Investigation into the Unusual Signups
Prepared by the OSMF Membership Working Group
26 December 20181
Steve Friedl (SJFriedl), Guillaume Rischard (Stereo)2

Summary
On 15 November 2018, there was a significant and unusual spike in signups for
OpenStreetMap Foundation (OSMF) memberships: ~100 employees of an outsourcing
company in India completed membership applications within a few hours, raisingconcerns about possible attempts to influence the election3.
The board did not pass a circular resolution that would have rejected these signups.
Independently, the Membership Working Group (MWG)4, whose duties include theadministration of OSMF memberships, undertook an investigation into thecircumstances around this matter.
MWG believes it is reasonable to conclude, based on the available evidence:●

The unusual signups are actual members, not fake identities.

●

This was an orchestrated, directed campaign by the employer, not an organic
response to a public encouraging post.

●

The majority of these members did not sign up voluntarily, personally andindividually.

●

We strongly suspect that the employer paid for these memberships.

●

OSMF is fortunate to have detected this campaign.

●

We do not know the motivations for this campaign.

●

The company is not being truthful to the board or to the public.

These signups raise concerns about possible attempts to influence the board election
on 15 Dec 2018, which was only made impossible by the widely publicised but
incorrect closing date for eligibility for voting.

1

Minor correction to the location of Mapbox offices on 2019-01-14
Primary authors, with extensive help from the wider MWG/OSMF/OSM community
3
19 votes decided the 2017 election, and 100 votes would have been enough to get any of the2017 candidates elected. The 2018 numbers were of course not available when the signups
happened, but 100 votes would have been enough to pick between two candidates for thesecond seat.
4​https://wiki.osmfoundation.org/wiki/Membership_Working_Group
2

1

The authors thank those who have helped us, in particular the Indian community,
whose members provided crucial assistance during our investigation.

Background
The OpenStreetMap Foundation is a non-profit “Company limited by guarantee”
registered in England and Wales, “supporting, but not controlling, the OpenStreetMap
Project”. It is governed by its Articles of Association (AoA), and its members are theultimate authority. OSMF convenes for a general meeting online once a year, where
they elect new members for the board of directors.
Just as the window for eligibility for voting in the 2018 board election was closing, alarge group of OSMF membership applications arrived under suspicious
circumstances.
This issue was detected by MWG member (and then-board candidate) Guillaume
Rischard while analysing member statistics by country. Concerned with this influx,
and after having researched it, he raised the issue5 to the board on 2018-11-20.
The OSMF Articles of Association give the board seven days to reject a newmembership application without cause, and this had been done in 2011 when an
influx of employees of Skobbler, a mapping company, was rejected on this basis6.
In the Skobbler case, no wrongdoing or impropriety was suspected, but this influx of~10% of voting members so late in the election cycle was seen as destabilising, so theboard accepted the applications as of the day after the Annual General Meeting (i.e.,
after the election).
In the current case, a board circular that would have rejected these memberships did
not pass7.
Guillaume contacted the other candidates for the election, and five of the sevenco-signed a letter to the board asking for a statement and a full investigation, andpledging to introduce rules to prevent electoral fraud. The board then issued astatement:
Circular Resolution

There had been a mass signup of 100 new accounts on 15.11.2018 from India,
most coming from one single IP address from a company "well known" to
OpenStreetMap. There had been a larger amount of complaints regardingedits from that company, who provide "mapping services" to other companies.
This circular preliminarily rejects all of those applications and tasks​ ​MWG​ tofurther investigate them. There's a precedence case for similar action with the
Skobbler-case back in 2011.

5

Since Guillaume is under MWG NDA, he has access to information such as the full
membership register (though which all members can request). Because he was then a board
candidate, he raised the issue privately rather than do so publicly.
6​https://lists.openstreetmap.org/pipermail/osmf-talk/2011-August/001139.html
7​https://wiki.osmfoundation.org/wiki/Board/Minutes/2018-12-20​ Ref: “2018/Res12”2

The board posted further information on [osmf-talk]8:

Those in favour argued that given the circumstances under which theregistrations happened, the memberships should be investigated and decided
on later. There is no assumption of ill intent.
Those against argued that the original complaint -- the suspicion that these
newly created accounts were fabricated with ill intent and required further
investigation-- was not supported, and thus did not have a sound legal basis
for delaying membership per our current membership requirements.
All Board members are against the creation of artificial OSMF membershipaccounts.
As a separate but intimately related matter, the board also determined that since theproper cutoff time for voting eligibility was ​prior to 1
​ 5 November, not ​by the end of
15 November (UTC), these and any other members registering on or after this date
are not eligible to vote at the 2018 AGM.
MWG’s duties include the administration of OSMF memberships, and in its 2018-11-26
meeting, voted9 to conduct an investigation into the circumstances of these newsignups.

