ConCalls: How Secure Was CIMS and Your Data?

Posted on by John Klein

Sixth Estate has learned that if Pierre Poutine had just asked nicely (or bribed the right people?), they could have had a duplicate copy of CIMS, potentially. It’s not clear if this would be a complete copy, or information only for a local riding. Why is this very important? See the bottom of this article if it’s not clear.

Look at this excerpt from the Globe and Mail two years ago:

Federal and provincial parties eager to get ‘conservative-minded individuals’ into municipal office
GLORIA GALLOWAY

From Friday’s Globe and Mail Published on Thursday, Aug. 19, 2010 7:18PM EDT Last updated on Thursday, Aug. 19, 2010 7:21PM EDT

The municipal candidate had a question for Brian Patterson: Can someone running for city council get his hands on party computer programs that incorporate federal or provincial voters lists?

Specifically, the candidate wanted to know if he could get access to massive databases, called CIMS (constituent information/issue management system), that the federal and provincial parties use to store information about voters, including lists of electors that are protected by law.

“CIMS is a copyrighted computer program of the Ontario Progressive Conservative Party and the party can’t give it out because we have a contractual obligation with a guy in British Columbia,” Mr. Patterson replied.

“But if someone gives you a copy of CIMS in your local campaign, we can’t stop you from calling up your local guys that you work [with] on the executives of [riding associations] if you can get it off them. You know, ‘Hear no evil, see no evil, speak no evil,’ ” he said. “… you never heard me say this – and I’ll deny it in a room full of lawyers – that if you can somehow get it, you know, we don’t care.”

Pierre Poutine, the alias of a criminal involved in a vote suppression scheme known as RoboCon, needed specific phone numbers for voter misdirection robocalls to be effective. These numbers would have come from a political party’s voter information database. The Conservatives’ database is widely regarded as the most complete in the country.

Where is all this leading? I’m not sure yet. But if you decided you wanted to call a huge number of suspected non-supporters and send them off to the wrong polling place, you could do it with a system like CIMS or (presumably) Liberalist. And if you didn’t have a system like CIMS or Liberalist, you wouldn’t be able to. It’s as simple as that.

13 responses to “ConCalls: How Secure Was CIMS and Your Data?”

  1. “if you didn’t have a system like CIMS or Liberalist, you wouldn’t be able to”

    This is not true. A local campaign could do a “one-two” round of calling using their service provider.
    Step 1 – Identify voter intentions. Robo-poll or phone bank. Build “enemies” list.
    Step 2 – Feed enemies list into robo-call software (or provide to phone bank) and deliver misdirect message.

    Of course for multiple ridings to use the same script implies a conspiracy of some kind and greater likelihood of access to a central database but it could be pulled off using local voter intention lists paid for by the local campaigns.

    Question to be asked (and maybe answered). Do all local Conservative campaigns “upload” the results of their voter intention calls (robo or live) to CIMS as a matter of policy?

    Reply

    • As you said, it’s true IF the point is to make it practical, and easier to conceal without involving more people at more points directly in the conspiracy. So while it could be done if the task was farmed out to an unethical polling company, the Conservatives would still be implicated in providing their DB to unsavoury sorts who would concoct a massive conspiracy like this.

      Tracey Kent has indicated in another of my CIMS blog posts that gaining write/update access is less usual for local campaign workers than read-only access for the local consitutents. Not sure if that specificly answers your question.

      Reply

      • According to one of your links, it suggests that local campaigns do “input” the results of their local “data collecting” to CIMS. It looks like if they need for their own riding later, they can retrieve but it must become available for the central party apparatus were they to act without the knowledge of the local campaign.

        What I was suggesting is that unscrupulous local campaigners could do this without needing to access a central database IF they compiled the “enemies” list themselves using robo-polls, phone banks and/or door to door canvassing results. Robo-polls. Their second step would be to either input the target numbers into an auto-dialer with a message blast (Guelph) or provide it to phone bank (as was reported in Thunder Bay).

