Identifying a Cheater in Public Voting Campaign

Question

A local brewery recently ran a photo contest where the grand prize winner is determined by a public vote using a third party platform/administration. One of the entrants reached out to us because they suspected that someone was using a platform or application to enter multiple votes at one time. In the last hour they got an additional 200 votes. When I pulled the file, sure enough, there were spats of votes coming from the same IP address.

Is there any way to look up the owner of an IP address? Are you familiar with these types of voting platforms? Can they mask or give a dummy IP address?

The only information that we took when consumers voted was first name, last name and email. We can see that this person cheated but we need hard evidence that leads the cheating back to this particular person. Partly, because we believe a staff member may also be involved.

Answer 1

My question is, is there anyway to lookup the owner of an IP address?

Yes, search for Reverse IP Lookup and you will find a couple free services with varying amount of information. It won't be that useful anyway, because unless you can subpoena his ISP, you will not get his name and address. And the ISP will not be willing to cooperate.

can they mask or give a dummy IP address?

It depends heavily on the platform. Usually the IP returned is the IP used for accessing the form, so you probably can trust the information on your file.

Any insight would be helpful, if you have any thoughts!

Your priority is to bring fairness to the contest, not bring the cheater to justice. Don't waste any time time to unmask the person behind the cheat, only the cheating votes.

You have a collection of emails, right? Send an email to every address with a confirmation link, linking to a page protected with a good CAPTCHA, and ask again the first and last name for confirmation. This can reduce the amount of duplicate votes you will get, because will increase the work needed to the cheater.

And don't disclose publicly how many votes the contestants have, so you can remove the duplicate votes on the background without the attacker knowing their votes were disqualified. You can then remove all duplicate votes from the same IP address, silently, and have a fairer contest.

But if one of the staffers are involved, it's going to be more difficult to protect the fairness of the contest.

Answer 2

That's the big problem with anonymous online voting. You can not ensure that each vote was cast by a different person.

When you have no other form of user authentication (like personalized accounts with username and password), then the IP address isn't an unique identifier.

• IP addresses can change. Many ISPs use dynamic DHCP and give every device a new IP address whenever it reboots or in regular intervals.
• Users might own multiple devices with different IP addresses (like a home PC and a smartphone)
• When a user connects to a public WiFi network, they usually appear with the IP address of the WiFi network
• Users can use public proxy servers. Votes will then appear with the IP of the proxy

And even if you do catch multiple votes from the same IP, the voters can plausibly deny that they are the same person by claiming:

• They were different people using the same WiFi network
• Their internet service provider might use a network configuration called Carrier Grade NAT, which results in all users of the ISP to appear with the same IP address to the outside world.

So IP address isn't helping us.

What else can we try? What about Browser Fingerprinting? Web browsers transmit a lot of data about their configuration, and can be coaxed into revealing even more data through various JavaScript APIs and plugins. But if people know you are doing that, then there are ways around that. Like casting votes with different web browsers.

Sorry, but anonymous online voting just doesn't work!