EU official proposed covering up wifi portal flaw

He also warned that cancelling the call for proposals – which in the end was what the commission decided to do – could damage the commission's reputation.

On 15 May at 1PM exactly, European municipalities could sign up for an EU-funded voucher, which they could use to pay for the setting up of public wireless internet hotspots, the "WiFi4EU" programme. The vouchers would be distributed on a first-come, first-served basis.

In the first five seconds of the call, 3,500 applications had been registered, and more than 11,000 in the first three hours.

Fatal flaw

However, the contractor which built the application portal included a design flaw. The software did not check the time with the commission's clock, but took the clock of the applicants' computer as reference.

This meant that anyone whose computer's clock was running slow, was prevented from applying at exactly 1PM.

Moreover, those whose clock said it was already 1PM or later - while it was in fact not yet 1PM - were able to apply.

"As a consequence, a potentially significant number of applicants might have a reasonable belief that they applied on time, but did not, in fact, do so according to our central server's clock, which recorded them as too early or too late to win a voucher," Whelan admitted in a document dated 28 May.

It was a note to Luis Romero Requena, director general of the commission's legal service.

The document was released by Whelan's directorate-general for communications networks, content and technology (DG Connect), after an access to documents request from this website.

Parts of the text explaining "two vulnerabilities affecting the WiFi4EU online portal" have been heavily redacted.

However, the commission released, mostly in full, three pages in which Whelan discusses two options: cancelling the call or considering the call valid.

He wrote that two other directorates – the Innovation & Networks Executive Agency and the budget department – did not consider it necessary to cancel the call.

"The consequences of cancelling the call from a reputational point of view are very significant, considering the high expectations raised and the flood of applications, all of which would have to be resubmitted in a subsequent call," said Whelan.

"Moreover, reasons would have to be provided for the cancellation, which would point to - or at least risk raising suspicions about - the robustness of the system and the soundness of the initiative itself, which is still in its pilot phase," he added.

Instead, Whelan suggested that the call could be considered valid, and that those applications which had been received before the commission server's clock struck 1PM, would simply be considered inadmissible. After all, the commission is not responsible synchronising the computers of the applicants, he noted.

"Even if some of them proactively request and then contest their respective time stamps, reputational and fairness risks are arguably manageable as we use an objective criterion," he wrote.

He then went on to argue that the call (which was, in fact, suspended a few hours after it had been opened, after the Commission heard of the problem) should be formally closed immediately – even though it was supposed to be open for a month.

Whelan said that this would reassure municipalities that they would not need to reapply, and also safeguarded the call's success "in terms of number of applicants in very little time".

Marginalising questions

He then went on to say that closing the call early would be a way to avoid tough questions while fixing the problem.

"It eliminates possible criticisms by third parties regarding the continuing flaw in the clock feature of the portal, and gives as much time as needed for the most thorough possible vetting of the data security of the amended portal," said the director.

"The announcement of the call's success and termination due to over-subscription is also likely to marginalise questions about the suspension of the portal over the past few days," said Whelan.

He added that early closure is feasible from a "legal point of view".

He also wrote the measure would be proportionate, because the large number of applications made it "pointless (…) to maintain the fiction that vouchers are still potentially available".

Whelan asked the legal service's confirmation that it did not object to the early closure of the call.

It is not clear whether the legal service replied, but someone in the commission decided that Whelan was wrong.

Fairness

Less than three weeks after his note, the commission published a press statement from digital affairs commission Mariya Gabriel.

"The commission is strongly attached to the principles of fairness, transparency and reliability," Gabriel said.

"Therefore, as this technical issue prevented all municipalities from applying on an equal basis, I have asked my services to cancel this first call. The vouchers from this first round of applications will be added to the budget for the next call".