Photo: Getty
Last year, Canada introduced a new lottery system used to extend permanent-resident status to the parents and grandparents of Canadian citizens. The process was designed to randomly select applicants in order to make the process fairer than the old first-come, first-served system. There’s just one problem: the software used to run the lottery isn’t actually random.
The Globe and Mail reported the Immigration, Refugees and Citizenship Canada (IRCC) uses Microsoft Excel to run the immigration lottery to select 10,000 people for permanent resident status from a field of about 100,000 applications received each year. Experts warned that the random number generating function in Excel isn’t actually random and may put some applicants at a disadvantage.
First, it’s best to understand just how the lottery system works. An Access to Information request filed by The Globe and Mail shows that IRCC inputs the application number for every person entering the lottery into Excel, then assigns them a random number to each using a variation of the program’s RAND command. They then sort the list from smallest to largest based on the random number assigned and take the first 10,000 applications with the lowest numbers.
The system puts a lot of faith in Excel’s random function, which it might not deserve. According to Université de Montréal computer science professor Pierre L’Ecuyer, Excel is “very bad” at generating random numbers because it relies on an old generator that is out of date. He also warned that Excel doesn’t pass statistical tests and is less random than it appears, which means some people in the lottery may actually have a lower chance of being selected than others.
Here’s how the issue manifests, per The Globe and Mail:
Excel uses pseudo-random number generators, a class of algorithms that rely on formulas to generate numbers. These generators have a key flaw — they rely on a “seed” number to kick off the mathematical process. In the case of Excel, this seed is generated automatically by the application. “If you know one number at one step,” Prof. L’Ecuyer explained, “you can compute all the numbers that will follow.”
Because most random number generators use algorithms that produce longer values determined by initial shorter values, most computer processes are considered to be pseudorandom rather than truly random. But Excel has often failed to even produce good pseudorandom results and at times has been so bad that programmers could reverse engineer the results. A team of cryptographers at the University of Haifa in Israel were able to predict the numbers the software would generate by determining the initial values that it is working with.
B.D. McCullough, a professor at the LeBow College of Business at Drexel University, examined Microsoft’s revamped number generator implemented in Excel 2007 and found it lacking as well. “Users of Excel’s ‘rand’ function have been using random numbers from an unknown and undocumented RNG of unknown period that is not known to pass any standard tests of randomness,” he said of the process.
Excel’s random function has improved over time but it’s still considered to be inadequate, especially for a purpose as sensitive as determining a person’s eligibility for permanent resident status. L’Ecuyer told The Globe and Mail the government could use free cryptographic generators that are available online and it would produce fairer outcomes than Excel. “Anything would be better,” he said.
It would take some knowledge of the program and effort to manipulate Excel in order to favour certain applicants, but the possibility exists. That should be enough to convince the government to pursue other options, but IRCC seems satisfied with its current Excel-based system.
“We stand by this randomised selection process as a sufficient means of equal opportunity for all who look to express an interest in sponsoring their parents and grandparents,” a spokesperson for IRCC said in a statement to The Globe and Mail. The agency also said there is no indication the system has been manipulated and, just like Excel’s random number generator, that will have to be good enough.