N.J. voting technology in question after discrepancies in February vote

Last Tuesday, a court subpoenaed electronic voting machines used for the primary elections in six New Jersey counties, including Mercer County, questioning the accuracy and security of the machines. Later that day, Sequoia Voting Systems, the company that manufactures the machines, filed a motion to quash the subpoenas, claiming that the subpoenas sought to test their machines under “unknown circumstances and protocols,” which could “unfairly undermine both the reputation of Sequoia’s products and public confidence in election results.”

Two University computer science professors, Andrew Appel ’81 and Ed Felten, have served as expert witnesses in the case, testifying on the security and reliability of Direct Recording Electronic voting machines (DREs), which do not generate any voter-verified paper ballots. Both professors said they had serious doubts about the DREs and cited their own research suggesting that the machines are easy to hack.

The subpoenas were issued for a suit filed in 2004 that alleges that DREs are illegal and unconstitutional. The suit, Gusciora v. McGreevy, claims that New Jersey law explicitly permits the use of paper ballots as well as both mechanical lever-action and optical-scan voting machines, but does not authorize use of DREs. The suit also claims that use of DREs violates the state’s constitution, which requires that each vote in an election be accurately counted.

The suit has been hindered by resistance from Sequoia Voting Systems, the company that manufactures the AVC Advantage machines — a type of DRE — used in New Jersey and threatened Appel and Felten with legal action, the professors said.

Troublesome technology

The controversy surrounding the New Jersey primaries began in March, when a Union County clerk noticed that the number of Democratic and Republican voters recorded by the DRE paper reports generated after the election did not match the number of votes cast in each primary on those machines.

One machine, for example, recorded that its Republican ballot was activated 60 times and its Democratic ballot was activated 362 times. Yet the same report shows that 61 votes had been cast on the machine for Republican candidates and only 361 for Democrats.

“What’s alarming here is not the size of the discrepancy but its nature,” Felten said on his blog freedom-to-tinker.com. “This is a single voting machine, disagreeing with itself about how many Republicans voted on it.”

Felten described the scenario with an analogy. “Imagine your pocket calculator couldn’t make up its mind whether 1+13+40+3+4 was 60 or 61. You’d be pretty alarmed, and you wouldn’t trust your calculator until you were very sure it was fixed. Or you’d get a new calculator,” he said.

In response to these concerns, Sequoia issued a memo blaming these discrepancies on the New Jersey poll workers. The company reported that its machines had 12 possible switches for poll workers to use in selecting the appropriate ballot, some of which were unassigned because fewer than 12 parties competed in the primary. In the memo, Sequoia reported that if the poll worker pressed an unassigned switch by mistake, it could change which party’s ballot was displayed.

Denying machine malfunction, the company explained that when the wrong ballot was brought up by the poll worker, “the voter that was in the voting booth at the time … would have voted the opposite party ballot instead of telling the poll worker that the incorrect ballot was activated,” the memo said.

Sequoia announced on March 28 that it had hired Wyle Laboratories to evaluate and test the voting machine source code used by the New Jersey machines. A preliminary report by Wyle, released on Friday, confirmed Sequoia’s claims that poll worker error could explain the reported discrepancies.

Get the best of the ‘Prince’ delivered straight to your inbox. Subscribe now »

“Sequoia’s explanation involves a voter seeing the wrong party’s ballot being activated, and not complaining about it,” Felten said on his blog. “Assuming (as press accounts say) that the problem happened about sixty times in New Jersey, one would expect that many voters noticed and complained ... Yet there don’t seem to be reports of such behavior.”

Felten later discovered additional discrepancies in the Sequoia machines’ printed reports. One machine counted that it was used by 105 voters but recorded 106 votes, according to its paper summary report. Felten found a similar problem with another record, which showed 167 votes for only 166 voters.

Last Thursday, New Jersey Secretary of State Nina Mitchell-Wells issued a statement asserting that there was “no discrepancy whatsoever” in the final vote and that Felten “rushed to judgment and released a statement that is inaccurate,” due to his misreading of the paper record.

Felten said he was told that, due to printing problems, he read the number 8 as being 9, and that something he read as a 3 was in fact a misprinted 2.

Michelle Shafer, vice president of communications and external affairs at Sequoia, echoed the secretary of state’s claim that Felten “rushed to judgment,” and said in an e-mail that Felten was “exactly the type of reviewer that Sequoia wishes to avoid — one that already has pre-determined the outcome of his investigation before it truly begins.”

Potential for foul play

Both Felten and Appel have serious reservations about the security and accuracy of DRE machines, dating back to well before the New Jersey primary. In an affidavit issued Feb. 7, 2007, Appel explained his experience purchasing and investigating some old DREs to “demonstrate the ease with which Sequoia AVC Advantage DREs can be manipulated to throw an election.”