What was unusual?
It’s common10 to see an increase in OSMF signups in the runup to an election: thewindow closes a month before the election itself, so an uptick in new enrolments isboth expected and welcome.
But the reported influx of members did not match usual patterns of behaviour, andthis raised suspicion.
Observations that caught our eye:●All were Associate members; there’s usually a mix of membership types.

●

All had @gmail.com addresses; we normally see a mix.

●

Almost none provided OSM usernames; this is ​very​ ​unusual.

●

Many (most?) were associated with the IP address of GlobalLogic, an
outsourcing firm in India operating in the OSM/mapping world11.

●

All came in at the last minute in a v​ ery​ concentrated manner.

This was obviously a coordinated effort, but what kind? A legitimate (and innocent)campaign to encourage real mappers to join and support the Foundation? A
fraudulent effort with fake members intended to swing an election? Something else?

8​https://lists.openstreetmap.org/pipermail/osmf-talk/2018-November/005456.html
In favor: Steve Friedl, Guillaume Rischard, Michael Spreng; Abstain: Paul Norman
10​https://www.openstreetmap.org/user/SunCobalt/diary/47107
11
GlobalLogic has previously received complaints to DWG when it worked for Apple and Grab.
93

We undertook to find out.

Early technical findings
The first part of our investigation mainly looked for evidence that supported either acoordinated campaign (as we suspected), or an organic grassroots one (which we
doubted).
In this report, all times are UTC unless otherwise noted.
Graphing the signup times12 in hour groups for several days surrounding 15 Novshows an enormous uptick midday, with 55 in the 10:00 hour UTC, around 2.5 times
higher than any other one-hour period in the history of OSMF recordkeeping in
CiviCRM.

This is an e
​ normous​ outlier that has no likely explanation other than a coordinatedcampaign13. Coordinated campaigns are not necessarily, or even usually, nefarious.
We determined relatively quickly that these all appeared to be real individuals,
rendering the initial concern about possibly fake accounts (thankfully) moot.
Nevertheless, the motivations or possible influence by others remained unknown.
At the beginning of this large influx of members14, a post appeared on the [talk-in]
mailing list encouraging OSMF membership, referencing the (incorrect) 15 Nov
deadline15:
Subject: [Talk-in] OSM Foundation Membership
From: **@gmail.com
Date: Thu Nov 15 07:16:00 UTC 201812

From CiviCRM, the membership management system used by the OSMF
In a graph with a much wider date range, the difference is even more stark.
14
This post appeared shortly ​after t​ wo GlobalLogic managers started the signup that day.
15
​https://lists.openstreetmap.org/pipermail/talk-in/2018-November/003216.html
134

Hi OSM India Community,
This is just a reminder, that the next election for the OSM Foundation board will
be on December 15 according to:https://wiki.openstreetmap.org/wiki/Foundation/AGM18/Election_to_Board
Anyone who wishes to participate in the voting must register as a member of theFoundation by today, November 15 here: https://join.osmfoundation.org/

This is certainly an encouraging post16, but 100 memberships from a mild reminder
sent to a regional mailing list make it one of the most effective campaigns in history,
and OSMF would do well to attempt to replicate it.
The poster is an employee of GlobalLogic, and given that India is at UTC+05:30, thispost appeared at 12:46 local time (around lunchtime).
There was no contact from the company until the board’s statement was published tothe [osmf-talk] mailing list, so one cannot help but wonder whether this was acompany-engineered stealth campaign that was hoping not to get noticed.
After the statement’s publication, the company itself confirmed that they were behindthe coordinated effort in an email to the [talk-in] mailing list by a GlobalLogic
representative:17
Subject: [Talk-in] Thanking SOTM Asia participants and 100+ Sign up for OSMF
From: **@globallogic.com
Date: Mon Dec 3 06:30:14 UTC 2018
Hello OSM India,
I am writing this post with fresh memories from SOTM Asia which I attended
along with 25 members of my team. This was our first time at SOTM Asia & it wassuch a wonderful experience listening to all the great talks & participating inworkshops. We at GlobalLogic are very committed towards building the best mapof OSM and have been coordinating & learning from different OSM communities,
SOTM's are a great platforms to meet communities. We have always encouraged
our team members to participate in OSM community activities and ​happy toannounce 100+ members from our team got registered voluntarily for OSMF
after the encouraging post​ and hope many more of you sign up, too.

