Martin Galpin | Racing Driver | number66.net

The DriverDB competition to win one of three places in the Grand Prix Shootout has expired and place were won by Karline Stala (Latvia, 7038 votes), Martin Short (New Zealand, 1945 votes) and Richie Stanaway (New Zealand, 1068 votes). Congratulations to the winners and I wish them the best of luck in the competition.

At my last count, I believe I raised somewhere in the region of 1600 votes (I can’t be certain of the actual amount due to the unreliability in how votes are recorded). You may be wondering in that case why I did not win a place amongst the final three. On 24th September the voting rules were changed and my votes effectively void.

I have to admit, I’m not entirely surprised. I knew there was only two real outcomes; either I would win a place or I would be disqualified. But none the less, I can’t help feeling slightly disappointed because ultimately I did invest significant effort in the competition.

This is the story of how I achieved my votes and why I believe it was wrong to change the rules and disqualify me.

The Original Rules

When the competition began, I started to think of how I could maximize the number of votes I could achieve. The nature of the contest naturally suits those with ties to large organisations, marketing companies or access to large distribution lists.

The rules for the competition were relatively simple. Of the six relevant clauses the following were of particular interest to me.

Essentially, the competition will allow one vote per e-mail address and up to ten votes per IP address per e-mail domain. In theory, the rules allow for one person to vote up to ten times using Hotmail, GMail, Yahoo or any other provider. And I’m sure that they did.

The reality is that whilst immediate family might have the patience to register tens of e-mail accounts across the Web, it isn’t going to win you the competition.

I needed something more. I wanted to ensure that I achieved the maximum number of votes allowed within the rules. I also wanted to make sure it was as painless and as simple as possible for the voter.

The following diagram shows my solution – aptly named the Grand Prix Shootout Vote-O-Matic.

Grand Prix Shootout Vote-O-Matic

Essentially, the Grand Prix Shootout Vote-O-Matic made it simple for a single voter to register the maximum number of votes allowed under the rules.

The voter initially enters his or her e-mail address into the Vote-O-Matic on my website. Upon submission, this fires an XMLHttpRequest to a webservice, also on my web server, which itself fires another call to a webservice on a Mail Relay I had set up.

The Mail Relay creates ten unique e-mail addresses for four different e-mail domains, each of which are configured to forward to the voters original e-mail address. These addresses are then passed back to the webservice on my web server and finally back to the Vote-O-Matic via JSON.

For each e-mail address (40 new plus the one original), an iframe which contains the voting form is created dynamically. The e-mail address is then injected into the form and at scheduled intervals (for 30 seconds), each form is submitted (the intervals are delayed to prevent the browser DOM becoming overloaded and causing a Denial of Service on the DriverDB server). At the this point the vote has been cast. (NB: 40 votes is an arbitrary number I felt was sufficient to win).

In case you are wondering, the Raison d’être for submitting votes in this way (using Javascript and iframes) is to ensure that each vote still originates from the users IP address and not my webserver.

The user now receives 41 validation e-mails in their original inbox and they must manually confirm each vote individual before it is valid.

Ultimately, both the IP address that submitted the vote and the IP address that confirmed the vote match and every e-mail address continues to be manually validated by the voter. This process is the same as a voter manually registering a number of e-mail accounts and voting multiple times.

For a demonstration of the Grand Prix Shootout Vote-O-Matic see the video below.

The Unfair Advantage

I believe that Mark Donohoe would have called this The Unfair Advantage. I also believe that Perry McCarthy would have done the same (given his history with the Racing for Britain programme).

Alternative interpretations of rules is as much a part of motorsport as the racing itself. You could in fact argue that in modern Formula One it is the greater force. You can take this years double decker diffuser row as a case in point. I consider the Grand Prix Shootout Vote-O-Matic to be my diffuser – my way of performing up to the maximum allowed by the rules.

I would like to point out that at no point did I attempt to deceive the organisers of the competition. Each unique e-mail address was an obvious collection of random characters. I could have generated e-mail addresses against a word list to create more authenticate looking addresses. What’s more, the pool of subdomains was also kept intentionally small.

A Late Addition to the Rules

On 24th September an e-mail was sent to all participants in the competition introducing a new clause to the rules.

The first part of this clause is obviously directed at the Grand Prix Shootout Vote-O-Matic where as the latter is not applicable to me.

In my opinion, this addition to the rules confirms that the original rules were not broken. Whether it is in the “spirit of the rules” is a matter of opinion and I have made mine open.

The outright winner of the competition, Karline Stala, did so with 7038 votes. However, despite 7038 votes there are no more than 4200 unique IP addresses. I would be interested to understand the voting pattern that produces this and I would welcome a raw log of all votes (including my own) to be published and made accessible.

Not Hard Done By

I would like to reiterate that I actually do not feel hard done by. I knew that the Grand Prix Vote-O-Matic would either see me win or be disqualified but I felt that it was an interesting enough story the share none-the-less. I am content in the knowledge that I did in fact secure enough votes to win a place in the Grand Prix Shootout and I would like to extend my thanks to all those who voted for me.

If we are to learn one thing from this story it is this. Internet voting, of any kind, is and will always be inherently insecure. In the words of one of the worlds most influential computer security experts, Bruce Schneier:

Related posts:

1. Vote for me in the Grand Prix Shootout!
2. The Death of the 2010 British Grand Prix?
3. Dunlop Race Academy: Now with Motorsport News
4. 2009 Dunlop Race Academy – Good News for British Motorsport