ONE ENGINEER CAUGHT IT. WHAT IF HE HADN'T?

In 2024, Microsoft engineer Andres Freund noticed something small.

A computer process was running slightly slower than it should.

He investigated.

What he uncovered was enormous.

Malicious code had been deliberately hidden inside XZ Utils, a widely used open-source software component found throughout the Linux ecosystem. The compromised versions could potentially have created a secret pathway into affected computer systems.

One engineer noticed something unusual.

One engineer kept digging.

And a potentially massive cybersecurity incident was exposed.

NOW ASK THE OBVIOUS QUESTION

What if he hadn't noticed?

What if the slowdown had been ignored?

What if the malicious code had remained hidden?

What if millions of systems had simply continued operating while everyone assumed the software was trustworthy?

That is the lesson.

It does not prove that Kawartha Lakes' voting system—or any particular election system—has been compromised.

But it absolutely demonstrates why citizens should never be told that software alone deserves unquestioning trust.

Sophisticated software can contain vulnerabilities.

Updates can introduce problems.

Dependencies can be compromised.

Malicious code can be deliberately concealed.

And sometimes the only reason we discover it is because somebody happens to look closely enough.

ELECTIONS DESERVE A HIGHER STANDARD

When choosing our government, the answer should never simply be:

“Trust the computer.”

The answer should be:

“Verify the result.”

That is why I support giving every municipal voter the option of a physical paper ballot.

A properly secured paper ballot creates something critically important:

EVIDENCE OUTSIDE THE COMPUTER.

If an electronic result is challenged, physical ballots can be secured, inspected and independently recounted.

Canada elects its Parliament using physical ballots.

Ontario elects its Legislature using physical ballots.

Municipal voters deserve the same tangible safeguard.

THIS IS NOT ANTI-TECHNOLOGY

Technology can assist elections.

But technology should never eliminate our ability to independently verify them.

The XZ incident gave us an extraordinary warning.

A sophisticated backdoor entered trusted software.

And one engineer caught it.

WHAT IF HE HADN'T?

ONTARIO MUNICIPALITIES: THIS IS YOUR RESPONSIBILITY

This is bigger than Kawartha Lakes.

Every municipal council, every municipal clerk, every candidate and every Ontario voter should be asking the same question:

WHY ARE WE REMOVING THE PHYSICAL BALLOT INSTEAD OF STRENGTHENING IT?

Municipalities should not wait for a cybersecurity disaster, disputed election or system failure before recognizing the value of physical evidence.

Act before there is a problem.

Councils across Ontario should publicly demand that the Province restore and protect a physical paper ballot option for municipal voters.

Candidates should be asked directly:

WILL YOU SUPPORT THE RIGHT TO VOTE ON A PHYSICAL PAPER BALLOT?

Residents should contact their Mayor, Councillors, municipal Clerk, MPP and the Ontario government and demand action.

Do not accept silence.

Do not accept, “The system is secure.”

Ask instead:

Can I physically verify my vote?

Can it be independently recounted without relying upon the same electronic system being questioned?

Will you give me the choice of a paper ballot?

Ontario's municipalities should stand together and demand that this safeguard be restored.

THE TIME TO FIX THIS IS BEFORE THE ELECTION - NOT AFTER IT.

PAPER BALLOT.

PHYSICAL RECORD.

INDEPENDENT RECOUNT.

VOTER CHOICE.

TO ONTARIO'S MUNICIPALITIES:

GIVE THE PEOPLE THEIR PAPER BALLOT CHOICE.

Because when democracy is at stake, “trust us” is not good enough.

Give the people something they can verify.

Sources:

The Hindu — Microsoft employee discovered backdoor in open-source software

Andres Freund's original security disclosure ·

Red Hat — CVE-2024-3094 technical description

Red Hat — response to the XZ security incident