One of the main arguments in defense of DRE security is that hackers do not have access to the machines for experimentation or hacking, Appel said. He discovered, however, that he was able to easily purchase five AVC Advantage machines for $82 online at govdeals.com, a site that sells government property that is no longer needed.

In February 2007, Appel examined the machines and found them to be “almost identical” to the ones he uses to vote in Mercer County.

Appel reported watching a University student pick the machine’s lock in about seven seconds. Appel then unscrewed the metal panel covering the machine’s internal computer circuit board and found that, contrary to Sequoia’s earlier claims, there were no security seals inside the machine protecting its memory chips.

“The vote-counting firmware can be removed and replaced with fraudulent firmware” because memory chips that count votes “are not soldered onto the circuit board of the DRE,” Appel said in the affidavit. “If I had the inclination to cheat in an election (which I do not) I could prepare a modified version of the firmware that subtly alters votes as the votes are cast, with no indication of the alteration made visible to the voter.”

Appel added that “many tens of thousands” of individuals in this country would have the capability to manipulate the machines if they had brief access to the DREs.

In the days leading up to Super Tuesday this year, Felten stood “conspicuously” for 15 minutes next to several unattended voting machines in Princeton and saw nobody. He posted photographs documenting this on his blog.

"I had ample opportunity to tamper with the machines — but of course I did not,” he said on his blog.

In 2006, Felten also conducted a study showing that he could easily hack into Diebold voting machines and alter the records and vote counters kept by the machines.

Testimony and threats

In March 2008, just a month after the New Jersey primary, Felten said he believed that the state of New Jersey, backed by the state’s Constitutional Officers Association, was going to give him and some of his colleagues a few machines used in the primaries.

Felten said that he and his colleagues were ready to go forward with an investigation of Super Tuesday, when, on March 14, Felten and Appel received an e-mail from Edwin Smith, a vice president of Sequoia Voting Systems.

Smith said that giving the machines to Felten and his colleagues would violate the “established Sequoia licensing Agreement for use of the voting system,” adding that “Sequoia has also retained counsel to stop any infringement of our intellectual properties, including any non-compliant analysis. We will also take appropriate steps to protect against any publication of Sequoia software, its behavior, reports regarding same or any other infringement of our intellectual property.”

A longer, two-page letter was also sent to state authorities, threatening legal action if the state revealed Sequoia technology to the University researchers. Smith called Sequoia’s software a “trade secret.”

On March 18, Union County Clerk Joanne Rajoppi told The Times of Trenton that, on the advice of the county’s lawyers, all plans for independent analysis of the Sequoia machines were being cancelled.

Sequoia Voting Systems

In the summer of 2005, after the Gusciora v. McGreevy case had initially been dismissed in January of that year, then-New Jersey governor Dick Codey signed a bill requiring that all DREs in New Jersey print voter-verified paper ballots. The law said that all machines must be equipped with the VVPAT technology by Jan. 1, 2008.

In the appellate hearing for Gusciora v. McGreevy in fall 2005, the court ruled it would wait to make any further decisions about the case until they could determine the feasibility and costs of meeting the Jan. 1 deadline.

In June 2006, the appellate court vacated the dismissal of Gusciora v. McGreevy. Since then, Sequoia has been granted a one-year extension until January 2009 to equip its New Jersey machines with a VVPAT.

Felten is critical of what he fears may be an ongoing cycle of extensions for Sequoia. “I really do believe that we can’t just keep granting extension after extension into the future,” he said.

He added that he is optimistic about the subpoenas issued last week and thinks they may help counteract the secrecy surrounding voting technology. This will be the first time the state can perform any truly independent investigation of these machines because of the interference of Sequoia in the attempted investigations, Felten said.

In March, before securing the independent review by Wyle Labs, Sequoia hired the independent Kwaidan Consulting to investigate the machines.

Yet the voting website bradblog.com later revealed, in a post titled “This is Who Sequoia Voting Systems Has Chosen to Test Their Machines Instead of Princeton,” that Kwaidan Consulting consisted of one person, Mike Gibbons, whose myspace.com page used to profess his desire to meet “a well endowed blonde nymphomaniac (half my age or take the difference of her bustline and waistline added to her current age) that likes to be under the influence of Jim Beam whiskey in a dimly lit room at least 3 times a week.”

Gibbons’ page was later changed to state that, instead of the blonde nymphomaniac, he would now like to meet “Jesus Christ, Sir Isaac Newton, Albert Einstein and James Clerk Maxwell.”

Slim chances

Appel and Felten, though pleased with the investigative opportunities afforded by the subpoenas, remain skeptical that any changes will be made to New Jersey voting technology before the November 2008 presidential election.

“I think it’s very likely that in November we will use the same system we used on Super Tuesday,” Felten said.