J. Alex Halderman ’03

 
This fall Princeton computer science professor Andrew Appel ’81 has been teaching a freshman seminar called “Election Machinery,” about the technology of how we vote and the history of electoral cheating. Appel last offered the course in 2004, which was not only the last time Americans voted for president but also the year he was asked to serve as an expert witness by plaintiffs suing New Jersey over the state’s use of paperless voting machines (plaintiffs say the machines are highly vulnerable to computer hackers). Appel spoke to PAW at the end of September.

Last year, in an Internet auction, you bought five Sequoia voting machines from North Carolina, for a total of $82. What did you learn from examining them?   

When I took them apart, I found where their computer program is stored, and my students and I started reverse-engineering them to figure out how they worked. We concluded it should be possible to design a replacement ROM chip that contains a computer program that looks like it behaves normally, but in fact during elections would steal votes. And to open up the machine and replace the ROM chip would take just a few minutes and would require just a lock pick and a screwdriver.

This is probably a naïve question, but is it likely that people have been trying to tamper with voting machines?

At this point I’d say there’s no evidence that any particular election was hacked this way. But here are all the obstacles to our actually being able to tell: First of all, the losing candidate in a recount has never been able to persuade a judge to let his representatives actually examine the computer programs. This court case in New Jersey, which is not about a particular election, is the first time a judge has ever ordered a computer program inside a voting machine turned over to the plaintiffs in a lawsuit. Two, this kind of vote-stealing is so smooth that a losing candidate may have no particular reason to suspect that the election’s been stolen. If you are going to steal votes this way, you are going to do everything possible to make it not come out to within 1 percent, so nobody will ask for a recount. And three, you just can’t tell from the outside of the box.  

What about paper ballots? After I’ve watched my vote go into a ballot box, is it secure?

Good question. In some places they count paper ballots by hand — which doesn’t work so well in American elections because there are so many different questions on the ballot. But let’s talk about Canada or France. What they tend to do is, at the close of the polls, they open the ballot boxes right there, dump all the ballots out on the table, and count them in the presence of witnesses. You should be able to trust your own party’s representative, but one thing I do in my course is cover the history, and that shows that buying off the other party’s representative is quite common. ... For that reason, people who advocate for a mandatory 1-percent audit are concerned about doing it sooner rather than later and about chain-of-custody issues.

Why haven’t the manufacturers been able to fix these problems?

Well, here’s a system that does work and is already being used by many states: optical-scan forms. You fill in an oval next to the name of your candidate, and right there in the precinct you take your optical-scan form and feed it through the optical scanner, and the computer inside the optical scanner counts your vote — or has been fraudulently hacked to miscount it — and your optical-scan form goes into a sealed ballet box where it can be recounted by hand later. So you saw what was on the paper that you filled out yourself, and it can be recounted by a person who sees what’s on the paper without some computer interpreting it to them.

Should I trust the results this year?

The meltdown that some technologists are worried about is not in the voting machines, but in electronic voter registration. Let me describe what happens in New Jersey and what might happen in every state. You show up at the polling place, and there’s a big book in which you sign your name and someone checks your signature. Some states are now putting into place for this election [a system where] there’s no book, just an electronic touch-screen machine that is connected to a database of every voter in the state. These systems did not work very well six months ago in the various little elections in which they’ve been tried. I’m not even saying this is about deliberate disenfranchisement of some voters by some computer hack. I’m just saying that if that system fails to work well, then you’ll have polling places where people will be enormously delayed in voting, and you’ll have lines around the block and people will have to leave the line to go to work. We’re all hoping that doesn’t happen.


Interview conducted and condensed by Merrell Noden ’78