JesseAtGazette
MaddieAtGazette
AmberAtGazette
AaronAtGazette
CamAtGazette
CherylAtGazette
GloriaAtGazette
JasonAtGazette
JesicaAtGazette
JulianAtGazette
KaitAtGazette
KalAtGazette
NicoleAtGazette
NairaAtGazette
SophiaAtGazette
When Keith Horwood discovered a system hole on the University Students’ Council vote website and decided to investigate, he said he wasn’t thinking about the consequences.

Keith Horwood, a Western alumni, has taken responsibility for the hack.
“I had the memory span of a goldfish, I was thinking about three seconds ahead in the future at any given moment,” he said.
It wasn’t until the changes he had made went public and people started mentioning it on Twitter that he realized the magnitude of his decision. The next day, the votes were deemed invalid and a re-vote was scheduled.
Horwood stressed that the hack didn’t require a lot of finesse or cracking into somebody’s account. He explained it’s a common system vulnerability that shows up in many database sites like the USC vote system, and is fairly easy to fix. All the changes were made using the webpage URL.
“That’s what happened. I’m not magic, I’m not a superhero, I just happened to recognize the vulnerability and knew what to do with it.”
After the hack, Western’s Community Campus Police Service and Information Technology Services started an investigation. Horwood—who conducted the hack while at a friend’s house—said he made the decision to turn himself in after police started to question his friends, who he said were unaware of his actions.
“I just didn’t want to put people through any more BS on my behalf and wait for them to come get me. They’re my friends and the people I’m close to—I didn’t want them to have to go through a bunch of grief,” he said.
First thing Friday morning, he turned himself in to campus police. They didn’t press charges immediately, and the sleep-deprived Horwood went to a friend’s house to catch up on some rest. Looking back, he said he doesn’t necessarily regret the hack.
“I personally am of the belief that you should live life without regrets. We make choices for a reason—maybe you’re not aware of the reason at the time. We’re not perfect human beings, none of us are. That’s my personal belief system.”
Still, he expressed sympathy for those who were affected and inconvenienced by the hack. Caught up in the moment, he said he wasn’t thinking about the damage he could cause, and noted he never recognized the amount of time, energy and money that goes in to the USC elections process. He said he hopes just as many people will turn out to vote in the re-vote.
“I ask that people show respect for the candidates because they were inconvenienced a lot. It would mean a lot to me if people went out and showed the same support.”
A self-employed small business entrepreneur and Western graduate, Horwood said he’s been teaching himself to code since he was 10 years old. He’s never taken a formal course in programming, learning everything he knows on his own. Police have yet to contact Horwood again, but have stated they intend to press criminal charges, which will likely mean a trial and maybe even jail time for Horwood.
But for now, Horwood is humbly awaiting his fate and hopes some good might come of his hack.
“I hope positive change comes from this. It seems like it’s going to. It seems like it already has for the most part,” he said.
“I hope nobody has to be in the position that I was in [...] I don’t think anything like that will happen again.”
USC Vote Hacker to be Charged Criminally
Bill says:
Really hard to see how a trial is “likely”. As long as he’s admitting to doing it, there isn’t much point, and trials are unusual to begin with. He’ll get offered a plea deal – maybe something like probation and a couple thousand dollars in fines, and/or restitution. It’d be a shock if he didn’t take whatever deal they offered him.
Maverick says:
I’m kind of hoping the guy doesn’t get too many charges. He seems like a nice enough guy who just made a bigger mess than he was originally intending. As far as voters go, if their votes change, then their initial votes weren’t really that concrete to begin with.
Melissa says:
Restitution sounds great. As a student, I’m a little upset that my tuition money is, indirectly, going toward fixing this guy’s mistake and extending the campaigns and election process. The security flaw shouldn’t have existed, but neither should the immaturity it took to point out that it did…not to mention the smug manner he communicated through the video.
Dave says:
@Melissa: I absolutely agree. The mere existence of a security flaw does not entitle an attacker to free exploitation of said security flaw. Even after watching his “apology” video, I’m still not sure he understands just how much damage he’s done.
Shane says:
Unfortunately, having gone through a program of higher education is no sure guarantee of maturity. A lot of people get through and pick up a lot of knowledge but just about zero sense. One of the hallmarks of true adulthood is the ability to anticipate consequences rather than go on reacting after the fact and saying “Oops, guess I shouldna done that.” Yuh-huh, guess you shouldna. The prison system is a nasty place to complete your education.
And violating a system is not the best way to help out with it. Passing along information might be a better way to go about it. A good Samaritan doesn’t sock a fella in the guts to let him know he’s not great at self-defense.
