The Forum for Democracy ‘anonymous’ referendum is not that anonymous at all. The voting system knows the full names, email and internet addresses of all voters, despite Forum trying to hide this.
Forum has been going around for a while. Now the party is holding a controversial referendum to determine whether Thierry Baudet remains the party leader. According to Forum, the referendum, of which the result is expected tonight, is ‘safe and anonymous’, according to their website.
Forum members have received an email with a link to vote via the system of Big Pulse, a company that provides online voting.
This link is associated with their full name and email address, without Forum members knowing. The voting page itself only shows the question: “Do you want Thierry Baudet to remain the party leader of FVD?” with the answers ‘yes’ and ‘no’.
Adjust voting number
By a simple trick it is possible to see parts hidden by the system. The voting web address reads ‘p63260’, which is the Forum referendum number. Adjusting that number puts you in the vicinity of another online vote, such as the University of Leeds. There you can see that your private data is secretly stored and processed.
“This whole system looks very broken,” says an ethical hacker who wishes to remain anonymous. “You shouldn’t be able to get into a different mood, and certainly not by adjusting a few numbers.”
After you have voted, you can no longer change the vote. You will then see a voting receipt with your unique number that is linked to your full name and e-mail address, the IP address of your device, a unique voting number and a unique reception code for your vote.
Back not closed
The back of the Big Pulse voting system was also accessible to everyone. The url for this secret part of the website could be found in robots.txt, a file that tells Google which parts of the website should not be found in the search engine.
The back had options to adjust the election, view the votes, and add votes. It was not possible for visitors to operate these functions, but according to several ethical hackers it would be possible by logging in with the account ‘admin’ – the main account.
To log in with the ‘admin’ account, a password is still required, which according to hackers could be retrieved with the necessary digging. By shielding the back, so that malicious parties do not know where to log in, you would reduce this danger.
Big Pulse has further boarded the back for the publication.
Integrity
“The big question is: can Forum access the data from Big Pulse”, says researcher Matthijs Koot of the University of Amsterdam, who obtained his PhD in anonymizing data. “Strictly speaking, the vote is not anonymous because Big Pulse stores a lot of data about the voters, and you have to rely on the integrity of the company and their services.”
According to Koot, a system like Big Pulse should absolutely not be used for parliamentary elections, but before an internal referendum of a political party he can imagine that such an online service will be used – especially in times of corona: “It is good that attention is paid to this, because online elections remain a sensitive and difficult subject. ”
Forum
Forum states in a response to RTL News that it cannot be done at the back of Big Pulse or the data it contains. When asked how this can be independently verified for outsiders, the party refers to Big Pulse. Big Pulse says in a response to the NOS that this information is not shared with Forum.
Forum for Democracy said in a statement yesterday evening that “multiple hacking attempts” have been made to influence the “binding referendum” on the position of its initially retired leader Thierry Baudet. These ‘hacking attempts’ are reported, the party states.
Also with CDA problems
It is not the first time that there have been problems surrounding an online election of a party. Last August, there were doubts about the result of the CDA party leader election, which Hugo de Jonge narrowly won from Pieter Omtzigt.
The CDA then refused to answer ten concrete questions from RTL News about the voting process. Later accountants stated that the election was full of errors and that the party board could have designated ‘anything but a winner’.
See also: Thierry Baudet emotional
