The NHL's All-Star voting disaster:

[CRASHER]

Rorygate
By Daniel Engber
Posted Thursday, Jan. 18, 2007, at 6:55 PM ET

Rory Fitzpatrick fans. Click image to expand.Rory Fitzpatrick fans
Finally, something seemed to be going right for the National Hockey League. Despite flagging attendance and abysmal television ratings, the league was headed into next week's midseason break on a wave of positive publicity. For the first time in, well, maybe forever, people seemed excited about the league's annual All-Star Game.

The big story of this year's contest began with a single fan—22-year-old Steve Schmid of upstate New York. Schmid decided that it would be neat to see a hard-working journeyman get voted into the All-Star Game. He chose the Vancouver Canucks' Rory Fitzpatrick, an unremarkable player without much talent or flashy stats—in hockey terms, a grinder. The "Vote for Rory" movement took off soon after All-Star voting began in late November. Media outlets picked up the story a few weeks later, when the Vancouver players took their morning skate in "Vote for Rory" T-shirts. Rory supporters started posting clever campaign ads on YouTube, and by early December he'd been written about in USA Today, the New York Times, and Sports Illustrated.

Rory Fitzpatrick has exactly one assist this season and only nine goals scored after a decade in the league. He missed a month of play this year with a broken ankle, and his name was nowhere to be found among the league-sanctioned superstars on the official ballot. But on the strength of Schmid's campaign, Rory soon moved up to fifth in the voting among defensemen.

The press played up Rory-mania as a grass-roots movement to change the league. But a bunch of league stalwarts lashed out at the campaign. On the CBC's Hockey Night, Don Cherry called the whole thing a joke: "Rory, if you're watching, they're not laughing with you, they're laughing at you." On the Fox News-style Hockeycentral Panel, one commentator described Rory-voters as a bunch of "computer geeks." Wayne Gretzky suggested that the league intervene to save the All-Star Game. ESPN's Barry Melrose made an ominous warning about how the league would respond: "If this works, enjoy it," he said, "'cause I gotta think they'll have a trick up their sleeve so it'll never happen again."

It turned out the old-school hockey guys may have been onto something. A bunch of "computer geeks" were, in fact, driving the "Vote for Rory" campaign. And the NHL did have a trick up its sleeve to undermine the popular vote.

The YouTube videos and the "Vote for Rory" signs that started popping up at NHL arenas attest to the genuine support hockey fans gave Rory Fitzpatrick. But the campaign really took off because his supporters appeared to have figured out how to cheat the system.

The NHL's All-Star voting this year was carried out exclusively via unlimited online balloting. Anyone could vote for any player as many times as they wanted, so long as they took the time to fill out the entire ballot. By the end of the third week of voting, a young Vancouver computer programmer named Brad Touesnard had released the "Rory Vote-O-Matic"—a plug-in for the Firefox browser that allowed fans to fill out the ballot automatically. Thousands of times per hour. The campaign's initial organizers, who hung their shingle at VoteForRory.com, disavowed the use of voting bots. Still, the Vote-O-Matic seemed to have an impact. Over the next two weeks, Rory registered an astonishing 285,000 write-in votes; he surged into second place in the voting on Dec. 19—good enough to ensure a starting spot on the All-Star team.

How did the Rory Vote-O-Matic work? According to Touesnard, online security at NHL.com was pathetic. The league tried to counter automated scripts by making voters decipher words embedded in distorted images—a system known as CAPTCHA. But the NHL used only 51 different picture files and each one had a predictable name, like "1.gif." All the Rory hackers had to do was create a table that linked up each file name with the appropriate pass phrase. Touesnard coded up the Vote-O-Matic in just a few hours.

It would have been easy for the league to implement a better system. A script that generated filenames on the fly for each distorted image would have flummoxed the Vote-O-Matic. Instead, the NHL programmers tried to patch their system with quick fixes. Touesenard says they first put in a time delay to the voting, and then they added more pass phrases and renamed the picture files. The league stepped up its efforts in the final two weeks—by the time the voting was over, Rory hackers had discovered about 12,000 security files on the league server. But nothing stopped them for long; according to the comments on the Vote-O-Matic Web site, the plug-in worked until the very end.

