Andrew W. Appel's

Studies of Voting Technology

Andrew Appel

Security Seals on Voting
Machines: A Case Study

      Video demonstration of how to hack a voting machine

The New Jersey Voting-machine Lawsuit
and the AVC Advantage DRE Voting Machine

Some of my work on voting is described on my blog at Freedom-to-Tinker.

Voting-machine lawsuits

Gusciora v. Corzine and Zirkle v. Henry


Research and Public Service

New Jersey Election Cover-up: During the June 2011 New Jersey primary election, something went wrong in Cumberland County, which uses Sequoia AVC Advantage direct-recording electronic voting computers. I served as an expert witness in the resulting lawsuit. From this I learned several things; see the attached report.

  1. New Jersey court-ordered election-security measures have not been effectively implemented.
  2. There is a reason to believe that New Jersey election officials have destroyed evidence in a pending court case, perhaps to cover up the noncompliance with these measures or to cover up irregularities in this election. There is enough evidence of a cover-up that a Superior Court judge has referred the matter to the State prosecutor's office.
  3. Like any DRE voting machine, the AVC Advantage is vulnerable to software-based vote stealing by replacing the internal vote-counting firmware. That kind of fraud probably did not occur in this case. But even without replacing the internal firmware, the AVC Advantage voting machine is vulnerable to the accidental or deliberate swapping of vote-totals between candidates. It is clear that the machine misreported votes in this election, and both technical and procedural safeguards proved ineffective to fully correct the error.

Security Seals On Voting Machines: A Case Study, by Andrew W. Appel. Accepted for publication, ACM Transactions on Information and System Security (TISSEC), 2011.

Abstract: Tamper-evident seals are used by many states' election officials on voting machines and ballot boxes, either to protect the computer and software from fraudulent modification or to protect paper ballots from fraudulent substitution or stuffing. Physical tamper-indicating seals can usually be easily defeated, given they way they are typically made and used; and the effectiveness of seals depends on the protocol for their application and inspection. The legitimacy of our elections may therefore depend on whether a particular state's use of seals is effective to prevent, deter, or detect election fraud. This paper is a case study of the use of seals on voting machines by the State of New Jersey. I conclude that New Jersey's protocols for the use of tamper-evident seals have been not at all effective. I conclude with a discussion of the more general problem of seals in democratic elections.

Analysis of the AVC Advantage DRE voting machine: In July 2008 I led a team of computer scientists in a study of the software and hardware of the Sequoia AVC Advantage. This is in connection with the NJ voting-machines lawsuit.

Summary article:
The New Jersey Voting-machine Lawsuit and the AVC Advantage DRE Voting Machine, by Andrew W. Appel, Maia Ginsburg, Harri Hursti, Brian W. Kernighan, Christopher D. Richards, Gang Tan, and Penny Venetis.
Published in EVT/WOTE'09, Electronic Voting Technology Workshop / Workshop on Trustworthy Elections, August 2009.

Technical reports:

Down for the count, our voting machines remain vulnerable to tampering, op-ed article in the Bergen Record, June 22, 2008. [local copy] Note correction: in the next-to-last paragraph, change "a month later" to "at that time."
Letter to the New Jersey Voting Machine Examining Committee, May 2008.
Effective Audit Policy for Voter-Verified Paper Ballots, by Andrew W. Appel. Presented at 2007 Annual Meeting of the American Political Science Association, Chicago, September 1, 2007.
Earlier version, February 2007.
6300 beads representing the precincts in a New Jersey Governor election; 10% of the beads are blue, representing fraudulent voting machines. A 1% sample (63 beads) is shown; it is extremely likely to include at least one blue bead (in this case the sample has 7 blue beads), and thus the audit will catch some of the fraudulent machines (triggering, in principle, a wider recount and a forensic investigation). 100 marbles representing the precincts of a city mayoral election; 10% of the marbles are blue representing fraudulent voting machines. A 1% sample is shown (one marble); it's unlikely that a 1% sample will include any blue marbles. While a 1% audit works well for statewide races, it does not suffice for local or legislative-district elections. (Photos: Alex Halderman)

Andrew Appel with an AVC Advantage voting machine.  Photo credit: Alex Halderman
How I bought some used voting machines on the Internet

(voting machines as Halloween costumes...)
How to Defeat Rivest's ThreeBallot Voting System, by Andrew W. Appel. October 2006.

Related papers:
The Trouble With Triples: A Critical Review of the Triple Ballot (3ballot) scheme, Part 1 by Charlie Strauss, October 5, 2006.
A Critical Review of the Triple Ballot Voting System. Part 2: Cracking the Triple Ballot Encryption by Charlie Strauss, October 8, 2006.

Ceci n'est pas une urne:
On the Internet vote for the
Assemblée des Français de l'Etranger (click here for the report)

(ici la version fran├žaise)

I testified as an expert witness for the plaintiffs in Gusciora v. McGreevey, a lawsuit in New Jersey state court filed in October 2004. The plaintiffs argued that the use of Direct Recording Electronic (DRE) voting machines without a voter-verified paper ballot is both unconstitutional and illegal in New Jersey.
My testimony before the State Government Committee of the New Jersey State Senate, on the topic of voting machines, May 26, 2005.
I taught a Freshman Seminar on Election Machinery in the Fall semester 2004.