(emphasis MWG)

A manager at GlobalLogic is claiming that the 15 Nov encouraging post to [talk-in],made by an employee of GlobalLogic, was responsible for ~100 other employees of
GlobalLogic choosing to register for the OSMF and pay for it themselves. We
understand that the manager also made this claim to the board.
The representative seems to know how many employees signed up.
The author of the original encouraging post and the manager are the only GlobalLogic
members who subscribe to [talk-in]18, at least by any email addresses we are awareof.

16

The company representative later used the term “encouraging post” for this, so we use it
throughout as well, used interchangeably with “call to action”.
17​https://lists.openstreetmap.org/pipermail/talk-in/2018-December/003225.html
18​https://lists.openstreetmap.org/roster/talk-in

5

A number of us noticed the use of the word “voluntary” in the statement, finding it
oddly defensive in an otherwise positive statement, but it’s possible this is due toEnglish not being the writer’s first language.
We further noticed that State of the Map Asia19—which was held 500km from thecompany’s Hyderabad location—ended on 18 November, but this post was made two
weeks later, after the signup had been discussed on the [osmf-talk] list. All of thesemembers registered with OSMF prior to SOTM.
Finally, records show that no members from India have registered for OSMF in the
weeks subsequent to the manager’s 3 Dec post, suggesting limited powers ofmembership appeals on [talk-in].

Who are these members?
A few former Mapbox employees have moved on to GlobalLogic, and are still in touchwith former colleagues. Mapbox is a US firm very active in its contribution to OSM,
and it formerly operated an OSM data team out of Bangalore20.
61 of the new members have email addresses matching those found in the OSM
database, and we expect even more have accounts under other emails (perhaps theircompany email account).
Most have mapped very little. In the six months before the signup, only 31 haveedited at all. Only 7 have more than 10 edits.
One thing about three quarters of the active mappers have in common ishumanitarian mapping in HOT activities21. 15 have done only HOT mapping, in various
activities, mostly in India. 3 have done other things but a majority of HOT mapping, 6
have done a minority of HOT mapping, 7 have mapped but done no HOT mapping at
all. HOT and GlobalLogic client Grab collaborate in Indonesia22.
MWG doubts that a cohort of this kind joined the foundation personally andindividually based on the call for action claimed.
Instead, because the level of mapping activity does not match what we’d expect froma professional mapping group, we have the impression that these email addresses
are associated with secondary or sandbox OSM accounts, not the ones used for theirprimary OSM activity.
All of the sign-ups happened from Gmail addresses.

19​https://stateofthemap.asia
The first version of this report sent to the board on 26 December 2018 incorrectly locatedthe old Mapbox offices in Hyderabad. This was reported and corrected on 14 January 2019.
21
HOT (​https://www.hotosm.org/​) is a humanitarian NGO dedicated to mapping. HOT
Changesets have “#hot[digits]” in the changeset comments, e.g. #hot4986. See
https://gist.github.com/grischard/d3e947fa8e3ccac1a5c327f920a418b5​ for script used..
22​ ttps://qz.com/1481849/grab-southeast-asias-biggest-ride-hailing-firm-is-on-a-mapping-spreehmentions 100 mappers based in India. In private conversations, one GlobalLogic member has
claimed not to be part of or in touch with the Grab team at GlobalLogic.
20

6

We understand that many choose to support the foundation in their personal, nottheir professional capacity, so finding personal email accounts squares with that.
But in our experience, secondary, dedicated or throwaway email addresses often
have names indicating such: we did not see this pattern here.
While Gmail is very popular in India, only 71% (189 out of 263) [talk-in] subscribers
have a Gmail address. We see a wide diversity of email domains in OSMF
memberships. None of the new members signed up with their @globallogic.com
email address, including the manager who later used his work email address to post
to [talk-in]. Why did they all prefer a generic domain name?
In our opinion, this weighs somewhat into the notion that this was a stealth campaign
intended to hide the connections between the members.

A Fortuitous Control GroupWe were fortunate during this research to have noticed that a large group of French
mappers joined OSMF during November, also in response to unrelated encouraging
posts (one from Christine Karch on the [talk-fr] list23 on 12 November followed by one
from Christian Quest24 on the next day), and this gave us an ideal control group for
analysing new-member behaviour.
With two cohorts—.FR and .IN—of about the same size (110 and 101 members,
respectively), we could compare and contrast the circumstances and behaviours ofboth groups. What might this tell us?
Note that MWG cannot determine which of each group was nominally responding to a
campaign: it’s entirely possible that some new members from .FR and .IN are
unrelated to the others and simply happened to sign up during the time of interest.
We note, however, that the GlobalLogic representative has claimed “100+ members”
for this campaign, removing all doubt over that day’s activities for them.
We unfortunately no longer have web server logs that would have provided more
information regarding signups.

