Five days after Donald Trump was elected president, Alex Halderman was on a United Airlines flight from Newark to Los Angeles when he received an urgent email. A respected computer scientist and leading critic of security flaws in America’s voting machines, Halderman was anxious to determine whether there had been foul play during the election. Had machines in Wisconsin or Michigan been hacked? Could faulty software or malfunctioning equipment have skewed the results in Pennsylvania? “Before the election, I had been saying I really, really hope there’s not a hack and that it’s not close,” he says. “Afterwards, I thought, ‘Wait a minute, there’s enough reason here to be concerned.’ ”
Now, wedged into a middle seat on the cross-country flight, Halderman stared in disbelief at the email from Barbara Simons, a fellow computer scientist and security expert. Working with Amy Rao, a Silicon Valley CEO and major Democratic fundraiser, Simons had arranged a conference call with John Podesta, Hillary Clinton’s campaign chair, to make the case for taking a closer look at the election results. Could Halderman be on the call in 15 minutes?
United’s wi-fi system didn’t allow for in-flight phone calls. But Halderman wasn’t fazed. “I’m blocked,” he emailed Simons, “but I can try.”
Within minutes, Halderman had circumvented the wi-fi and established an interface with computers at the University of Michigan, where at 36 he is the youngest full professor in the history of the computer science department. He dialed in to the call but did not speak, afraid of drawing attention to the fact that he was violating the airline’s phone ban.
As he listened in, Podesta came on the line. Simons and Rao—along with David Jefferson, a computer scientist at the Lawrence Livermore National Laboratory—then laid out the reasons that Clinton’s campaign should call for an official review of the election results. The tech experts explained that America’s elections are fundamentally unsound, thanks to a new generation of electronic voting machines and tabulators installed after Florida’s “hanging chads” debacle in 2000. The machines are prone to malfunctions and miscounts, and many have back doors that can enable attackers to alter the outcome by infecting them with malware. The performance of the machines is often verified only by the companies that profit from them, while maintaining the equipment falls to underfunded and under-trained county officials. And because many voting districts create no paper record of electronic votes—more than 80 percent of ballots in Pennsylvania are cast without a paper trail—there is no way to confirm independently whether the tallies are accurate.
To Halderman, the 2016 election seemed like the perfect opportunity to review concerns about America’s voting system. After all, Trump himself had warned that the election was “rigged.” The final vote diverged sharply from the predictions of pre-election polls in a handful of swing states, and the FBI later uncovered evidence that Russian hackers had launched a coordinated effort to defeat Clinton. “If there was ever going to be an election where we should double-check the results,” Halderman says, “this was it.”
Podesta wasn’t entirely convinced. Did the computer scientists, he wanted to know, have reason to believe the election had been turned? Simons, Rao, and Jefferson acknowledged that they had no such evidence, and that a recount would be unlikely to change the result. What was needed, they argued, was a limited “audit” of the results in a handful of voting districts. That way, everyone would know for certain if the outcome could be trusted.
After more than an hour, the call was adjourned with no specific agreement other than for more conversation to follow. For his part, Halderman was encouraged. “My God,” he whispered to his traveling companion on the plane. “Podesta is seriously considering the possibility of a recount. That would be enormous.”
In reality, the call exposed the underlying fault lines that ultimately doomed the recount effort before it even began. For Halderman and his colleagues, reviewing the election results was never intended to put Hillary Clinton in the White House. They were scientists, and they thought like scientists: They wanted to review the ballots to gather evidence and test a hypothesis. To them, the recount was a sort of real-world, live-wire experiment. “This wasn’t about sowing doubts or pushing for any particular outcome,” Halderman says. “It was about proving something about election security.”
The problem, as they would soon discover, was that the Clinton campaign and the courts weren’t interested in science. Before they would authorize a costly and extensive recount, judges and politicians wanted to know if there was any evidence to suggest that such an undertaking was necessary. “We were going to need something pretty concrete,” a high-ranking Clinton aide later told me. “They didn’t have anything to hang a hat the size of this sombrero on.” Within days of the Podesta call, in fact, events would spiral beyond the control of Halderman and the scientists. The measured, impartial audit they envisioned was quickly swept up into a chaotic and high-profile partisan battle—an effort that may have actually wound up undermining the cause of election security.
