He did breakthrough work on hacking voting machines. Now he’s beloved by conspiracy trolls

Jeff Pillets | December 7, 2020 | NJ Decides 2020, Politics
Princeton computer scientist Andrew Appel, who helped fuel laws to make voting machines safer, shrugs off misrepresentation by Trump allies
Credit: Princeton University, Office of Engineering Communications, Frank Wojciechowski
Professor Andrew Appel

Editor’s Note: This coverage is made possible through Votebeat, a nonpartisan reporting project covering local election integrity and voting access. The article is available for reprint under the terms of Votebeat’s republishing policy.

For right-wing commentators and conspiracy theorists challenging the 2020 election, it looked like the perfect get: a Princeton University professor who can hack a voting machine in seven minutes flat and flip an election without leaving a trace.

The extraordinary research of computer scientist Andrew Appel helped fuel a wave of new laws that brought safer voting machines to states across the country. He’s appeared before Congress and has been an expert witness in landmark voting cases that led to electoral reform.

Now, his work is being touted by the likes of Sean Hannity and featured in fact-free lawsuits seeking to overthrow the results of the 2020 election. The Trump campaign has gleefully weaponized Appel’s research as well, via misleading, baseless tweets that claim tens of thousands of votes were stolen.

Appel, who chaired Princeton’s computer science department for six years, has published dozens of scholarly papers on arcane cyber topics ranging from “floating point proofs” to “deep specification” and “polymorphic lemmas.” His most recent paper is titled “Abstraction and Subsumption in Modular Verification of C Programs.”

But it is Appel’s exposing the ability to hack paperless voting machines — identical to those still in use across New Jersey — that gets all the attention. In an interview with NJ Spotlight News, the bespectacled and soft-spoken academic appeared more amused than angry when asked about his scholarly work propping up the fantasies of Trump supporters.

“Anyone is free to cite my work,” Appel said in an interview. “The research stands for itself.”

Drawing inaccurate conclusions

But Hannity and others have been sloppy in citing the research, quoting him out of context and drawing false conclusions, Appel said.

On Nov. 13, for example, Hannity’s Fox News program aired a piece promoted as “a deep dive into the voting machines at the center of the controversy.” The segment used an Appel-authored article to back up claims that machines in Michigan and Georgia made by Dominion Voting Systems were flawed and susceptible to hacking.

But Appel says that article was written about a design flaw in an entirely different model of Dominion voting machine. The professor also pointed out that former Trump team attorney Sidney Powell­­­­­ mixed up her voting machines in citing his research.

“Apples and oranges,” he said.

Appel writes about his brush with conservative media, and research on voting machines, in Freedom to Tinker, a blog hosted by Princeton’s Center for Information Technology Policy.

Huge swaths of the blog, which is archived back to 2002, track the efforts of Appel and others to shine light on flaws in New Jersey’s voting technology, which he claims remains among the least secure in the entire country. Even today, Appel said, more than 15 years after it became widely known that New Jersey’s voting machines were vulnerable, there has been little to no improvement.

Risks of paperless voting machines

New Jersey remains one of only four or five states that continue to primarily use so-called “direct recording electronic” voting machines, or DREs, which record votes from a digital touch screen but do not produce any kind of paper trail that can be audited. Most other states use a paper ballot marked directly by voters, which is then scanned in optically.

“The inherent risks of using paperless machines have been known since at least 2003,” Appel said. “Why are they still in use? That’s a great question.”

In a 2004 court case filed by a Mercer County voter who claimed one of the machines discounted her ballot, Appel proved just how easy it was to hack the vote. Using a screwdriver and a $4 computer chip, Appel pried off the back of a voting machine, found the motherboard, and swapped out its chip in about seven minutes.

Credit: J. Alex Halderman
Andrew Appel demonstrating how to hack a voting machine

He programmed his substitute chip with malware that would switch a small percentage of votes from one candidate to another — without a trace. Later, Appel and other researchers showed how seals used to protect voting machines while in storage could easily be broken and replaced.

Appel’s malware program, once installed on a machine, would siphon votes from one candidate to another as long as the machine remained in use.

“Say you just switched 5% of the votes, it would be more than enough to win many close elections,” Appel said.

A new generation of voting machines

Before 2020’s mostly mail-in general election, thousands of those machines remained in all but two or three New Jersey counties. Before the COVID-19 pandemic forced changes to the election, officials in Essex, Warren and Union counties had expected to roll out a new generation of machines that provided some level of a so-called “voter verified” paper trail.

The use of these newer machines made possible the hand recounts and audits in states including Michigan, Pennsylvania, Wisconsin and Georgia that showed there was no widespread voter fraud programmed into the machines.

“Before we used mail-in ballots, that kind of recount would have been impossible in New Jersey,” Appel said.

One bright spot in the Garden State: Essex County. Appel said new machines that could go into use next year will be the only ones in the state to use hand-marked ballots. The machines also cost about $4,000 apiece — $8,000 less than other models that are less secure because ballots are not hand-marked by voters.

Most of the rest of the state will continue to use vintage touch-screen machines now 10 to 15 years old. Officials in New Jersey have no easy explanation when asked why the state has been reluctant to switch. The answer usually comes back to money.

“It would cost $60 to $80 million to buy new machines across the state,” said Alicia D’Alessandro, a spokeswoman for Secretary of State Tahesha Way. “Some counties are doing it. But paying for it is hard.”

Costs of early in-person voting

New Jersey taxpayers may also be asked to pay an estimated $20 million to $30 million next year for the costs of beginning early in-person voting. That would entail establishing large “voting centers” in each county that would open several weeks before Election Day.

It would also mean more new technology: hundreds of electronic “poll books” where voters would sign in. The poll books would be linked via the internet and prevent people from voting twice.

Appel said linking any part of the voting system to the internet presents risks in the age of international hacking. But some risks are worth taking, he said.

“Unlike paperless machines, electronic poll books would be a good thing,” he said. “The internet just comes with the deal.”

We’re in this together
For a better-informed future. Support our nonprofit newsroom.
Donate to NJ Spotlight