23[OSM-talk-fr] rappel concernant l'élection de OSMF board​https://lists.openstreetmap.org/pipermail/talk-fr/2018-November/090979.html
24
48h pour ré-équilibrer la gouvernance de la fondation OpenStreetMap
https://medium.com/@cq94/-906f3f648d27

7

Compare: Responses to Encouraging Posts

Repeating the previous graph showing signups in mid-November, we separately
highlight the .FR signups that were formerly included in the “Other” category, as wellas mark the encouraging posts that called the members to action:
We see a more spiked response in the .IN cohort than in the .FR control group. We
know that the .FR signups are an organic response to the Encouraging Posts. The .IN
group was operating on what it believed was a much tighter deadline, which naturally
leads to a compressed response.
The French campaign had understood the cut-off date correctly, and was racing
against a 48-hour clock itself.
The above graph represents a wider timeline to emphasize the outlier in comparison
to the normal signup baseline, but we can also zoom in a bit to show the responses tothe encouraging posts as their campaigns approached their perceived deadlines:

8Inspect the graph carefully to see the marker for the encouraging post of the second
cohort, as it’s so closely followed by an ​enormous ​number of signups.
This is an unprecedented response to any campaign we have ever heard of.
We understand that the second cohort was facing a tighter signup deadline, but theenormity and immediacy of this response could suggest a ​directed​ response rather
than a c​ oordinated​ one.

Compare: Membership Types
Though there is little practical difference25 in how membership type impacts one’s
day-to-day mapping (or Foundation membership), we expect to see a mix of Normaland Associate member types. The OSMF, of course, welcomes members of whatever
type they choose, the cost to join is the same (£15/year), and no type is “better” thanthe other from MWG or OSMF’s point of view.
We did not see a mix: the .FR group was mostly Normal members with a few
Associate members, but the ​entire ​.IN cohort registered as Associate members:
Group

Normal Members

Associate Members

.IN

0

101

.FR

99

11

A plausible explanation for any skewed ratio is that some call to action linked to a
specific signup page for one membership type, rather than the main
join.osmfoundation.org page that offers a choice between the two.
Indeed: Christian Quest’s post linked to the Normal signup page (intentionally), andthose who reposted his message included that same link. For one reason or another,a few .FR members found their way to the Associate Member page to join OSMF.
One might speculate: could some internal post inside GlobalLogic have inadvertently
linked to the Associate Member page, thereby drawing heightened attention there?
Perhaps, but this does not square with the company’s repeated claim26 that it was the
public post​ (possibly passed around internally) that encouraged these signups, apublic post that linked to the main OSMF page that offered ​both links​.
It is not believable that 101 employees received a call to action by this encouraging
post, one that presented both signup options, but who chose only one. A​ ll of them​.
We would expect at least one person to become a Normal member, even if only
because the Normal member section is first on the page, so this squares far moreeasily with a data entry team entering a data-entry rhythm.
Another possible explanation is that such a data entry team may have minimised thework to be done: since Normal membership requires entry of a residential houseaddress, signing up as an Associate member without entering the address or OSM
nickname requires the least work.
25
26

See ​https://join.osmfoundation.org​ for details
Once in public on talk-in, once privately to the board.

9MWG is confident that it was some other call to action that drove thesesignups, one the company has not been forthright about.

Compare: Members providing OSM
Usernames
When joining the Foundation, the signup form hasa field for the Country, which is required, and one
for the OSM username, which is optional.
Roughly 80% of active OSMF members haveprovided their usernames during signup, andthough the .FR group’s rate of 73% is in line withexperience, the .IN cohort’s vastly smaller 5% is a
substantial outlier.
Group Signups27

With OSM Id% with Id

.IN

101

5

5%

.FR

110

80

73%

Relatively few who are real mappers fail to include their username. It’s too much apart of OpenStreetMap for essentially all of the .IN cohort to leave this out so
uniformly28. We know by matching email addresses that at least 60% have mapper
accounts on openstreetmap.org.
We certainly understand and appreciate that one does not have to be a day-to-day
mapper to support the aims of the Foundation, but it is ​exceptional f​ or 96 out of 101
mappers to not provide their username during signup.
A plausible (​but not innocent​) explanation is a data entry team working from a listthat simply didn’t have the OSM username, or saving time by not entering optional
fields.
MWG believes this behaviour is not consistent with each of these .IN members
performing the signup process voluntarily, individually and personally.