        What’s crystal clear is that you can’t call your enemies if you don’t know who they are. If accounts of micro-focusing based on age are true, that points the finger in the direction of a central database because I would presume that most local “voter intention” drives – through whatever means, probably don’t ask people their ages.

      • My understanding of CIMS (which is not expert at this point {and probably never will be}), is that local campaigns work off of the central DB with limited permissions. There is no local DB, and downloading portions of the DB is highly restricted.

        Since there were calls of various sorts in many ridings, it could not have been one guy in Guelph, without permission. If it were many ridings working on this autonomously, there’s a paper trail somewhere that will show EC who co-ordinated/ordered this at the national party level. Because the Conservatives are a top-down organization, with the PMO approving every press release at local campaign levels, Harper is going to wear this scandal very hard, no matter if he directly ordered it or not because people will realize that like Chretien and Adscam, something was rotten in Denmark, while the King looked the other way or was preoccupied.

      • Great info!
        http://catch22campaign.ca/
        “March 14, 2012

        I am currently in the process of researching the financial reports of all the ridings named by the National Post in which complaints were made about either fraudulent or nuisance calls.

        I also did a quick look at the financials for all the other registered Third Party campaigns in Canada. Guess what? Catch 22 was the only registered Third Party to use auto-dialing to deliver our message.
        That means that all other auto-dialing (or phone bank) initiatives were conducted by either local party campaigns or central party campaigns. If the robocalling was outsourced to a Third Party, they did not register which is illegal if they spent more than $500. In the case of Guelph, we know that they did not list RackNine as a service provider. They did use two other survey/research suppliers.

        More to come.

        Gary
        “

  2. any lawyer types know what joe citizens rights are with respect to a CIMS. Can I demand to see what info they have somehow acquired about me or possibly my family? I would be extremely concerned if my kids showed up in their database as they might indicate access to census data. Right about now I don’t trust the Cons with anything related to this whole affair.

    Reply

  3. Excerpted from Catch 22 Campaign – Robocalling: One way to produce an “enemies” list” – http://catch22campaign.ca/profiles/blogs/robocalling-one-way-to-produce-an-enemies-list. The Catch 22 Campaign was voter cooperation / strategic voting campaign that made voting recommendations in 58 ridings.

    =============

    I’m by no means an expert on auto-dialing but I was directly involved – hands-on – in the last week of the election. We made more than one million robo-calls into 16 ridings. Our calls combined a voter intention “robo-poll” with a strategic voting message to our target voters.

    Here’s an overview of what we did:
    1) Hired an auto-dial service provider. As our public financial records show, we paid a flat rate per riding which included the rental of the riding phone numbers. Each list had tens of thousands of phone numbers.
    2) Got an account with a log-in name and password. This gave us access to a web interface that let us “do it yourself” and save money. We also had a training session.
    3) Created an electronic “campaign” for each riding. At this stage we designed the call (what happens when they push different buttons, the dates and times for the calls, etc.)
    4) Wrote and recorded scripts for each campaign. Once we did that, we had to listen to and approve the recordings before they could be finalized and used. This was a built-in “final”, safety check to make sure we didn’t send out the wrong message by mistake.
    5) Turned it on.
    6) Once the calls began, we could see their progress online in real time – i.e. see a summary of how many calls were made, how many minutes we used and the results of the “voter intention” robo-poll.
    7) We were also able to produce a detailed report with the robo-poll results in the form of a spreadsheet file that could be turned into lists of Con, NDP, Green & Lib voters phone numbers.

    Voila. That’s one way that a local (or any other) campaign can produce its own “friends” and “enemies” lists. Catch 22 did not use these lists as we didn’t have a “get out the vote” component to our campaign.

    Reply

  4. Pingback: Blog Navel Gazing | Saskboy's Abandoned Stuff

Leave a comment