E-Voting Machines on Trial
posted by Danielle Citron
On Monday, a New Jersey Superior Court wrapped up a fifteen-week trial in Gusciora v. Corzine. There, plaintiffs challenged New Jersey’s use of e-voting machines on the grounds that the machines cannot be trusted to count the votes accurately given how easily they can be hacked. The trial centered on security problems of the state’s 11,000 e-voting machines manufactured by Sequoia Voting Systems. Plaintiffs argued that the machines are vulnerable to physical and digital attacks that could compromise elections. Expert witnesses in the case included Professor Andrew Appel from Princeton University, Dr. Roger Johnston of Argonne National Laboratory, and Professor Wayne Wolf of Georgia Institute of Technology, who testified that vote-stealing software could be installed by attackers without specialized training or expensive equipment. At trial, the experts demonstrated multiple hacks of the machines’ source code and user interface, attacks on the machines’ circuitry, and methods for bypassing New Jersey’s physical security measures.
A few tidbits from Professor Appel helps demonstrate the importance of the judge’s decision and the ramifications of the court’s future findings. As Appel explained, “in 7 minutes you can replace the ROM and make the machine cheat in every future election, and there’s no practical way for the State to detect cheating machines (in part because there’s no voter-verified paper ballot).” For Appel, the course of the inaccuracy is the machines’ vulnerability to hacking. There is no practical means of testing for hacking, and the State of New Jersey does not attempt to test for hacking. Appel also explained that when he examined the State’s machines in July 2008, they had no security seals preventing ROM replacement. He demonstrated on video (which was played by the court at trial) that he could pick the lock, unscrew some screws, and replace the ROM with one that cheats, replaces the screws, and lock the door, all within seven minutes. On cross-examination, the State defendants asked Appel to demonstrate this process in the courtroom, which he did carefully and slowly in 47 minutes. As Appel testified, “someone with more practice (and without a judge and 7 lawyers watching) would do it much faster.”
So what might come of all of this? The court could certainly order local precincts to refrain from using the machines until the security problems have been addressed. It is also possible that such a ruling would influence other jurisdictions currently using the Sequoia machines to rethink their use. Because our electoral federalism leaves ultimate administrative decisions concerning elections to states and local precincts (unless Congress says otherwise under its Elections Clause power), such a finding won’t guarantee any change beyond New Jersey (if even that comes about). Nonetheless, it would provide strong signals about e-voting machines’ security in ways that would be more productive than (my) grumbling from the peanut gallery does.
May 20, 2009 at 4:12 pm
Posted in: Administrative Law, Technology
Print This Post
Responses (1)
Ann - October 31, 2009 at 10:00 am
Your not alone in that peanut gallery….
Voting is not the only thing in question regarding this type of hacking….
Leave a Reply