“It’s bothersome that there are claims made when there does not appear to be evidence, because it tends to undermine people’s confidence in the election,” says Michael Haas, who serves as the top election official in Wisconsin. “We were all surprised by what was motivating the requests for the recount, because we had not seen anything raising red flags. And now, because it went as well as it did, it will probably be much harder for anyone to try to do this again.”
Immediately after the phone call, while he was still in the air, Halderman logged on to a secure online chat service called Slack and created an invite-only channel he named “Voting.” The encrypted conversations, which were obtained by the New Republic, provide a minute-by-minute log of the seven weeks of the recount effort and its aftermath. Halderman deputized Matt Bernhard, one of his doctoral students, as a co-administrator, and the two men began assembling a group of 30 that included some of the world’s foremost computer scientists and statisticians. There were academics from top universities, expert advisers to the Defense Department, and activists who have spent years decrying vulnerabilities in electronic voting machines. None of the participants was a political player or professional partisan. Their goal was not to bring down Trump, but to study and strengthen America’s election system. Some in the group dubbed it the “A-Team.”
From the start, the Slack conversations made clear that the A-Team never wanted to conduct the full statewide recounts that would eventually be pursued in Pennsylvania, Wisconsin, and Michigan. Instead, they preferred what is known as a “risk-limiting audit,” or RLA. Writing in USA Today five days after the Slack channel was created, two members of the A-Team—statistician Philip Stark from the University of California, and cryptographer Ron Rivest from MIT—spelled out the benefits of an RLA. Hand-checking a total of 700,000 ballots in the 29 states won by Trump, they explained, would provide “95 percent confidence that the results are correct.”
At the time, the computer experts were optimistic that Podesta would ultimately sign on, and they focused on preparing for an RLA. The problem was that the A-Team had no idea how to actually go about conducting an audit.
“What would it take to conduct a statewide RLA for a state that is not prepared for it?” Jefferson, the scientist from Lawrence Livermore, asked in Slack on the first day. “How can we select random ballots from across the state when they are held in many separate counties? We would need either the extraordinary cooperation of all county election officials, or a federal court order, no?”
“Are counties even allowed to do this voluntarily?” Halderman asked.
“Good question,” Jefferson replied. He suggested focusing on a single state where turnout was lower than expected, then arguing that the anomaly could have been the result of “technical attacks” on electronic scanners. “This is a technically stretched argument,” he conceded, “but I am looking for an argument a court might buy to justify an audit order.”
“Sounds reasonable,” another expert interjected, “but I’d prefer to focus on what will help technically and let the campaign figure out legal and strategy angles.”
There was also discussion of arranging a security briefing at the White House, Congress, or the Defense Department, to secure their support for an audit. “I reached Podesta via text,” Simons wrote. “He said he’s willing to ask about a security briefing but he’s not optimistic. I asked if perhaps someone higher in government than he might be able to make it happen. (I’m not shy.) He hasn’t responded.” The briefing never happened.
The Slack conversations are filled with technical debates about how to analyze precinct and voting data to identify an anomaly that could be explained only by malfeasance. At one point, the A-Team created a spreadsheet with 20 different ideas for lines of inquiry, involving ten states. “We appear to be having some strange data coming out of Wisconsin,” Bernhard wrote at one point. Trump had outperformed Mitt Romney by nearly 20 percent in some counties, while Clinton underperformed Barack Obama by almost 30 percent. “It could be that these are just swing-y counties,” he allowed, “but those are *huge* swings.”
Discussions also focused on the countless ways someone might execute an election-altering hack. Last summer, the FBI notified election officials in Arizona and Illinois that Russian hackers had infiltrated their voter registration systems, stealing voter data and the username and password of at least one election official. The A-Team theorized that attackers could have used such voter records to cast absentee ballots in swing states. There was precedent for their concern: In 1994, a state Senate race in Pennsylvania was invalidated after Democrats were caught using the names of Puerto Rican residents to cast absentee votes. “So the hypothesis is that someone registered a whole mess of people, and then requested absentee ballots for them,” one scientist said. “That’s certainly possible (absentee ballots are a weak link, especially now that it’s feasible to request them by the truckload via online systems).”