Compare: Time to Complete the Signup Process
Joining OSMF requires creating the account in CiviCRM by following a link at
join.osmfoundation.org, following a payment link to PayPal, then completing theformal signup. The system captures individual activities, each with a timestamp, so we
can observe signup behaviour in a per-member timeline.
For a user with an existing PayPal account, with banking information preconfigured,
we would expect the signup to take only a minute or two, while another without a27

Only successful signups were counted.
We understand that a few members intentionally decline to provide their username foranonymity. We didn’t check whether the .FR members who didn’t provide an username had
OpenStreetMap.org accounts for that email address.
28

10

PayPal account requires more time to enter credit card information, a billing address,
etc.
In any case, this is essentially the placement of an online order, something mostinternet users ought to be familiar with, but we saw substantially different behaviourin the two groups.
For every successful signup, we computed the elapsed time of the transaction fromstart to finish (in minutes), and here we show a graph of what percent of members
were able to complete the signup by that amount of time. This is a cumulative graphworking up to 100% of members having completed their signup.
In the .FR group, 75% of members completed signup in three minutes or less, and all
but one took 8 minutes or less29. We believe this is consistent with normal behaviour:
decide to join, then join. This is reflected in the top red graph line.

The .IN group, on the other hand, took much longer to sign up, with long breaks
between the individual steps (which will be shown later): by the 8 minutes that all .FR
members were able to complete, only a bit more than 50% of the .IN group had doneso; this was far more spread out.
Furthermore, the .IN group had far more difficulties with the payment process30,
having 45 failed payment attempts and 13 abandoned registrations compared to 6
payment failures and 3 abandoned registrations in the control group.
29

A single .FR outlier took 17 hours to complete, with a failed payment right after the start ofthe process and completing the signup the next day. All of us have run into problems with acredit card, an internet connection, or even a crying child that distracted us from an online
order.
30
A new member from India but not with GlobalLogic was able to complete his signup on 15
Nov in two minutes with a single payment attempt.

11MWG believes that these timelines are not consistent with each of these .IN
members performing the signup process voluntarily, individually andpersonally, and paying for their own membership.

Detailed Membership Signup Timeline
Expanding on data represented in the previous graph, we can show the fine detail ofall steps in the signup process for the events of 15 Nov for the cohort in question;these graphs have much detail31 and extensive annotations that require some
explanation, but they provide a telling story.

The Managers / Leads have been confirmed by looking at web presence. Othersignups could be in manager or lead positions that we haven’t identified.
Each horizontal line is a single member signup timeline from start to finish (left toright), and member signup lines are stacked on top of each other to form a
progression throughout the day for all in that cohort: higher lines represent different
individuals who started later.32

31

We are sorry this graph is so terribly busy. Bear with us, we promise it will make sense.
The fact that the first dots of subsequently higher lines form a smooth curve is inherent in
the design of the graph, not a pattern from which suspicion should be drawn, though having
so many sign up in such a short time may well be.
32

12Lines in black completed the process successfully, while those in red did not(“Abandoned Registrations”), and red diamonds indicate intermediate unsuccessful
payments which could have been part of any signup attempt. The stacking represents
118 total member signup attempts, 101 ultimately successful and 17 abandoned.
For example, the lowest line shows a failed payment at 12:05 IST, another at 13:38,
followed by a successful payment/signup at 13:41.
The next line above it had four failed payments prior to successful signup, and theone just above it completed signup quickly with no failures, finishing right at 13:00.
The first five signups were made by GlobalLogic Managers, Leads or Senior Analysts.
We have already noted the difficulty the .IN cohort had with the payment process,which is illustrated here extensively.33
The second thing we noticed was that signups were in batches, with the first starting
about 13:30 IST and the second about 15:30 IST; this is the same graph but with thebatches marked:

33

We have the corresponding detailed graph for signups from the .FR cohort, but it was so
ordinary and had so few anomalies that it did not add anything even remotely useful.

13

It’s possible that these align with the company’s schedule that day: an encouraging
meeting over the lunch hour promoting OSMF membership, then an unrelated
meeting later in the afternoon that kept everybody away from their desks for a time.
But MWG believes it’s more likely that we are seeing the effect of a bulk data entry
project with a small group entering registrations for a large number.

The Lowercase Factor
When looking at the data34, we noticed an unusually large number of members
registering with their person names all in lowercase: ​gerardus mercator​ rather thanthe customary ​Gerardus Mercator​. By itself this is not uncommon35, but it was far
more common than in the control group or in the OSMF community in general.
We did not know if this was reflective of a regional difference or just a coincidence,but overlaying a green triangle marker at the bottom of the graph brought out a clear
pattern:

34
35

For many, many hours.
Even one member of MWG styles his name this way.

