Could New Jersey go back to paper ballots? To stop Russian hackers we might have to

Nicholas Pugliese | NorthJersey

It was a discomforting moment recently when a Princeton University computer science professor, in a series of PowerPoint slides, showed lawmakers how he had hacked the type of electronic voting machine most New Jersey counties use to conduct their elections.

More jarring still, the professor, Andrew W. Appel, explained that if he manipulated a machine actually in use, election officials would be hard-pressed to detect it because the devices don’t leave a paper trail that can be checked against the electronic tally.

“They’re a fatally flawed technology,” said Appel, who was previously involved in a lawsuit that sought to end the use of the machines. “Pretty much everyone knows this now.”

And yet New Jersey is one of only about 10 states that still uses that technology — a dangerous arrangement, experts say, in the wake of Russian operatives trying to breach the election infrastructure of at least 20 states during the 2016 election. No results are known to have been altered.

Charlie Stile: What is Murphy doing about NJ's high property taxes? Not much yet

Retail news: NJ to lose three Sears, one Kmart, in latest round of store closings

NJ news: Lawmakers question if sexually abusive teachers avoid punishment

Editorial: NJ voting technology must include paper record

Kirstjen Nielson, head of the U.S. Department of Homeland Security, recently said the inability to verify election results in states like New Jersey is a “national security concern.”

Hacking fears ahead of midterms

The debate in Trenton comes as New Jersey is preparing for primary elections on Tuesday and ahead of November's congressional midterm elections, which will determine whether Republicans maintain control in Washington.

Trump administration officials have already warned the contests will the be the target of additional Russian interference.

Appel was one of a series of experts who appeared before the Assembly State and Local Government Committee on May 23 to urge lawmakers to replace New Jersey’s direct-recording electronic voting machines, or DREs, as soon as possible.

All counties in New Jersey use some model of the touchscreen devices, which critics say are vulnerable to fraud and manipulation. Only in one county, Warren, do the machines create a paper record of each vote.

The better option, several experts said, are optical scan machines that require voters to color in circles next to candidates’ names on a paper ballot, which voters then feed into an electronic scanner. The ballots are stored in a sealed box and can be checked by election officials in the event of an audit or recount.

About 40 states already use optical scan machines in all or most of their precincts, Appel testified, with no state moving away from a paper-based system since 2004.

Two of four county election officials who addressed the committee said that optical scan machines might not be the best fit for every county and asked lawmakers to give them discretion over what systems to adopt.

But all four acknowledged the need for a paper-based system.

“There has to be some sort of voter verified paper trail,” said Michael Harper, clerk of the Hudson County Board of Elections. “We know that. We agree with it.”

Questions of timing and cost

Lawmakers on the committee largely concurred that a change was necessary, although they disagreed over how fast it should happen.

Assemblyman Vincent Mazzeo, D-Atlantic, spoke in favor of a bill he sponsors, A-3991, that would transition all 21 counties to optical scan machines over four years.

But that timeline is too slow for Assemblyman Michael Patrick Carroll, R-Morris, who said he would like to see the new system in place in time for the November general election. He is sponsoring a separate measure, A-1563, that mandates immediate implementation.

“We should do it because it’s important that our elections not be, in any way, shape or form, questioned,” he said.

At this point, however, a November roll-out seems unlikely.

New Jersey is eligible for nearly $10 million in federal grants this year to improve election security. But that is less than the $40 million to $65 million that the New York-based Brennan Center for Justice estimates it will cost to replace New Jersey’s voting equipment, a sum that could be more than lawmakers want to dedicate in one year, if ever.

And when some experts testified that it would be “feasible” to transition to optical scan machines statewide by November, they received pushback from the county election officials in the room.

“The phase-in component is a good one,” Mercer County Clerk Paula Sollami Covello said, endorsing Mazzeo’s plan. “It is tough to get everyone trained and the machines purchased and all the election officials ready in such a short amount of time, by November of this year. That would be very, very aggressive.”

Prioritizing cybersecurity

New Jersey election officials, meanwhile, appear more concerned with cybersecurity than transitioning to a paper-based system.

A spokesman for the New Jersey Department of State declined to comment on the committee testimony, but in a joint statement in April, the department and Office of Homeland Security and Preparedness said they were working with federal officials and other experts “to continuously improve our security posture as the threat landscape evolves.”

They said the statewide voter registration system had been upgraded, with rollout of the enhanced system scheduled for after the June 5 primary election, and that other changes are being made to increase the deterrence and detection of cyber threats.

As for the voting machines themselves, the officials said they are protected by tamper-evident seals and other protocols. Anyone working on the voting machines are required to undergo background checks, and anti-virus software has been installed on all election management computers.

Overall, the officials said, they had “continued confidence” in the security of New Jersey’s elections.

New Jersey gets a ‘D’

But “until New Jersey switches to a statewide paper-based voting system and requires post-election audits, its elections will remain vulnerable,” researchers with the Center for American Progress wrote in a February report on election security.

New Jersey was one of roughly a dozen states to receive a “D” rating in that report, which also stressed the importance of paper-based audits. New Jersey has a post-election audit law on the books but it’s not in use because there are no paper ballots to audit.

"For almost two decades, many NJ election officials have been in denial about the hackability of the voting machines," Appel said in an email last week.

To bring the issue to life for lawmakers last week, Appel demonstrated how someone could alter election results in New Jersey by incorrectly programming the vote-recording cartridges that are inserted into the back of electronic voting machines, as happened in Cumberland County in 2011.

Alternatively, he said, a hacker could place a chip with a vote-stealing program in the back of the machine — assuming the person could gain physical access to it — or use the internet to infiltrate a computer used by election administrators or private contractors to program the cartridges, which could then be corrupted.

By law, New Jersey's voting machines are never connected to the internet. But they could still be vulnerable to hacking, Appel said, if their components are connected, even indirectly.

Mazzeo, whose razor-thin 51-vote electoral victory in 2013 was subject to a month-long recount without the aid of paper ballots, said the current system is "good" but "a better system's out there."

“We must have an assurance that our votes are accurate and legitimate,” he said. “Where is our democracy without an election being validated?”

Email: pugliese@northjersey.com