Much of the debate centered on where to conduct the RLA. Members of the A-Team tried to “think like an attacker,” as Halderman put it, to figure out which states they would most likely have targeted. “Who has done the calculations about possible paths for fraud making a difference?” he asked. “What’s the smallest fraud in the smallest number of states that would have flipped the outcome?” Bernhard offered to crunch the numbers, but Stark disagreed with the premise of the question. “I don’t think the ‘minimal path’ is the best question because I don’t think that’s the computation an adversary would do,” Stark wrote. “I’d meddle where it’s hard to find because there’s little or no paper, e.g., PA, and/or where it would be written off to bad election administration, such as FL has had historically.”
Michigan, Wisconsin, and Pennsylvania soon emerged as the prime targets. In falling to Trump, all three had defied both the polls and their own electoral histories. Taken together, they also included enough electoral votes to change the outcome, which made them worth attacking.
Planning for an RLA continued, without much progress, until November 16, when a veteran activist jumped in and hit the A-Team with an overdue dose of reality: No state had laws that allowed for a limited audit. “Doing an RLA is not a THING, not legally and not as a strategy pursued by any of the parties committed to pursuing a recount,” the activist informed the team. “A recount is a process defined by law and carried out by the election officials. It’s not carried out by the third party and the third party has no standing to say, ‘Oh we only want to count the votes like this now.’ There is no path to ask for a recount and do an RLA, please don’t represent to anyone that there is.” The whole idea was a legal nonstarter.
The A-Team had hit a dead end. They couldn’t do an audit, and the Clinton campaign wasn’t going to participate without the kind of evidence that could only be acquired after a recount. Even if the scientists somehow managed to convince a state to conduct a full recount, it would likely cost millions of dollars—a sum far beyond the reach of the A-Team, which was unable to meet its goal of getting 110,000 people to sign an online petition calling for an audit. To make matters worse, in one of the states they wanted to pursue, Wisconsin, only a presidential candidate could call for a recount. And the A-Team had no presidential candidate.
Not, that is, until Jill Stein got involved.
“History came knocking,” Stein later told me. “Who was I to say no to this effort to verify our vote?”
Stein was drawn into the recount effort by John Bonifaz, a Massachusetts attorney who tried and failed to stage a recount in 2004, after George W. Bush narrowly won Ohio. He was also upset by the 2016 election results, and had spoken with Barbara Simons about voting “anomalies.” But he didn’t know about the November 13 phone call with Podesta, nor was he invited to join the Slack channel.
Still, Bonifaz had his own contacts. When a friend pointed out to him that any candidate who could foot the bill was entitled to demand a recount in Michigan and Wisconsin—both of which were so close that their vote totals had yet to be officially announced—Bonifaz went to work to recruit Stein, the Green Party candidate. The narrative that Stein was “simply a puppet for the Clinton campaign is completely false,” says Bonifaz, a recipient of a MacArthur “genius” grant for his legal work on behalf of voting rights. “I took the information that she could do this to her.”
On the same day that Simons and Halderman were on the phone with Podesta, Bonifaz called Stein. He knew it would be better if Clinton led the recount, since her campaign had far more resources, but he also knew Stein would be eager to get involved.
Bonifaz suggested that the effort wouldn’t require much from Stein. “You can take a minimalist role if you want,” she recalls him saying. “If you want to just be the plaintiff of record, you could do that.”
“No,” Stein told him. “If I’m going to do it, I want to come out swinging and really fight on the issues that I think are really important. I’m not just going to be a name.”