John says:
Some people think they’re a lot smarter than they are, what he did was simple and it seems ridiculous that he was saying things like “I’ve been teaching myself to code since I was 10″ Anyone with a modicum of program knowledge can do what he did, in the same situation of boredom. He’s clearly going the humble route to try and lessen charges, and he’s clearly full of regret.
Jihyen says:
It’s better to know that there was a flaw in the voting system rather than letting it slip without anybody noticing it. Who would know how many people could have accessed it and potentially changed it if there were any others that looked in and did things (secretively as some have suggested)? It was a loophole in the system and he turned out to be the one who exposed it. Why charge crime against him? Shouldn’t we be thanking him for noticing the loophole rather than be concerned about the money it will cost for re-election? Truthfully, the school does use a lot of money on many things..
HH says:
Andrew says:
I think all the guy needs is a fine to help pay for some damages; a criminal record can have lasting repercussions on a person’s future. I’d feel pretty bad knowing that this kid has to go to jail for essentially just being a bit of a dumbass; this is a school election, not the end of the world
Sean says:
If there are less votes this time around than the first time, then I honestly have to say good job to the voters who don’t vote. Why vote in the first place if you won’t vote again and again? But of course, we’ll have to wait and see the results of the election next week.
Shane says:
So it seems the guy was actually doing the university a favour by hacking the system and making changes to the site. It let everyone know there was something wrong.
It’s good to that this is the way you should handle this sort of situation. It actually helps me out with a concern that I have.
My neighbour has an alarm system but it’s from one of those kind of shoddy companies that no one has really heard about. I’m just not sure it’s up to snuff. He has a lot of big ticket items in his house and I worry that someone is going to break in and rob him.
For a while now I’ve been agonising over how I should approach him and tell him about my concerns.
Scratch that.
Sometimes he goes away on the weekend. Next time he leaves, I think I’ll break into his place and steal his TV and maybe his DVD player too. That way he’ll find out that his alarm system is substandard and hopefully rectify the situation. And I get to replace my old TV. It’s a real win-win situation. And I mean, ya gotta be a good neighbour.
James says:
If the hacker was truly concerned with the security of the server he could have just approached the USC and informed them of the security flaws. Instead he said “I’m going to show you why murder is bad by shooting this person in the face.”
He is an overgrown child who thought it would be cool to “hack” something, and at his apex he turned out to be a coward. This aptly demonstrates the growing disconnect people seem to have with the internet and “real life”. I guess he needed to learn the hard way that sometimes lulz have real life consequences.
Tony says:
The USC needs someone who will make Western a more valuable institution for students. Maybe think of engraining a sense of academic pride – we are of the best academic schools in Canada, instead of letting us think of being the best party’ers around – or that we offer the newest toys on campus.
The USC presidents are campaigning for bringing in new Dyson AirBlades at the spoke, Cross walks on Western Rd., and making food tokens so people can conveniently eat unhealthy food cheaper. This entire campaign was a joke.
If a $39K position can be jeopardized by someone without a comp sci degree, maybe this hack was more valuable in the long run than the couple thousand dollars in tacky signs, terrible youtube videos, and wasted time by the candidates and students.
liam says:
Your a canadian university.. any charges wont prove a point. You will be electing someone else soon enough because the “winner” wont please most of you. You will also forget all of this in 2 years. Why ruin someones life when they just made a point.
Sedate Me says:
This is the inevitable result of on-line elections. The candidates with the best hackers win.
It may be old fashioned, but nobody can hack into a paper ballot. And, if you can’t bother to waddle over to the nearest polling station, you commitment isn’t worth that much
Initial D says:
Script kiddies gone wild!
A little twink with a feew google-searches worth of database know-how brings down the USC elections, and it makes the national news. If the elections were so important, why did the site use such piss-poor security?
@Tony: Just give the skiddie some ritalin and make him write a big “I’m so sowwy” letter, then let the rest of us get on with our mid-terms. Some of us have more important things to do then get our knickers in a twist over an election which won’t change jacksquat about the university experience aside from whoever makes insipid publicity statements on my behalf as an undergrad.
C says:
RE liam: “electing someone else soon enough”
May I contest the outgoing president’s election?
We now have proof last year’s election was susceptible to digital trickery, and there is precedent for undoing past votes in favour of new votes.
(Instead of rebutting me here, show me the arguments by printing a summary of the minutes from that five hour meeting in which the decision was made to re-run the election.
If the minutes were posted online, I missed them–in which case posting a link here in the comments so I can easily find them would be much appreciated.)