 AM
12. Even easier is simply blocking cookies from governor.wa.gov. I hope they block multiple votes from a single IP, but even that won't help much... there are SO many compromised open proxies out there that they could just write a script to vote through a bunch of compromised proxies.

Posted by: cs on April 13, 2006 11:30 AM
13. I thought I would exercise my Warshington right to be heard more than once and "The MAN" had the gall to tell me I already voted. Probably because I voted for the 1st coin. So I only voted once. Where is queen Christine's image on the beloved coin(I suggest near the rear!), or Gary Locke for extending Tribal Property rights off the Rez. not to mention the Smoking and Gambling Mono Poly they have.

Posted by: Garret on April 13, 2006 11:30 AM
14. But I like the Orca. I've always liked NW Indian art.

Posted by: RBW on April 13, 2006 11:56 AM
15. Wow, all that's missing for Joni Balter in that Gregoire-lovefest piece is the pom-poms!

Posted by: Misty on April 13, 2006 12:04 PM
16. ..and they won't give us the results of the on-line poll, so that Jeff B. nor anyone else can't discern any more cheating going on. What we don't know, we can't complain about, eh??

Posted by: Misty on April 13, 2006 12:08 PM
17. i voted twice for the first choice.

so this is how it feels to be a gregoire voter.

Posted by: dan on April 13, 2006 12:52 PM
18. 1. The Orca design *is* the best, by far.
2. I hope our tax dollars aren't spent creating a tamper proof voting system for quarter designs. What a waste.

Wait, #2 is your argument usually. What's going on?

Posted by: LovinUSA on April 13, 2006 12:52 PM
19. Just change the pricavy settings in IE to 'Do not accept any cookies' just before you vote, then vota and press the back button, and vote again.

Posted by: Chick Green on April 13, 2006 01:19 PM
20. In order to honor DeanRon I voted 10 times. Now if I could only change my address to the King County office building I would be on the Liberal honor roll.

Posted by: swassociates on April 13, 2006 01:56 PM
21. Well, i deleted the cookie after voting once, deleting the cookie, then voting again. After that, it stopped putting cookies back and i can vote over and over and over simply by hitting back button and voting again. So... in the Washington tradition, I voted for design #2 about 10-15 times.

Posted by: Eric on April 13, 2006 01:58 PM
22. Stephan,

I usally agree with you, but I really like the Orca/Native design! I lived in Alaska for a few years, and I don't think very many people outside of us in washington think of Fish & Washington...outside of the pike place market throwers.

But the PNW is well known for our Native ties and culture.

Posted by: Josh on April 13, 2006 02:04 PM
23. "1. The Orca design *is* the best, by far."

To mouth-breathers, morons, and moonbats that is....

Posted by: alphabet soup on April 13, 2006 02:06 PM
24. Also, I love that the Honorary Chair is Mrs. Gregoire's husband. She can't even get him a REAL job......just Honorary Chair.

Posted by: Josh on April 13, 2006 02:07 PM
25. Muwahahaha!!!
I just voted again at my work address. Now I've disenfranchized everyone of my coworkers. OK, they won't be able to vote twice now. Which is a good thing.
Trust me.

Posted by: Reporterward on April 13, 2006 02:18 PM
26. Even using a logged IP address won't work. Sure, DSL has a static IP, but dial-up and cable do not. You'll likely see the same address, legitimately, over and over again.

Even better, IP addresses are not tied to physical addresses. What would prevent, say, everybody in Germany from deciding what our quarter should be?

Posted by: Jeannette on April 13, 2006 02:22 PM
27. Although not the same but sure is close is the logo for "Northwest Handling System Inc."

Posted by: Steve on April 13, 2006 02:25 PM
28. What a dilemma! I was hoping to allow my web designer and my two expatriot friends now living in Baghdad (they're from North Carolina, but helped me carry the Dell boxes from where the UPS man left them on the curb when they visited once. I even have pictures of them at the Pike Place Market.) use my computer to vote, since they all care so deeply about the Evergreen State's quarter.