Bonifaz didn’t give up on Clinton. On November 16, he spoke with Jake Sullivan, a longtime Clinton adviser. The next day, he was included on another conference call that Simons arranged with Halderman, Podesta, Sullivan, and Marc Elias, the general counsel of the Democratic National Committee. By then it was clear that the campaign was not interested in participating unless a recount would change the election results. “They gave reasons why they saw obstacles,” Bonifaz says, “but I didn’t find any of them convincing.” Halderman, too, was frustrated. “They kept asking us what evidence we had that something had happened, and I kept saying the evidence is in the ballot box.”
Two days later, on November 18, Stein’s name entered the Slack discussion for the first time.
“*Oh boy.* I just had a phone call with an attorney who’s … now representing Jill Stein,” one of the scientists wrote. “He’s keen to go to court and file election challenges in Stein’s name. This could well be the ‘public face’ of the lawsuits that everybody’s been talking about, but it’s also something that’s going to require some coordination.” There was never any debate about whether turning to Stein, a candidate who had received only one percent of the vote and was widely seen as a spoiler, was a good public face for the recount.
Four days later, news of the recount effort broke in New York magazine. Relying on anonymous sources, reporter Gabriel Sherman published a story entitled, “EXPERTS URGE CLINTON CAMPAIGN TO CHALLENGE ELECTION RESULTS IN THREE SWING STATES.” Sherman named Bonifaz and Halderman as leaders of a recount effort that had “found persuasive evidence that results in Wisconsin, Michigan, and Pennsylvania may have been manipulated or hacked.” According to Sherman, the group believed that “Clinton received 7 percent fewer votes in counties that relied on electronic voting machines compared with counties that used optical scanners and paper ballots. Based on this statistical analysis, Clinton may have been denied as many as 30,000 votes; she lost Wisconsin by 27,000.”
The Slack logs show that Halderman and other members of the A-Team believed no such thing. While there was some speculation about possible anomalies in Wisconsin vote totals, no one ever suggested that there was “persuasive evidence” of manipulation. From the start, the argument was only that there were worthwhile reasons to take a closer look. Weeks later, Halderman remained irate. “I’m furious about it,” he said. “I never would have said that.”
The numbers, it turned out, came from Bonifaz. He admits that he spoke to Sherman, but insists that he never mentioned Halderman by name. “The question was presented to me as to what data was being presented,” Bonifaz says. “That was one of the points I made, but I never attributed it to Alex.”
But the damage was done. The message was clear: Computer scientists have evidence that could save the world from Donald Trump! Minutes after Sherman’s piece was posted online, Halderman was besieged by calls and emails from journalists around the world. He quickly stopped listening to them. Only weeks later, after the recount was over, did he discover that he had missed a voicemail from his congresswoman, Representative Debbie Dingell, who had reached out to offer her help. “I would love to hear what you’re willing to share about what you’ve found out,” she told him. “I’m so sorry I didn’t call her back,” Halderman told me. Having a member of Congress on his side might have helped.
The next day, Halderman published a response to Sherman on Medium, entitled, “WANT TO KNOW IF THE ELECTION WAS HACKED? LOOK AT THE BALLOTS.” He denied having knowledge that could turn the election, but stood by his assertion that the results should be verified. “The only way to know whether a cyberattack changed the result is to closely examine the available physical evidence — paper ballots and voting equipment in critical states like Wisconsin, Michigan, and Pennsylvania,” he wrote. “Unfortunately, nobody is ever going to examine that evidence unless candidates in those states act now, in the next several days, to petition for recounts.”
Stein, in her many interviews about the recount, largely stuck to Halderman’s message, expressing concerns about security vulnerabilities and talking about the importance of making sure that every vote was counted. But many observers, including her own supporters, wondered why she was suddenly going to bat for Clinton, a candidate she had vilified during the campaign. Stein’s own running mate, Ajamu Baraka, told CNN that the recount effort made it look like Stein was “carrying the water for the Democrats.”
The way Stein handled her fund-raising efforts didn’t help matters. On November 23, she told supporters that she needed to raise $2.5 million to cover the initial filing fees for recounts. After the initial goal was reached in less than 12 hours, the figure rose to $4.5 million. Then, on November 25, Stein boosted it to $7 million, saying she planned to cover the total cost of the recounts, including legal fees. The rapid pace of donations tapered off as the Thanksgiving weekend came to a close, but on November 30, Stein again increased the goal, to $9.5 million.