14

We believe it is not possible that 20 individuals signing up just after lunch happened
to be the lower-case type, while only one in the afternoon group is: this is too
coincidental.
Important note​: this is not reflecting regional/cultural differences: a​ ll of them​ arefrom the .IN cohort, the vast majority ​from the same company​. It’s almost impossiblethat this is just a coincidence.
MWG is convinced that this is not consistent with each of these members
signing up voluntarily, individually and personally.
The most likely explanation is that one member of the bulk data entry team simply
entered names in lower case while working the first batch, but did not return for thesecond batch.
A far less busy graph of the day’s signups is shown here which demonstrates the clear
pattern of lowercase person names being entered in the first batch, but not in thesecond.

This is a subtle but crucial point: the only plausible explanation for this systematicconcentration of one uncommon mistake is that this was at least partially one agent’s
bulk data entry, not a large inrush of individual signups who were working off a script.

Member Outreach
Concurrent with raw data analysis, MWG reached out to members of both groups
using CiviCRM mailing tools to send this message to all of the new .IN signups at
2018-12-05 1300 UTC:15

Hello [name],
About 100 Indians (including you) became members of the
OpenStreetMap Foundation in November, which more than quintupled
your number. On behalf of the Membership Working Group, welcome,and congratulations on this remarkable and historic growth!
We are delighted with this success, and would like to collect information
to organise membership campaigns in other countries under-represented
in the foundation.
What prompted you to act now?
Have you heard of any membership campaigns before?
How could we encourage more new members to provide their OSM
username in the form?
Was the choice between normal and associate membership well
explained?
Did you find the payment process smooth?
Did you receive the automatic welcome message from the system?
Are there any things that could be improved in our process?
Thank you very much for your comments.
The OpenStreetMap Membership Working Group
Simultaneously, essentially the same message, translated into French36, was sent to
the .FR cohort, all with responses going into OSMF’s email ticketing system.
The French replies were far more numerous, arrived far more quickly (most within
the first 24 hours), and were far more verbose and encouraging. We are thankful forthe constructive answers and suggestions we have received from them that will help
MWG in its everyday work—this killed two birds with one stone even more than we
had hoped37.
MWG received 30 replies:●●●

22 from the .FR cohort
1 from India but known not to be part of GlobalLogic
7 from the .IN cohort probably from GlobalLogic.

The one Indian reply not from GlobalLogic—a mapper for years, and who ​did p​ rovide
his username—was similarly pleasant and communicative.
But the replies from GlobalLogic members were brief, not too chatty, and raised morequestions than they answered:●36
37

All 7 claim the distinction between Associate and Normal membership was
clear.

MWG has at least one native French speaker (Guillaume)
We have other initiatives in mind that involve emailing members in mass

16

●
●
●
●

●

Several claimed to have had payment problems, which matches ourobservations.
Three of the 7 claimed that the JOSM editor’s message-of-the-day on startup
prompted them to join
Not one of the 7 mentioned the [talk-in] post referenced by the GlobalLogic
company representative. The Indian mapper not employed by GlobalLogic did.
In response to the question “How could we encourage more new members toprovide their OSM username in the form?”, six of the seven Global Logic
respondents suggested that the field should be “mandatory38”, while one did
not reply to that question. Only three of the control group mentioned this,each with a lot more detail and discussion, suggesting coached responses tothis mailing by the .IN cohort.
One person claimed that they were “new and recently started editing OSM
data”. Their Linkedin shows that they have been “Manager–OpenStreetMap” atGlobalLogic for 15 months, proudly proclaiming work on OSM, HOT tasks andMissing Maps.

To be fair: the control group received (and replied) in their native language of French,
while the .IN cohort transacted in English39. We believe that not using one’s native
tongue could reduce chattiness (and possibly even responses in general).
Nevertheless, these responses further muddied the waters about the call to action.
The company representative had previously claimed that the [talk-in] post prompted
these signups, but none of the 7 respondents mentioned that, ​including the company
representative himself​.
Furthermore, though it’s certainly possible that any given user could have seen the
JOSM startup message as a call to action, it seems suspicious that a message present
since 6 Nov would invoke a call to action so closely aligned with all these othernominally independent signups in a last-minute rush.
In addition, the JOSM startup page links to the main site that presents both options:again, n​ ot one c​ hose Normal as the membership type.
Furthermore, MWG has been told by multiple sources who wish to remain
anonymous that GlobalLogic employees were ordered to keep quiet about thismatter, which may explain the lack of responses to the survey, as well as the odd
commonality of those responses.
Members of the Indian community who thought the signups were suspicious andprovided us with crucial information were reluctant to speak on the record, which isunderstandable: the mapping world is small, and some are afraid that sharing
information publicly could cost some of them their jobs and careers.
MWG considers the responses from the investigated cohort to be disingenuous.