If they log the IP address of my computer, I can only vote once? How will my web designer and expat friends make their voice heard? Oh the horror!

I should really put something about this in my next column, I could start writing right now, but I am terribly upset by all this and think I need to seek comfort from Ben & Jerry's.

Posted by: Joel on April 13, 2006 02:58 PM
29. i really love voting multiple times. thank god i live in king county!!!!!!!!!!!!! i just might have to make a habit of this.

Posted by: danno on April 13, 2006 03:12 PM
30. You do realize that this poll is non-binding anyway don't you? Mrs Gregoire has the final choice and hers is the only one that is binding.

They went through a similar process in California though the public had twenty choices on the online poll not just three. Like the system now in use here you could vote multiple times by deleting the cookie.

After the poll ended Gray Davis did not select the ones that the public chose. He even placed the one that finished sixth in the list of the final five, it featured an image the the "naturalist" John Muir and was heavily lobbied for by the Sierra Club and other environmentalist groups. It had been designed and submitted by a Sierra Club member.

When the time arrived to choose the final design Schwarzenegger was then Governor and along with manipulation and advocacy from the State Librarian he was persuaded to select the Muir design. It was widely speculated that Schwarzenegger was trying to curry favor with said environmental groups when he chose their design.

Obviously it wouldn't be too big of a leap to assume that Mrs G will be doing the same regarding the native tribes. Unlike Arnie who attempts to ingratiate himself with everyone except his own base, she has been doing a bang up job of repaying those that arranged for her to "win" her election.

Posted by: Mark on April 13, 2006 04:26 PM
31. I'm not voting, but I hope the third one wins - I always liked the R. Crumb style of cartooning.

Posted by: Ira on April 13, 2006 06:33 PM
32. The Orca is an okay design. However, it isn't overly authentic and it does NOTHING to show Washington state. The Orca could just as well be for Alaska or Oregon. The purpose of the quarter program was to showcase each of the 50 states in the order of their admission to the union. And then have most of the coins pulled out of circulation by people collecting them!

Gregoire will probably try to trade her choice for the Indian tribes to ban smoking in their tribal gaming buildings (ca*ino is a banned word). Of course she would chose the coin and they would renege on the agreement.

Welcome to online voting. The planning for this vote was probably not done by their best technicians or planners. However, when the fake votes showed up they probably ran for the "experts" and the PR people. Just about any method of online voting can be manipulated.

Posted by: Skeptic on April 13, 2006 06:41 PM
33. like an online poll ever meant shit for anything.

Posted by: AD on April 13, 2006 07:09 PM
34. This is fun!!!!!

I even voted for my dog and 3 cats. They're people too... at least to me.

Posted by: Janet on April 13, 2006 07:35 PM
35. Howyousdoin

Whaddayouswant,it's a two-bit poll.

Forgetaboutit

Posted by: Joey bag of doughnuts on April 13, 2006 09:12 PM
36. Throw this in a batch file in a command prompt and crank out the votes for #1!!!! (you'll need to download curl.exe from http://curl.haxx.se/).

@echo off
set NUM_VOTES=0

:vote_loop
sleep 1
set /A NUM_VOTES=%NUM_VOTES%+1
echo Sending vote number %NUM_VOTES%...
curl --form design=1 --output NUL --referer http://www.governor.wa.gov/quarter/default.asp --user-agent "The_Vote_Balancer" http://www.governor.wa.gov/quarter/results.asp
echo ...complete.
goto vote_loop

Posted by: Schwing on April 14, 2006 03:21 PM
37. Thanks schwing. I'm not interested in cheating, but was interested in seeing how it's done.

So how does the web designer defeat your program?

Posted by: alphabet soup on April 15, 2006 10:02 AM
Post a comment
Name:


Email Address:


URL:


Comments:


Remember info?