Each time, Stein cited unexpected expenses; eventually, her team had lawyers deployed in all three states fighting legal battles to defend the recounts. But the ever-increasing demand for more money had the odd effect of uniting Republicans and Democrats. Trump called it “the Green Party scam to fill up their coffers by asking for impossible recounts,” while comedian Samantha Bee responded to a clip of Stein defending the recount with an earnest plea: “Oh, fuck off!” The A-Team, true to form, wondered whether the online counter that kept track of all the fund-raising pledges was working properly. “I very much hope that it’s not somehow falsified,” one scientist wrote on the Slack channel.
By late November, Halderman and the A-Team had become completely dependent on Stein’s willingness to proceed, and her surprising ability to raise money. There would be no recount without her. But in a sense, the scientists were also using Stein for their own purposes. “What we’re doing right now is clearly a hack,” Halderman told me at the time. “It’s a hack in the other sense of the word—a creative way to use the existing rules to get some necessary thing done.” The effort, as he saw it, was a “historic moment in American democracy. For the first time since we’ve had computer voting machines, we’re going to make sure they’re producing the right result in a national election.”
Over the next two weeks, the recount battle shifted from the Slack channel to the courts, where the Trump campaign and the states themselves were resisting efforts to reexamine the outcome. The primary legal issue was Stein’s standing: Since the recount wasn’t going to make her president, did she have the right to force a recount? “The law says nothing about having to prove that you’re aggrieved in any way,” insisted Hayley Horowitz, Stein’s attorney. “The statutes presume that anyone who runs in an unfair election has suffered an injury.”
On December 9, Halderman traveled to Philadelphia for what turned out to be the most dramatic legal battle in the recount fight. Stein had filed suit in federal court in Pennsylvania to allow a team of computer scientists to conduct a forensic assessment of the state’s voting machines. By that point, a recount that had been authorized in Wisconsin, which would end up shifting a few hundred votes to Trump, was underway. A federal court, meanwhile, had shut down the recount in Michigan after only three days, ruling Stein was not an “aggrieved candidate” because she had no chance of winning. Pennsylvania was the last chance.
Both sides put their own experts on the stand. The state called Michael Shamos, a computer scientist from Carnegie Mellon who has accepted hundreds of thousands of dollars from voting-machine companies to testify that election hacking is virtually impossible. “Shamos is the guy who is responsible as much as anybody in the tech community for all these lousy systems that are used all over the place,” says Jefferson, the scientist from Livermore. “So, of course, he had to be there in order to defend his past work.”
After first admitting that “a machine of any kind” could be hacked, given time and unfettered access, Shamos walked the court through a detailed explanation of why he believed that would have been essentially impossible to do in Pennsylvania. Even hacking a single machine, he testified, would take far too long to be practical:
One has to break seals, do things to the machine and then apply counterfeit seals back to the machine in such a way that nobody notices what is going on. And to do this to any significant number of machines requires an incredibly long time. I did a calculation earlier this year and found that it would take four months to do it for the DRE machines that are used in my county, Allegheny County. Nobody has unfettered access to the machine warehouse for four months without being observed.
When Halderman took the stand, his testimony didn’t go as well. “Am I correct,” the state’s attorney asked him, “that as you sit here today, you have no evidence that any machine in the Commonwealth of Pennsylvania was compromised in such a way as to alter any vote?”
“That is indeed what the forensic examination I’m talking about would seek to find,” Halderman answered.
Judge Paul Diamond, an appointee of President George W. Bush, interjected.
“Is that a yes or a no?” he asked.
“Yes,” Halderman replied, acknowledging both his lack of evidence and his view that a hack was, indeed, unlikely.
When the state’s attorney concluded his questioning, the judge continued to cross-examine Halderman. “Doctor,” he pressed, “is there anything that you have testified to this afternoon, other than the result of the vote on November 8, anything at all you have testified to today that you did not know before November 8?”