38

Five times using the word “mandatory”, using the word “compulsory” for the sixth response
received.
39
English is commonly used in India, acting as a bridge between language groups. Higher
education is taught in English, and the [talk-in] mailing list and the India OSM Telegram groupare conducted in English. GlobalLogic advertises jobs in Hyderabad in English, and requires
applicants to pass a written test with questions and answers in English.

17

Conclusions
MWG has put h​ undreds of hours​ into this investigation over the past several weeks
attempting to determine what happened, and going where the evidence took us.
These conclusions are our best collective judgement based on the entirety of theevidence. We actively looked for alternate explanations, including innocent or
exculpatory ones, and abandoned some lines of inquiry where conclusions could not
be supported by more than mere speculation.
A few of these conclusions were informed in part by off-the-record tip-offs and leads,
though we have given them limited probative value (especially where a source might
have an ax to grind), and in no case was any conclusion reached entirely, or evenmostly, based on information whose source we cannot name.
Though one author (Guillaume) was at the time a candidate for the board, most of
this investigation happened after these members had been declared ineligible to vote,rendering the impact on the 2018 election moot.
None of the primary authors has any conflicts of interest regarding the subject of thisreport.
Expanding on the conclusions noted in the summary:

These are actual members, not fake identities
It was initially questioned to the board whether these signups, which appeared at thelast minute, might have been invented identities intended to influence an election. It
did not take MWG long to determine that this was simply not the case; all of thesewere consistent with real identities.

Orchestrated, Directed Campaign by the Employer
We have seen in the control group what an organic response to a campaign looks like,and it seems unbelievable that this encouraging post to the [talk-in] group or the
JOSM startup message prompted this strong of a response in that short a time
window.
Though one can easily imagine somebody forwarding the [talk-in] post to an internal
staff@ email list inviting colleagues to join the Foundation, even with a personalencouragement, the response is far beyond what any voluntary membership
campaign has seen in the history of OSMF.
MWG believes that the company d​ irected​ ​the majority of these memberships.

Members did not sign up voluntarily, individually and personally
One can imagine a company directing its staff to join OSMF, and staff following that
direction with individual and personal (​but perhaps not voluntary​) signups, but we donot believe that’s what happened here.

18

We emphasise that for any bulk registration and payment process, there must be aworkflow, but we have not managed to fully reverse engineer it (having very little
inside information on it).
MWG believes that the consistent lack of OSM usernames, the unanimous selection of
Associate membership, plus the curious lowercase name pattern, mean thatmemberships were largely done centrally by a small team, perhaps with a list of gmail
addresses in hand.
By choosing Associate membership, which requires less information, the data entry
process was faster, and because the department directory didn’t include OSM names,
they were not included (it apparently didn’t occur to anybody that this was
suspicious).
An alternate explanation for the lack of OSM usernames is that they wereintentionally omitted to avoid linking these members together to their employer. We
don’t know, but that would weigh into the disingenuity of the campaign.
Though we believe that some of the payment difficulties were genuine, many others
can be explained by a rush to sign up a lot of employees in a short time with anunfamiliar workflow.

We strongly suspect that the employer paid for these memberships
We investigated whether these memberships had been directly paid by the employer.
Although there are numerous cases where one person has paid for 3–4 others,enough of the members paid for themselves, at least as far as PayPal tells us, that wecannot claim an obvious common paymaster.
MWG can only publish circumstantial evidence that the employer will reimburse
employees, but we have been told privately by more than one person that this will
happen.
We are sceptical that these employees, responding to another employee’s
encouragement to join OSMF, were expected to pay the £15 fee out of their own
pocket. £15 represents a significant portion of even a highly paid employee’s income
in Hyderabad40.
We understand that a company paying for memberships is not against the rules of
OSMF, and some do it openly, but doing so in a clandestine manner makes it aquestion of candour and transparency rather than of finance, especially right aroundan election.

OSMF is fortunate to have detected this campaign
The only reason this was detected is that the company was sloppy about it: by rushingmemberships at the very last minute, the enormous inrush of 100 members strongly
outnumbering the number of average daily active mappers, it invited attention.

