Crash
2021-07-19 20:47:08 UTC
From Chris Keall, NZ Herald: a long and detailed examination of how
the MIQ booking system works only for bot-users, with a simple
solution available to ameliorate this.
This is an example of Government failure to deliver. Booking an MIQ
slot should not be like this. Minister Hipkins must drive through a
solution to this as it appears the Ministry is not capable of doing
this itself.
==========
Wellingtonian Jonathan Brewer - who has been stuck in Singapore since
March 2020 - wants to be home by Christmas.
The odds look long - and are longer because Brewer has too much
integrity for his own good.
After battling bots (automated software) for a place, Brewer has now
laid a complaint with the Government's top watchdog saying the MIQ
booking site is simply not usable for those who play within the rules.
"I don't think it's possible to get a spot unless you use a bot or pay
someone to do it for you. MBIE seems to think otherwise. So I've
escalated to the Ombudsman," he says.
"I just can't type fast enough to beat the bots," Brewer says.
Earlier this month, Brewer posted a clip to social media (below),
showing 100 attempts to book a quarantine slot via
allocation.miq.govt.nz.
The site displays every date booked solid through to November 30 but
new slots open up at random, on random days, as people cancel, or
fresh booking spots are opened (December dates have yet to be posted).
Around 4000 MIQ rooms (down from 6000 since the transtasman bubble
opened) are allocated on a first-come, first-served basis. Without a
quarantine booking, you will not be allowed on a flight back to NZ.
Brewer documented the same problem that many have complained about on
social media: When a rare slot opens up, it is booked within seconds.
By the time Brewer had tried to click all the traffic lights on the 'I
am not a robot test' and filled in basic details, it was too late. The
date had just simply disappeared or a "This date is now full. Please
try another date."
Sean Gourley, a Canterbury University Physics and Complex Systems PhD
who went on to become a NASA research scientist before founding an AI
startup, divides his time between the US and NZ, and told Brewer's
experience was typical. Gourley's logs showed bookings "happening in
under 750 milliseconds [three-quarters of a second] which is faster
than a human can navigate this UX [user-interface].
"The only way to book a spot to come back to New Zealand is if you pay
$1000 to a third party to employ bots for you," Gourley said.
As reported earlier, people are paying freelancers in Bangladesh to
book a spot, or send them a direct message - at $2 per alert - so they
can scramble to their keyboard when a slot comes free in their chosen
seven-day window.
On social media, people told Brewer to stop being a chump, sitting up
all night using the old-school method of hitting his browser's refresh
button over and over, then trying to type fast enough to beat the
bots.
Why not pay for alerts, or a Bangladeshi bot-wrangler, or pull a
scripting stunt himself, as some returning Kiwis have been doing?
But Brewer wanted everything above board. As a frequent business
traveller, he didn't want to break the law.
So he emailed MBIE, which runs the online MIQ booking system, to ask
about third-party booking services: "Are there any I can use without
violating the system's terms of use? If so, could you help me resolve
my issue by telling me where to go?"
He did not receive a black-and-white answer.
"MBIE does not recommend using any third parties selling their
services to secure a voucher on your behalf as by giving these
organisations your username and password they then have access to all
of your personal details including your full name, date of birth and
passport details," a resolutions manager replied.
"MBIE is not affiliated with any suppliers of these services. There is
also no guarantee that the voucher you are 'purchasing' will be
authentic."
The Ministry suggested that Brewer ask a friend or family member for
assistance.
He replied, "As I explained, I am the most technically skilled member
of my family."
And indeed, Brewer does have more than a smidge of tech-savvy.
After working as a scientific applications developer for Pfizer's
global research and development arm, the University of Kansas graduate
immigrated to New Zealand where, in 2004, he created a fixed-wireless
wholesale broadband provider called Araneo - which was bought by
NZX-listed Team Talk (now Vital).
Today, he works as a telecommunications consultant, ordinarily
dividing his time between Wellington and Singapore.
Of course, "assistance" could also mean roping in someone to
mindlessly hitting the F5 key to refresh, but as Brewer told MBIE, "I
don't have any friends in Singapore who could come to my flat to
operate the site for me.
And apart from anything else, that would appear to be a violation of
the MBIE booking portal's rules.
"Terms of use of the website - in particular 4(b): 'You must keep your
User ID and password secure and: not permit any other person to use
your User ID or password' - prohibit me from sharing my user ID or
password, so I can't provide those details to a friend so they can log
in," he said.
Brewer was after constructive responses from the Ministry.
Why not just ban the use of bots, and the practice of paying someone
to book a spot on your behalf, rather than telling people they are not
recommended?