Halderman’s answer was startling. “No,” he told Diamond. “I don’t think so.” After spending $7 million to force hundreds of county officials across three states to inspect millions of ballots, recount advocates could not provide a single piece of evidence that the election results had been manipulated or miscounted.
Three days later, the judge dismissed Stein’s lawsuit and ended the recount.
Three days before Christmas, Matt Bernhard, Halderman’s doctoral student, sat alone in an office at the University of Michigan, tapping on a computer. The semester had ended a week earlier, and the computer science building was dark and silent. But Bernhard was hard at work poring over the data from the recounts in Wisconsin and Michigan.
“It would be incredibly hypocritical to spend all this time saying you need to do a recount because you need to check that there was no fraud, and then not check the recount to make sure there was no fraud,” he says. “That’s what most people did. They said, ‘Well, we did the recount, the results were the same, let’s go home.’ That’s not the point.”
Unfortunately, the data doesn’t make the point of the recount any clearer. The Michigan data set is so incomplete—just 40 percent of the state’s 4.8 million votes were recounted before the process was halted—that it provides little insight one way or the other. In Wisconsin, the only state that finished the process, there was no evidence to indicate that anyone stole the election. The hand recount did find that three percent of the 13,800 ballots scanned using an Optech III-P Eagle machine were miscounted. That’s less than 400 votes changed—but the errors followed no apparent pattern, and did not favor either Trump or Clinton. “That indicates that these are just crappy voting machines and we shouldn’t be using them,” Bernhard says.
Bernhard insists that he is comforted by these results. The country’s election system, he concludes, produced a true and accurate reflection of the people’s will. While there is no way to know what security experts might have found if they had been permitted to conduct a forensic examination of Pennsylvania’s machines, Bernhard declares himself “probably the most convinced person in the world that Donald Trump won Wisconsin.”
Bonifaz and Halderman remain less certain. In early December, when President Barack Obama declared that he was confident that no voting machines had been hacked, Bonifaz was incredulous. “How can he know that?” he growled. Later that month, during a presentation at a computer security convention in Germany, Halderman said that because the recounts weren’t completed, scientists can’t conclude that the 2016 election was hack-free.
In the end, it’s not clear that anyone benefited from the recount. Trump gained a handful of votes in Wisconsin, and Clinton picked up a few in Michigan. Other than that, nothing of consequence was resolved. As countless investigations have shown—and recent events have confirmed—the threat of malicious hacking and machine error remains a very real threat to our democratic process. If election results can’t be trusted, then the legitimacy of the representative system itself is called into question. Yet despite all the expense and the drama and the partisan bickering over the recounts, Halderman and his colleagues failed to advance public understanding of the serious risks posed by electronic voting machines. Indeed, the argument could be made that by raising the alarm when there was no sign of smoke, advocates for election security may have made it harder to force recounts when they’re really needed.
“People will be wondering whether all of this was necessary,” Halderman says. “I hope the outcome is positive policy change—that people won’t go back to state capitals and make recounts harder to do.” In fact, the Michigan legislature did just that during the recount fight, introducing a bill that would significantly increase the costs of a recount sought by a candidate who lost by as much as Stein. The measure was dropped after the recount ended, but it’s likely that Republicans will use their dominance in state legislatures to make it harder to scrutinize the outcome of questionable elections.
“I don’t think the whole process was particularly productive,” says Michael Slaby, who served as chief technology officer for Obama’s presidential campaigns. “It cost millions of dollars, and President Trump ended up with more votes in Wisconsin. That doesn’t seem like a good result.”
For his part, Halderman remains baffled by such reasoning. To him, proving that the process worked is just as valuable as showing that it erred. As a scientist, he believes that the democratic experiment must yield verifiable results if it is to be accepted as valid. What matters isn’t proving that there was wrongdoing in any given election. What matters is subjecting our system of elections to constant and careful scrutiny, to ensure that our voting technology stays one step ahead of those who seek to disrupt it.
“The machinery of democracy should be answering the questions we’ve asked,” Halderman says. “We are further from a safe system than I thought we were before the election. That bothers me. That’s not the way democracy should work.”