Author: Andrew Appel

For hundreds of years, New Jersey voters have voted in their local precinct polling places (800 registered voters per precinct), with only a tiny percentage voting absentee. This year, for reasons of public health in the pandemic, all voters will receive a mail-in ballot; a few polling places will be open on November 3rd for…

Many election administrators in U.S. states and counties need to receive and open PDF files from voters. Some of these administrators receive these PDFs as e-mail attachments. These may be filled-out voter registration forms, or even voted ballots from UOCAVA (overseas and military) voters. We all know that malware can lurk in e-mail attachments; how…

The OmniBallot internet voting system from Democracy Live finds surprising new ways to be insecure, in addition to the usual (severe, fatal) insecurities common to all internet voting systems. There’s a very clear scientific consensus that “the Internet should not be used for the return of marked ballots” because “no known technology guarantees the secrecy, security, and…

with Penny Venetis On May 4th, 2020 a press release from mobilevoting.org announced that New Jersey would allow online voting in a dozen school-board elections scheduled for May 12th. On May 11, the Rutgers International Human Rights Clinic filed an emergency motion to stop internet voting in New Jersey. During a conference on May 18 with Superior…

Even before the crisis of COVID-19, which will have severe implications for the conduct of the 2020 elections, the United States faced another elections crisis of legitimacy: Americans can no longer take for granted that election losers will concede a closely fought election after election authorities (or courts) have declared a winner. Along with two…

It is a well understood scientific fact that Internet voting in public elections is not securable: “the Internet should not be used for the return of marked ballots. … [N]o known technology guarantees the secrecy, security, and verifiability of a marked ballot transmitted over the Internet.“ But can legislatures (city councils, county boards, or the…

In my previous posts, I’ve been discussing ballot-level comparison audits, a form of risk-limiting audit. Ballots are imprinted with serial numbers (after they leave the voter’s hands); during the audit, a person must find a particular numbered ballot in a batch of a thousand (more or less). With CCOS (central-count optical scan) this works fine:…

In my previous posts, I’ve been discussing ballot-level comparison audits, a form of risk-limiting audit. Ballots are imprinted with serial numbers (after they leave the voter’s hands); during the audit, a person must find a particular numbered ballot in a batch of a thousand (more or less). If the ballot papers are numbered consecutively, that’s…

In my last article, I posed this puzzle for the reader. We want to do ballot-level comparison audits, a form of RLA (risk-limiting audit) on a precinct-count optical-scan (PCOS) voting system. This requires a serial number printed on every ballot, linked with an entry in the cast-vote-record (CVR) file. The standard method is to pick…

Special bonus: This article contains two puzzles for the reader, marked in green. Try to solve them yourself before reading the solutions in a future post! In my last post I described a particularly efficient kind of risk-limiting audit (RLA) of election results: ballot-level comparison audits, which rely on a unique serial number on every…

All voting machines these days are computers, and any voting machine that is a computer can be hacked to cheat. The widely accepted solution is to use voting machines to count paper ballots, and do Risk-Limiting Audits: random-sample inspections of those paper ballots to ensure (with a guaranteed level of assurance) that the election outcome…