http://www.nj.com/news/ledger/index.ssf?/base/news-11/1171172999136630.xml&coll=1&thispage=2
The Star-Ledger
A lawyer calls them uncertified. A professor calls them
easy to rig
Sunday, February 11, 2007
BY KEVIN COUGHLIN
Star-Ledger Staff
The electronic voting machines used in most of New Jersey
were never properly inspected as state law demands, according to a new legal
claim filed by voter rights activists. Had the machines been tested, they would
have proved to be a hacker's dream, the activists say.
This week Newark attorney Penny Venetis, representing a
coalition of plaintiffs, will ask a judge in Trenton to decommission machines
used by 18 of the state's 21 counties.
Similar models of the computerized touch-screen machines
made by an Oakland, Calif., company, Sequoia, are currently being tested by a
Princeton University computer scientist, who says they easily could be rigged
to throw an election.
Venetis filed legal papers Friday claiming the state never
certified some 10,000 Sequoia AVC Advantage machines as secure or reliable as
required by law.
"There is zero documentation -- no proof whatsoever --
that any state official has ever reviewed Sequoia machines," Venetis,
co-director of the Rutgers Constitutional Litigation Clinic, said in an
interview. "This means you cannot use them. ... These machines are being
used to count most of the votes in the state without being tested in any way,
shape or form."
If Mercer County Assignment Judge Linda Feinberg agrees with
Venitis to pull the plug on the electronic machines, it will create a giant
headache for state election officials, who already are struggling to meet a
January 2008 deadline to retrofit all voting machines with paper printouts. The
state would have to find a way to recertify or replace them -- or come up with
a lot of pencils and paper ballots -- in time for April school elections.
A spokesman for the state Division of Elections had no
comment.
The problem goes beyond a lack of documentation, according
to Andrew Appel, a Princeton computer science professor.
Appel bought five Sequoia machines for a total of $82 from a
government auction Web site last month. Sold by officials in Buncombe County, N.C.,
after a decade of use, they are virtually identical to the machines Essex
County bought for $8,000 apiece in 2005, Appel said.
For Appel, it was a lucky find. Sequoia and other voting
companies have refused to let academic experts peek inside their proprietary
software and machines. Appel had to submit only minimal personal information
and a cashier's check to close the deal.
A Princeton student picked one machine's lock "in seven
seconds" to access the removable chips containing Sequoia's vote-recording
software, Appel said.
"We can take a version of Sequoia's software program
and modify it to do something different -- like appear to count votes, but
really move them from one candidate to another. And it can be programmed to do
that only on Tuesdays in November, and at any other time. You can't detect
it," Appel said last week.
Citing more than a century in the election business, Sequoia
Voting Systems asserts on its Web site that "our tamperproof products,
including ... the AVC Advantage, are sought after from coast to coast for their
accuracy and reliability."
While promising to look into Appel's claims, Sequoia's
Michelle Shafer asserted that hacking scenarios are unlikely. "It's not
just the equipment. There are people and processes in place in the election
environment to prevent tampering and attempts at tampering," she said.
But Appel said voting machines often are left unattended at
polling places prior to elections. He is confident his students and other
recent buyers of 136 Sequoia machines sold on GovDeals.com -- where bidders
also can find surplus coffins, locomotives and World War I cannons -- will
crack Sequoia's code.
Then, he said, it will be fairly simple for anyone with bad
intentions and a screwdriver to swap Sequoia's memory chips for reprogrammed
ones.
Another Princeton team, led by professor Ed Felten, did
essentially the same thing last fall with a Diebold touch-screen machine,
obtained by secret means. In a demonstration for Congress, Felten rigged an
electronic election so Benedict Arnold beat George Washington every time.
The latest New Jersey legal challenge comes amid a national
backlash against touch-screen machines.
Through the Help America Vote Act, Congress doled out more
than $3 billion -- at least $37million of it to New Jersey -- for new voting
technology after Florida's punch card ballots and their hanging chads marred
the 2000 presidential election.
But computer scientists have warned about potential flaws in
electronic voting machines, which resemble ATMs.
Last week Rep. Rush Holt (D-12th Dist.) reintroduced a bill
to require e-voting machines to include paper printouts. Voters can review
these printouts, and they can be recounted if disputes arise over electronic
tallies.
Warren County is the only place in New Jersey so equipped,
but the state has earmarked $21million to retrofit machines elsewhere.
Without a paper trail, electronic voting machines
"cannot be made secure," the National Institute of Standards and
Technology cautioned last year.
After touch-screen machines apparently failed to record
18,000 votes in a close Florida race last November, that state decided to
replace them with optical scanners before the 2008 presidential election.
Ballots will be cast on paper and scanned electronically. The paper can be
counted manually if there are discrepancies.
New Mexico switched to optical scanners last year.
Connecticut is going that way and New Jersey should, too, said Appel and
Venetis.
THE LAWS
On its Web site, the state Division of Elections says it
certified the Sequoia AVC Advantage in August 1987. But Venetis said state
officials could furnish no proof when she formally requested it.
Venetis said the state has failed to follow its own hoary,
vague laws demanding that voting machines must be "thoroughly tested and
reliable."
They should "correctly register and accurately count
all votes cast" and be "of durable construction" so they may be
used "safely, efficiently, and accurately," the law says.
But the section of New Jersey's Title 19 that outlines the
actual certification process dates to 1953 -- long before computers became
commonplace.
It empowers New Jersey's secretary of state to oversee
examinations of voting machines. Reviews by "an expert in patent law"
and "two mechanical experts" must be completed within 30 days of a
company's application. These experts earn $150 apiece, from a fee paid by the
voting machine company, to file a report with the state.
Precisely what they are supposed to examine, Venetis said,
remains a mystery.
Once approved, a machine can be modified without further
state scrutiny, as long as any changes don't "impair its accuracy,
efficiency, or capacity," the law says.
When Essex County bought 700 AVC Advantages from Sequoia
late in 2005, there was talk about their certification by a federally approved
laboratory -- but no documentation from the state, said Carmine Casciano, the
county superintendent of elections.
"I've never seen anything from the state,"
Casciano said. "I just get a list from the attorney general saying
'Approved.' I've never seen anything from the individuals involved in the
process."
Venetis represents the Coalition for Peace Action and other
plaintiffs in a 3-year-old lawsuit pressing for secure and verifiable
elections. She is expected to make her new argument before Judge Feinberg
Friday.
Venetis also plans to raise concerns about the state's
dependence on Sequoia. Its parent company, the Smartmatic Corp. of Florida, has
been the focus of a federal probe into possible ties to Venezuelan President
Hugo Chávez and has announced plans to sell Sequoia to an American buyer.
Sequoia's Shafer said any sale of the company won't
interfere with its obligations in New Jersey. "Sequoia's not going
anywhere," said Shafer.
Kevin Coughlin may be reached at kcoughlin@starledger.com or
(973) 392-1763.
© 2007 The Star-Ledger. Used by NJ.com with permission.