U. computer science professor questions election voting security

Andrew Appel, Eugene Higgins Professor of Computer Science, recently testified before Congress regarding security at the polls. In his testimony, Appel noted key areas of concern — voting machines and voting procedure, in particular — that could impact the validity of the election results.

Appel could not be reached for comment.

In his testimony, Appel noted with regards to voting machines that it is expected that each person’s vote be tallied by a voting machine, and that once the polls close, the net results at each voting center be collected and transmitted up the chain. This current system leaves plenty of room for interference by a third party actor, who could either disrupt the tallying of votes, or discretely shift votes from one candidate to another, potentially shifting the tide of an election, he said.

Appel said that he and many others have demonstrated in the past that voting machines are vulnerable to hacking. While he did not go into the details on how to hack a voting machine, he noted that doing so is as simple as installing new software on the voting machines, and can take as little as seven minutes.

Referencing a hacking attack that targeted hotel chains such as Hyatt several years ago, Appel noted that in theory, swinging the tide of a presidential election could be as easy as committing the petty theft that occurred at Hyatt. The attack on Hyatt bypassed the key card security systems by taking advantage of the facts that the systems stored passcodes in plaintext and that a developer port was left open on the underside of the lock. Anyone with $20 worth of equipment and five minutes of time could make a skeleton key to open any door in any Hyatt hotel using this technology, Appel explained.

Additionally, Appel noted, voting machines are often transported to voting centers days in advance. These locations can include schools, firehouses, churches, and other places not under 24-hour surveillance, where “anyone could gain access to a voting machine for 10 minutes,” Appel said.

For this reason, Appel recommended eliminating touch screen voting systems and using optical-scan paper ballots instead. Under this system, in the event that the validity of the polls is called into question, a physical copy of each vote would have already been collected, allowing for recounts. Appel also recommended a mandatory sampling of said paper votes post-election. Doing so, he said, would not be time consuming, but would be very efficient in auditing for suspicious behavior, which could stem either from direct interference or from bugs in the voting machines.

With regard to voting procedures, Appel warned that in recent years, the system has become overly reliant on technology. In particular, he noted, if information regarding registered voters were stored only online, then an entire voting center could be subject to a denial of service attack, potentially delaying an election.