Pa., N.J., and Del. upgrading voting machines — not in time for midterms

The three states use electronic voting machines that can be hacked, and don’t have a paper trail to facilitate vote audits.

Voting machines at the Office of the City Commissioner's warehouse (Brad Larrison for WHYY)

Voting machines at the Office of the City Commissioner's warehouse (Brad Larrison for WHYY)

In 2016, Russian hackers targeted election systems in the U.S., including Pennsylvania and Delaware. Pennsylvania Gov. Tom Wolf has said there’s no evidence of a breach, but it did get election officials to focus on voting security.

Pennsylvania, New Jersey, and Delaware all have plans to get new voting machines, but not in time for November. In the Keystone State, the Wolf administration has said counties should have these new voting systems ready for the 2020 election.

In the meantime, many election officials say there is no reason to worry about voting machines in the upcoming midterm elections.

“They are not connected to any other source. They plug into the wall for electricity, so there’s no data source that you can get in and pull any information out of it,” said Lisa Deeley, a city commissioner in Philadelphia. “They’re unhackable, they’re like a toaster.”

  • WHYY thanks our sponsors — become a WHYY sponsor

Andrew Appel, a computer science professor at Princeton University, says we shouldn’t be so sure.

“It would really be comforting to be able to say we shouldn’t worry, but these machines are hackable,” he said.  

Appel lists how this could happen:

  • Install vote-stealing software on voting machines
  • Delete voters from voter registrations systems so they can’t vote when they show up at a polling place
  • Change the ballot definition files that need to be loaded into the machines before an election
Andrew Appel demonstrated how he hacked a machine. (Photo courtesy of Andrew Appel and Mike Wood)

In 2008, he even demonstrated how to hack a voting machine in under seven minutes for a New Jersey court, though that was just for one machine.

Montgomery County and Northampton County in Pennsylvania still use that exact same model of voting machine, including for the upcoming midterm election.

Election officials say the kind of hack Appel demonstrated is unrealistic because no hacker would have such unfettered access to voting machines. And presumably, anyone hacking the machines would have to repeat the process for each one.

Elaine Manlove, state election commissioner in Delaware, points out: “No one gets into it in the polling place or in the warehouse before it leaves … We have physical protection against things like that.”

But again, opening a machine is just one way of influencing an election.

This July, Deputy Attorney General Rod Rosenstein announced an indictment against Russian intelligence officers for several things: hacking the website of a state election board, stealing information about 500 thousand voters, hacking into a company that supplies voter registration software, and targeting state and local election offices.

So voting systems have already been targeted by hackers.

Appel at Princeton says anything that involves a computer could be hacked, so the most cutting-edge way of making sure elections are safe is voting on bits of paper that humans can count.

“We need to make sure that whatever piece of paper the voters saw with their votes on it, or marked, even better, is the one that’s a ballot of record for recount,” Appel said.

He says it’s fine to let computers do the counting, but many are pushing for paper records for each individual vote.

Dwight Shellman, an election official at the Colorado Secretary of State’s office, says he’s more confident in paper.

“Paper can’t be hacked, at least in a way that a computer can,” he said.

Colorado is what Appel, and the Department of Homeland Security point to as the place to watch for voting security. Shellman says for the past two elections, he’s had visitors from 20 or 30 states watch to see how they do it.

Colorado has voting machines that produce paper records, and the state also does “risk-limiting audits” after elections.

While it would take too much time and money to count every single paper ballot after an election, you could do a bit of math to figure out how many randomly-selected ballots you would have to count to be 95 percent sure that the computers are giving you the right result.

If election officials think there’s been a hack, Shellman says they can order a drastic remedy, in effect saying, “We no longer trust the machines, we need human beings to count every ballot for this election.”

“We can recover and still provide certified election results that our voters can have confidence in,” he said. “And that will be, if it ever happens, god forbid, that will be the best day of my professional life.”

WHYY is your source for fact-based, in-depth journalism and information. As a nonprofit organization, we rely on financial support from readers like you. Please give today.

Want a digest of WHYY’s programs, events & stories? Sign up for our weekly newsletter.

Together we can reach 100% of WHYY’s fiscal year goal