But if bots remained merely discouraged, and he was officially
prohibited to share his details with third-party booking agencies,
what could Brewer do? He asked the Ministry for advice. When none was
forthcoming, he took his case to the Ombudsman. He was issued a case
booking number - 556535 - a few days ago, which he asked the Herald to
share so others could join his action.
In the meantime, Brewer has a low-tech solution. If the government
can't afford to provide enough MIQ spots, then there should be an
option for those who can afford it, like himself, to pay extra to
cover the cost of an extra room.
And Gourley has publically suggested a simple change, which he says
would make the site workable.
"The simplest change [MBIE] can make to the booking code is to keep
the date open for 10 minutes and let anyone choose the date. Then
randomly select from all those who have clicked on this date within
the 10-minute window," he posted.
"It removes the speed advantage bots have. And Importantly, makes it
accessible to people who can't afford to pay $950 to the black market.
It's a simple code change that you can push out today if you want,
MBIE."
The Herald has asked MBIE and Covid Response Minister Chris Hipkins
for comment.
In a July 12 email to Brewer - which was CC'd to Hipkins - an MBIE
response manager said:
"Improvements have been made to the managed isolation allocation
system as we go and these are happening all the time. Since the system
was introduced over 150,000 returnees have arrived in New Zealand and
we have made improvements to the system such as:
Preventing people booking multiple vouchers;
Putting fixes in place to stop programmes that can secure bulk places
and blocking users with a 'bot' profile;
Releasing batches of vouchers at different times to assist people in
different time zones;
Adding a 'Flights into NZ' tab to assist people with booking flights
that are loaded into the MIAS;
Preventing users from being logged into more than one device at a
time.
"We have no evidence of 'bots' booking vouchers, instead we are aware
of programmes that 'sweep' the system and identify vacancies. However,
they cannot book vouchers due to security features on the site. We
have also actively blocked users who appear to be using automated
systems for booking vouchers."
The response manager reiterated that MBIE recommends against the use
of bots and third-party services.
In late June, as "hacktivists" published MIQ booking scripts to
protest what they called an "unfair" system, Crown cybersecurity
agency Cert NZ issued a warning to New Zealanders against downloading
software from unknown sources.
In the meantime, Gourley says, "New Zealand has designed an MIQ
booking system that can't be accessed by humans clicking on a webpage.
"Unfortunately at this point if you want a place in MIQ, then you have
to use a script. All because the website has been poorly designed as
is easily exploitable by automated processes."
==========
--
Crash McBash
the MIQ booking system works only for bot-users, with a simple
solution available to ameliorate this.
This is an example of Government failure to deliver. Booking an MIQ
slot should not be like this. Minister Hipkins must drive through a
solution to this as it appears the Ministry is not capable of doing
this itself.
==========
Wellingtonian Jonathan Brewer - who has been stuck in Singapore since
March 2020 - wants to be home by Christmas.
The odds look long - and are longer because Brewer has too much
integrity for his own good.
After battling bots (automated software) for a place, Brewer has now
laid a complaint with the Government's top watchdog saying the MIQ
booking site is simply not usable for those who play within the rules.
"I don't think it's possible to get a spot unless you use a bot or pay
someone to do it for you. MBIE seems to think otherwise. So I've
escalated to the Ombudsman," he says.
"I just can't type fast enough to beat the bots," Brewer says.
Earlier this month, Brewer posted a clip to social media (below),
showing 100 attempts to book a quarantine slot via
allocation.miq.govt.nz.
The site displays every date booked solid through to November 30 but
new slots open up at random, on random days, as people cancel, or
fresh booking spots are opened (December dates have yet to be posted).
Around 4000 MIQ rooms (down from 6000 since the transtasman bubble
opened) are allocated on a first-come, first-served basis. Without a
quarantine booking, you will not be allowed on a flight back to NZ.
Brewer documented the same problem that many have complained about on
social media: When a rare slot opens up, it is booked within seconds.
By the time Brewer had tried to click all the traffic lights on the 'I
am not a robot test' and filled in basic details, it was too late. The
date had just simply disappeared or a "This date is now full. Please
try another date."
Sean Gourley, a Canterbury University Physics and Complex Systems PhD
who went on to become a NASA research scientist before founding an AI
startup, divides his time between the US and NZ, and told Brewer's
experience was typical. Gourley's logs showed bookings "happening in
under 750 milliseconds [three-quarters of a second] which is faster
than a human can navigate this UX [user-interface].
"The only way to book a spot to come back to New Zealand is if you pay
$1000 to a third party to employ bots for you," Gourley said.
As reported earlier, people are paying freelancers in Bangladesh to
book a spot, or send them a direct message - at $2 per alert - so they
can scramble to their keyboard when a slot comes free in their chosen
seven-day window.
