Detailed Analysis Of The Attack And The Results 

//.\\//.\\//.\\//.\\//.\\//.\\//.\\//.\\//.\\//.\\//.\\//.\\//.\\

Contents:

  1. Analyzing the Attacks



  2. Retrieving the Good Data



  3. Results



  4. Who Did It?

  5. Conclusion 
\\`//\\`//\\`//\\`//\\`//\\`//\\`//\\`//\\`//\\`//\\`//\\`//\\`//\\`//
  1. Analyzing the Attacks

    [[o]]|[[o]]|[[o]]|[[o]]|[[o]]|[[o]]|[[o]]|[[o]]|[[o]]|[[o]]|[[o]]|[[o]]


  2. Retrieving The Good Data

    After the successful analysis of the attacks, it was possible to remove all the bad data. However, our policy is to allow one vote per attacker rather than to remove all the votes. As vote-keepers, we have no interest in punishing our attackers, only in correcting the tallies.

    Because our attacker appears to be in Nicaragua, and not in Mexico, and we have no reason to believe that our attacker is Mexican, we cannot give this particular attacker a vote. 

    ((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))


  3. Results

      _  _  _  _  _  _  _  _  _  _  _  _  _  _  _  _  _  _  _  _  _  _  
 |_||_||_||_||_||_||_||_||_||_||_||_||_||_||_||_||_||_||_||_||_||_|


  4. WHO DID IT?

    At this time we have no ideas on how to determine the identity of our attacker from Nicaragua by further data analysis at deliberate.com. Probably the authorities at the University there can find her/him.

    However, to discover the logins that our attacker might have used, we ran our analysis backwards. Starting with the original data, we removed all the ballots associated with errors. Then we removed the ballots associated with the domain names used in the attacks. These ballots, removed after the errors were removed, were sent from valid user id's and probably point to our attacker(s). 

    21 Mar 1999 17:39:09 -0800 -1.00 m_agui@ankara.bcc.bilkent.edu.tr
21 Mar 1999 17:39:36 -0800 -1.00 ojaguila@ankara.bcc.bilkent.edu.tr
21 Mar 1999 17:41:13 -0800 -1.00 r-aguila@ankara.bcc.bilkent.edu.tr
21 Mar 1999 17:45:11 -0800 -1.00 yoaguila@ankara.bcc.bilkent.edu.tr
21 Mar 1999 17:48:49 -0800 -1.00 ciaguirr@ankara.bcc.bilkent.edu.tr

21 Mar 1999 17:50:07 -0800 -1.00 ezagui@netra.tnet.net.mx

21 Mar 1999 21:07:12 -0800 -1.00 ararriaga@www.subasta.com.mx

21 Mar 1999 15:17:20 -0800 -1.00 adaceved@mailer.data.net.mx
21 Mar 1999 17:42:14 -0800 -1.00 azaceved@mailer.data.net.mx
21 Mar 1999 17:46:16 -0800 -1.00 q_aceved@mailer.data.net.mx
21 Mar 1999 17:49:36 -0800 -1.00 o_acev@mailer.data.net.mx
21 Mar 1999 17:49:43 -0800 -1.00 puaceved@mailer.data.net.mx

    It is likely that amongst these login ids are the ones that our attacker used. 

    ((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))|((o))


  5. Conclusion

    We conclude from this experience that, even without voter registration and when viciously attacked, online voting is more accurate and secure than traditional voting because the data trail allows complete analysis and reversal of attacks. Online voting would be absolutely accurate and secure if there was a registration process identifying each person with her/his single email address.

    zapa@deliberate.com

Public comments contributed in La Consulta and the Solidarity Petition are shown at:
http://www.deliberate.com/consulta/comments