Glassdoor shows salaries at GlobalLogic starting at ₹1,38L/y, or about £130/month.
According to private conversations, senior experts earn up to ₹7,2L/y, about £675/month.
40

19None of these employees included their company email addresses, nor their OSM
usernames, the lack of both making it much more difficult to link them as a groupacting in concert.
Had this campaign been done more quietly, starting farther in advance (and ahead ofthe deadline), it’s possible this might have gone unnoticed except for whatever impact
it had on the election.

We do not know the motivations for this campaign
MWG is convinced that this campaign was directed by the employer, but we do notknow why.
Some might speculate that it was merely an innocent but clumsy effort to support theFoundation41.
We understand from various sources that the company privately raised the issue ofbeing allowed to vote with the board s​ everal times​. The issue was also raised privately
by GlobalLogic employees in conversations with MWG. Anecdotally, this has barely, if
at all, come up in casual personal conversations with friends who were also cut off.
One cannot help but reach the conclusion that this has something to do with theelection, and wonder whether these new members might have received direction on
voting​ i​ n addition to direction on m
​ embership​.
To date, we have not uncovered any evidence, even whispers, of what anybody might
have had in mind with respect to board candidates. Employees themselves might notknow either42.

The company is not being truthful
The company has claimed to the public and to the board that this was a voluntary
response to a public email post, but this can hardly be reconciled with our findings:
the company statements do not appear truthful.
These raise serious questions about whether a player in the mapping community is
being sincere about their actions and intentions, and whether this is consistent withgood governance of the OSMF.
MWG has not officially contacted the company about these matters, believing it to be
the responsibility of the OSMF Board.
As we concluded that these last-minute signups were coordinated and that thecompany is not being truthful, and because it insisted on voting several times, wethink that the signups were not innocent.

41

Corporate memberships are available for that.
It would have been possible to reveal the next step (“election instructions”) to employees
once the election was actually under way some weeks later.
42

20

Recommendations
We hope that the community reacts by joining the OSMF, and encouraging othermappers to join, increasing our membership numbers. A wide and diverse
participation of mappers engaged in the OSMF’s mission makes us less vulnerable tovoting blocs of any kind.
MWG understands that remedies for nefarious behaviour are limited, and believes
that any actions against GlobalLogic or its employees and clients are up to the board
and the wider community. These new members were not eligible to vote in the 2018
AGM, and unless they renew again next year, probably won’t be able to vote in
December 2019.
But we do believe this raises concerns that many OSMF members share: can anelection be improperly influenced by a stealth campaign? What would stop a
company from an ​overt​ campaign?

MWG believes that transparency is the ultimate antidote to most governance issues.
Accordingly, we have discussed some ideas for increasing transparency and avoiding
surprises: we are raising them for discussion, not proposing them for adoption. MWG
is not the appropriate body to decide some of these things, and a few proposals
would require changes to the OSMF’s Articles of Association.
●

Requiring affirmative email confirmation of new memberships would make it
more difficult for some other nefarious campaign to enlist its workers without
their active participation.

●

Enable entry of industry affiliation (“Company”) during registration43 andinclude it in existing active-member-list exports. Even if the field is notmandatory, it would allow others to judge the level of transparency andcandour during any future campaign such as this.

●Enact a new policy that OSMF will post a list of who-voted after each election,
allowing the membership to decide for themselves if a company operates avoting bloc (votes themselves would always remain fully secret).

●

Clarify a long time ahead of the next AGM when the exact and proper cut-off
date and time will be.

●

Request/require that companies who pay OSMF registrations for theiremployees disclose this in some place ([osmf-talk]? membership@? board@?
checkbox on registration?)
This would be difficult to enforce other than discovering violations after thefact, but the requirement itself and threat of enforcement (or bad PR) might
be enough to discourage bad actors.

43●

Enable a checkbox in registration so the user ​either​ enters the OSM usernameor​ checks a “[X] Decline to state” box—requiring one or the other makes it anaffirmative choice.

●Verify OSM usernames when they are entered

CiviCRM appears to support this field already, though we have not researched the details.

21●

Allow only verified active mappers to vote and run for the board●

Explicitly forbid vote recommendations by employers, vote coercion, votebuying, turnout buying and/or voter impersonation.

●

Ask the Operations Working Group (OWG) to consider longer logfile retention
for the CiviCRM webserver handling OSMF membership tasks, including new
signups; we believe the current retention is two weeks.

●

We recommend the board reach out to GlobalLogic to establish a dialog,
clarify intentions, and establish a plan to increase transparency of theiractivities in the OSM world, perhaps through corporate membership.

22