Category: Voting
-
Cheating with paper ballots
In my previous article, I discussed 10 ways that voting machines could cheat, in ballot-marking, ballot-scanning, and ballot tabulating; and I discussed which of these cheats could be caught and corrected during risk-limiting audits and recounts of the paper ballots. In particular, cheat-methods 1, 2, 5, and 7 will be detected/corrected by audits/recounts; methods 3,4,6,8,9,10…
-
Ten ways to make voting machines cheat with plausible deniability
Summary: Voting machines can be hacked; risk-limiting audits of paper ballots can detect incorrect outcomes, whether from hacked voting machines or programming inaccuracies; recounts of paper ballots can correct those outcomes; but some methods for producing paper ballots are more auditable and recountable than others. A now-standard principle of computer-counted public elections is, use a voter-verified…
-
An unverifiability principle for voting machines
In my last three articles I described the ES&S ExpressVote, the Dominion ImageCast Evolution, and the Dominion ImageCast X (in its DRE+VVPAT configuration). There’s something they all have in common: they all violate a certain principle of voter verifiability. Any voting machine whose physical hardware can print votes onto the ballot after the last time…
-
Continuous-roll VVPAT under glass: an idea whose time has passed
States and counties should not adopt DRE+VVPAT voting machines such as the Dominion ImageCast X and the ES&S ExpressVote. Here’s why. Touchscreen voting machines (direct-recording electronic, DRE) cannot be trusted to count votes, because (like any voting computer) a hacker may have installed fraudulent software that steals votes from one candidate and gives them to…
-
Design flaw in Dominion ImageCast Evolution voting machine
The Dominion ImageCast Evolution looks like a pretty good voting machine, but it has a serious design flaw: after you mark your ballot, after you review your ballot, the voting machine can print more votes on it!. Fortunately, this design flaw has been patented by a rival company, ES&S, which sued to prevent Dominion from selling…
-
Serious design flaw in ESS ExpressVote touchscreen: “permission to cheat”
Kansas, Delaware, and New Jersey are in the process of purchasing voting machines with a serious design flaw, and they should reconsider while there is still time! Over the past 15 years, almost all the states have moved away from paperless touchscreen voting systems (DREs) to optical-scan paper ballots. They’ve done so because if a…
-
Securing the Vote — National Academies report
In this November’s election, could a computer hacker, foreign or domestic, alter votes (in the voting machine) or prevent people from voting (by altering voter registrations)? What should we do to protect ourselves? The National Academies of Science, Engineering, and Medicine have released a report, Securing the Vote: Protecting American Democracy about the cybervulnerabilities in U.S. election…
-
Are voting-machine modems truly divorced from the Internet?
(This article is written jointly with my colleague Kyle Jamieson, who specializes in wireless networks.) [See also: The myth of the hacker-proof voting machine] The ES&S model DS200 optical-scan voting machine has a cell-phone modem that it uses to upload election-night results from the voting machine to the “county central” canvassing computer. We know it’s…
-
My testimony before the House Subcommittee on IT
I was invited to testify yesterday before the U.S. House of Representatives Subcommittee on Information Technology, at a hearing entitled “Cybersecurity: Ensuring the Integrity of the Ballot Box.” My written testimony is available here. My 5-minute opening statement went as follows: My name is Andrew Appel. I am Professor of Computer Science at Princeton University. …
-
Which voting machines can be hacked through the Internet?
Over 9000 jurisdictions (counties and states) in the U.S. run elections with a variety of voting machines: optical scanners for paper ballots, and direct-recording “touchscreen” machines. Which ones of them can be hacked to make them cheat, to transfer votes from one candidate to another? The answer: all of them. An attacker with physical access…