On social media, people told Brewer to stop being a chump, sitting up
all night using the old-school method of hitting his browser's refresh
button over and over, then trying to type fast enough to beat the
bots.
Why not pay for alerts, or a Bangladeshi bot-wrangler, or pull a
scripting stunt himself, as some returning Kiwis have been doing?
But Brewer wanted everything above board. As a frequent business
traveller, he didn't want to break the law.
So he emailed MBIE, which runs the online MIQ booking system, to ask
about third-party booking services: "Are there any I can use without
violating the system's terms of use? If so, could you help me resolve
my issue by telling me where to go?"
He did not receive a black-and-white answer.
"MBIE does not recommend using any third parties selling their
services to secure a voucher on your behalf as by giving these
organisations your username and password they then have access to all
of your personal details including your full name, date of birth and
passport details," a resolutions manager replied.
"MBIE is not affiliated with any suppliers of these services. There is
also no guarantee that the voucher you are 'purchasing' will be
authentic."
The Ministry suggested that Brewer ask a friend or family member for
assistance.
He replied, "As I explained, I am the most technically skilled member
of my family."
And indeed, Brewer does have more than a smidge of tech-savvy.
After working as a scientific applications developer for Pfizer's
global research and development arm, the University of Kansas graduate
immigrated to New Zealand where, in 2004, he created a fixed-wireless
wholesale broadband provider called Araneo - which was bought by
NZX-listed Team Talk (now Vital).
Today, he works as a telecommunications consultant, ordinarily
dividing his time between Wellington and Singapore.
Of course, "assistance" could also mean roping in someone to
mindlessly hitting the F5 key to refresh, but as Brewer told MBIE, "I
don't have any friends in Singapore who could come to my flat to
operate the site for me.
And apart from anything else, that would appear to be a violation of
the MBIE booking portal's rules.
"Terms of use of the website - in particular 4(b): 'You must keep your
User ID and password secure and: not permit any other person to use
your User ID or password' - prohibit me from sharing my user ID or
password, so I can't provide those details to a friend so they can log
in," he said.
Brewer was after constructive responses from the Ministry.
Why not just ban the use of bots, and the practice of paying someone
to book a spot on your behalf, rather than telling people they are not
recommended?
But if bots remained merely discouraged, and he was officially
prohibited to share his details with third-party booking agencies,
what could Brewer do? He asked the Ministry for advice. When none was
forthcoming, he took his case to the Ombudsman. He was issued a case
booking number - 556535 - a few days ago, which he asked the Herald to
share so others could join his action.
In the meantime, Brewer has a low-tech solution. If the government
can't afford to provide enough MIQ spots, then there should be an
option for those who can afford it, like himself, to pay extra to
cover the cost of an extra room.
And Gourley has publically suggested a simple change, which he says
would make the site workable.
"The simplest change [MBIE] can make to the booking code is to keep
the date open for 10 minutes and let anyone choose the date. Then
randomly select from all those who have clicked on this date within
the 10-minute window," he posted.
"It removes the speed advantage bots have. And Importantly, makes it
accessible to people who can't afford to pay $950 to the black market.
It's a simple code change that you can push out today if you want,
MBIE."
The Herald has asked MBIE and Covid Response Minister Chris Hipkins
for comment.
In a July 12 email to Brewer - which was CC'd to Hipkins - an MBIE
response manager said:
"Improvements have been made to the managed isolation allocation
system as we go and these are happening all the time. Since the system
was introduced over 150,000 returnees have arrived in New Zealand and
we have made improvements to the system such as:
Preventing people booking multiple vouchers;
Putting fixes in place to stop programmes that can secure bulk places
and blocking users with a 'bot' profile;
Releasing batches of vouchers at different times to assist people in
different time zones;
Adding a 'Flights into NZ' tab to assist people with booking flights
that are loaded into the MIAS;
Preventing users from being logged into more than one device at a
time.
"We have no evidence of 'bots' booking vouchers, instead we are aware
of programmes that 'sweep' the system and identify vacancies. However,
they cannot book vouchers due to security features on the site. We
have also actively blocked users who appear to be using automated
systems for booking vouchers."
The response manager reiterated that MBIE recommends against the use
of bots and third-party services.
In late June, as "hacktivists" published MIQ booking scripts to
protest what they called an "unfair" system, Crown cybersecurity
agency Cert NZ issued a warning to New Zealanders against downloading
software from unknown sources.
In the meantime, Gourley says, "New Zealand has designed an MIQ
booking system that can't be accessed by humans clicking on a webpage.
"Unfortunately at this point if you want a place in MIQ, then you have
to use a script. All because the website has been poorly designed as
is easily exploitable by automated processes."
==========
--
Crash McBash