Click here to open the graphWeek-to-week voting totals for Rory Fitzpatrick and the two defensemen who finished ahead of him.
The press had fallen in love with the Rory campaign, and no one seemed to notice when the Globe and Mail broke the Vote-O-Matic story on Dec. 20. Now the league's inability to stop the Vote-o-Matic (and other automated scripts) placed it in an awkward position. In public, the Bettman crew signed on with the Rory campaign. "It's good that a lot of people are having fun with it," announced a league spokesman. "This story underscores the respect we have for our fans' passion." But something else seemed to be going on behind the scenes. The next round of voting results were a bit surprising. Despite all the news coverage—and all the efforts of the Vote-O-Matic—Fitzpatrick's vote totals had fallen off a cliff. After receiving 285,000 votes the two previous weeks, he got just 58,000 in the week ending on Dec. 26 and dropped to third place in the standings. Had the Vote for Rory campaign run out of steam? Or did the NHL brass decide it was time to take matters into their own hands?

Click here to open the graphWeek-to-week disparity in votes between Eastern and Western Conference defensemen.
I believe the evidence suggests the NHL cooked the books. Since the league counted only ballots that were entirely filled in, there should have been an equal number of votes cast for hockey's two conferences. But for the week after Christmas, players in the Eastern Conference received 6 percent more votes than those in Fitzpatrick's Western Conference. Among defensemen, the results were even more skewed: The guys in the West—Rory among them—got 16 percent fewer votes overall. (These discrepancies were about three times bigger than any that had come before.) As bloggers were quick to point out, the numbers were exactly what you'd expect to see if the league had manually dumped 100,000 Rory votes. Nothing has been proved, but I'm hard-pressed to come up with another reasonable explanation.

If the league did toss out votes, it could have done so with a lot more subtlety. For example, it might have eliminated the votes of every player who was listed on each of the Rory ballots. That would have reduced the totals by equal numbers in both conferences, making the subterfuge undetectable. But the vote count released by the NHL suggests a more ham-fisted approach. The Rory fans were furious.

Click here to open the graphWeek-to-week voting totals for players from the San Jose Sharks.
League apologists might point out that automated voting was against the rules, and Rory didn't deserve to win anyway. But why should we assume that the Vote-O-Matic was the only voting hack out there? A sudden, extremely suspicious spike in votes for players from the San Jose Sharks seems to have propelled undeserving forward Jonathan Cheechoo* into the starting lineup. (He's currently ranked 37th in his conference for scoring.) Rory's teammate Roberto Luongo, who almost certainly benefited from the Vote-O-Matic, will also be an All-Star starter. Given how the voting system was set up, I'd bet that many more players were the beneficiaries of large-scale fraud.

This sort of thing is nothing new. Fans have been stuffing All-Star ballot boxes and electing ne'er-do-wells for as long as they've been asked to vote. In 1957, the commissioner of baseball had to step in when Cincinnati Reds fans managed to elect most of the team's starting lineup at the expense of players like Willie Mays and Hank Aaron. The introduction of online voting made cheating even easier: A Boston computer programmer famously hacked Major League Baseball's on-line system* to push Nomar Garciaparra ahead of Derek Jeter in 1999. And the hockey fans in San Jose—i.e., the ones who live in Silicon Valley—have been notorious for gaming online voting in years past. Even the fan poll for this year's Hobey Baker award—that's hockey's version of the Heisman Trophy—had to be reset as a result of automated scripts. (The NHL probably should have learned a lesson from its bush-league counterpart and reset the voting when they realized there was a problem.)

In spite of everything that's happened, sportswriters have proclaimed the defunct Rory campaign "good for the league." After all, voting for the game was up 740 percent compared to the 2004 contest. (Never mind where all those votes came from.) Some have even gone so far as to suggest the whole thing was orchestrated by the league's viral marketers, who have been pushing a fan-centered brand under the slogan "My NHL." But it's hard to imagine how anything positive could come from such a parade of scandalous incompetence.

It's been almost two years since a lockout almost ruined the sport. Now the league has baited, misled, and rejected its fans. The NHL has hit a new low. It's turned the All-Star Game—an event that's supposed to be about giving people what they want—into a repudiation of the game's most loyal supporters.

Corrections, Jan. 19: This piece mistakenly identified San Jose forward Jonathan Cheechoo as Joseph Cheechoo. (Return to the corrected sentence.) The piece also incorrectly identified Major League Baseball's official Web site in 1999 as MLB.com. The URL was majorleaguebaseball.com. (Return to the corrected sentence.)