How the league secures the ballot from hacking

Major League Baseball fans could choose a U.S. president and local elected officials, but for 12 seasons, they couldn’t be trusted to set the All-Star Game roster. Cincinnati Redlegs fans committed a form of voter fraud in 1957 when, goaded by media outlets, they gamed the system to stack the deck.

Then-MLB Commissioner Ford Frick was not pleased and he disenfranchised millions.

The right to vote for All-Stars was restored in 1970, ushering in first an era of paper ballots, then a hybrid of paper and online voting, and going fully online in 2015 for the midsummer classic held in, you guessed it, Cincinnati.

Voting rights were at the core of MLB’s decision this year to move the All-Star Game and related events to Denver from Georgia, a state that in late March changed its voting laws in ways that Democrats and the U.S. Department of Justice believe will disproportionately affect Black voters but Republicans defend as fair and an expansion of access.

Comparatively speaking, the All-Star Game vote is low stakes, but MLB, like state governments, changes the process over time to keep ballots accessible and safe from ballot-stuffing.

Sometimes.

“I’d only been … writing software for three years, something like that, so it hadn’t been that long,” said Chris Nandor, who in 1999 hacked the All-Star Game vote. “That kind of tells you it wasn’t that complicated.”

At the beginning

Maybe the best place to start this story is in the Negro Leagues. The first East-West Game — what the Negro Leagues’ All-Star Game was called — took place on Sept. 10, 1933, about two months after the first MLB All-Star Game.

But the precedent the East-West Game set likely had a wider influence: Its first year saw about 1 million votes come in thanks to ballots that were printed in Black newspapers across the country.

MLB initially gave fans the right to vote in 1933 and ’34 (though the league told The Post  “it is unclear how that was handled”) before giving it to the All-Star Game managers until 1947.

Georgetown history professor Chandra Manning said the Negro League’s motivation for fan voting was in part to “democratize emotional investment in the game to ensure … the Negro Leagues don’t lose their shirts on it,” but also so there’d be a high-profile platform for Black talent.

The last East-West Game was in Kansas City in 1962. But MLB marched on, right into the ballot-stuffing conundrum of 1957 and the temporary end of public voting. From 1958 to 1969, managers, coaches and players chose the teams. Commissioner Bowie Kuhn lifted the ban on public voting ahead of the 1970 game, and things were relatively calm until 1999.

In those nascent years of the internet, security was, well, lax. MLB let fans vote up to 22 times online, but didn’t have much in the way of voter ID — no email verification, no captchas.

Nandor was in his mid-20s, and had been working with a general purpose computer programming language called Perl. He said he first wrote a program that would vote frequently during an Evander Holyfield vs. Mike Tyson boxing match (and the undercards).

“It was very remedial in that it would just vote once, wait for a reply from the server, then vote again,” said Nandor, who’s a software developer.

The Boston Red Sox fan said he looked at the All-Star Game voting website, figured his program might work to submit votes for Boston infielder Nomar Garciaparra (who ended up that year with a .357 batting average and 1.022 OPS) and gave it a go. It was successful, so Nandor put it in a loop.

We’re not talking a few votes, it was nearly 40,000. “I let it run for hours and hours,” he said.

MLB said it threw out Nandor’s votes. Garciaparra started the 1999 All-Star Game in Boston anyway, beating out Derek Jeter at shortstop by 20,000 or so votes, according to The Washington Post.

“People have been stuffing the All-Star ballot box forever, and they would just do it with a paper ballot. … that’s why I didn’t think it was a big deal,” Nandor said. “It’s like, ‘Really, you’re gonna care about this?’ Now, granted, it’s on a bigger scale and someone can vote tens of thousands of times without doing much work. But still, it’s always been a joke.”

Starting in 2015, the voting went fully online. On June 8, 2015, MLB.com ran the story “Royals dominating AL All-Star Voting.”

Two weeks later, MLB announced it had thrown out more than 60 million ballots due to concerns of “improper voting,” according to Sports Illustrated. MLB said it was standard practice to scrub votes. Kansas City fans, excited by their team that went on to win the World Series, said they didn’t do anything nefarious. A Detroit SB Nation blogger easily found a way to hack the 2015 ballot.

Validation, voting and integrity

The current fan-voting system dates to 2019, a two-tier, online-only process for position players and the AL designated hitter. Votes can be submitted through MLB.com, the MLB app, team websites and through Google Search (if signed into a valid account). This year, fans could vote five times a day during Phase 1 (which lasted from June 3-24) and once per day during Phase 2 (June 28-July 1).

Major League Baseball told The Post there are several ways it protects the sanctity of the vote. For everything but a Google vote (since that’s a registered account), MLB sends a confirmation email to the voter, and said “votes are not counted when the confirmation email bounces back due to inauthentic email addresses.”

Starting this year, MLB had a partnership with Mastercard NuDetect, which the league said includes a “validation process … to ensure that only real votes from real people are being counted.” NuDetect’s website looks at four categories of data from your computer or phone to check for fraud, including expected IP address, typical typing speed and account history.

The league also said it partners with identity-management company Okta and cloud-computing business Fastly, and has a cybersecurity program that oversees the entire mlb.com universe. In the event ballot-stuffing is detected, MLB said its cybersecurity team would “investigate any anomalies.”

Overall, MLB said it collected 113 million votes between the two phases this year; about 14% of the Phase 1 votes were invalid and 21% of the ballots in Phase 2.

Kent State history professor Leslie Heaphy is skeptical ballot stuffing is even possible when “you can vote every day for a number of times.”

“When you make it a fan vote, haven’t you taken away the need for any kind of veracity anyway? Because it’s all about popularity, it’s not really experts deciding who’s the best player,” said Heaphy, who won the Society for American Baseball Research’s highest award in 2014.

She added: “To me, the integrity of the vote doesn’t really matter.”

MLB said it has made the All-Star Game vote accessible in a couple of ways. People who don’t have access to the internet or newer computers are given a heads up when voting online about what might not work, as well as “tips on how to fix and account for various circumstances.” For the visually impaired, the ballots on the league’s and teams’ websites have an audio captcha.

The voting system is “constantly under evaluation in an effort to provide a meaningful and fan-friendly process,” MLB said.

For Heaphy, the real purpose isn’t fan voting: “It’s all about the fanfare.”