Finnish Tax Information System Fault on hs.fi

Yesterday, many Finnish citizens and reporters of Yellow Press were enjoying a weird Finnish tradition when last year's tax information was again published. That information reveals how much every citizen earned last year and in this cold country some of us warm themselves up by reading how much money did their neighbours get last year.

Yesterday was also a really cold day and when I saw a link titled "Tax information for over 10.000 wealthy people" of course I had to click on it. Instead of a form where to put in both my neighbours names and my best friends names, I got an ugly error page telling about a Java exception and it revealed that the system was build with Spring and Hibernate frameworks.

Still today I haven't found any news on hs.fi telling what was wrong, but as a J2EE-developer, I must play some guessing game.

Figure 1. Imaginary deployment architecture of Tax Information Service.

Shortly for those who are not familiar with the defined frameworks; Spring is a lightweight J2EE-application framework that uses the dispatcher design pattern to separate the code logic and the user interface. Hibernate is an efficient LGPL-licensed ORM-tool (Object-Relational Mapping) that is based on Data Access Object design pattern. XML-file defines how regular Java-classes are mapped to database and Hibernate deals with complex database logic on various database products.

Whole Enteprise Java as well as both of these frameworks can be considered as well matured technology when comparing to other platforms such as .NET. Still, the J2EE field is so wide that it is easy to do mistakes on design and implementation of J2EE applications, and this can be usually seen when the application crashes already with a small amount of users. My guess is that the hs.fi tax service had an implementation fault that was not visible with a couple of simultaneous test users and the service crashed when a huge number of visitors entered the application. Thus, the service was not scalable.

The idea of software load testing is that it shows if the architectural decisions are working as required and if the user amounts defined in requirements specification are met. From web server logs we could see what are the peak times in the service and based on that, calculate the required processing power for servers and networking devices.

Cheers,

/markus