Twenty-five years after Brazil’s voting system moved from paper to electronic ballots, the model of electronic voting machine (EVM) the country uses is now in its twelfth version. During this period there has been no evidence of fraud in the voting system, which is used to select representatives in both the executive and legislative branches of government. The project’s success is due to the system being under constant improvement through public security tests, recommendations from technology companies, and interaction with researchers from universities and research institutes. However, questions regarding the method’s fairness have never gone away, and intensify when elections approach.
The most recent attack on the country’s voting machines came from the federal legislature. Since 2019, Constitutional Amendment Proposal (PEC) No. 135/19, drafted by Congresswoman Bia Kicis (PSL/DF), has been moving through Brazil’s House of Representatives. The idea is to augment the electoral process with a paper printout of voters’ EVM selections, creating a physical record that can be checked at the time of voting and later serve as a tool for auditing—or potentially recounting—votes.
The members of the Superior Electoral Court (TSE) object to the proposed amendment and see no reason to doubt the system, which first came into use in 1996. Brazil’s e-voting machine was designed to avoid human interference at two crucial moments: during the act of voting and when votes are counted. For TSE president and Federal Supreme Court (STF) justice Luís Roberto Barroso, the return of the printed vote in Brazil—a country of continental dimensions and a legacy of political patronage—could mean a return to the fraud that was for so long a factor in the electoral process.
During a press conference held in June, following a presentation on the electronic voting system for members of the House Committee conducting discussions on PEC 135/19, Barroso warned that a printed vote will increase the potential for claims of fraud. “People will ask, as has indeed been asked before, for the public counting of 150 million votes. And public counting can only be done manually. So we’re going to enter a time tunnel and go back to the era of fraud, when people ate votes, ballot boxes disappeared, and new votes appeared. This is going to create very bad results,” he said.
The first version of Brazil’s electronic voting machine was used in the 57 municipalities nationwide that had more than 200,000 voters. By the 2002 national election, the entire country was already voting electronically, and paper ballots had been replaced. Today, there are 550,000 EVMs available for the country’s 460,000 polling stations. The current model costs R$4,000 and has a minimum service life of 10 years. The equipment specifications are stipulated by the TSE, which opens a bid tender so companies may compete to manufacture the voting machines. The software running on the EVMs for recording and counting votes is designed and developed internally by a TSE team. This precaution, which centralizes the development of electoral hardware and software, is one the TSE views as one of the system’s strengths. “Other countries use what we call an ‘off-the-shelf EVM’, with market solutions developed by software companies. That’s not the case in Brazil. In addition to the EVM itself, for which we solicit bids according to a security architecture written to our own specifications, the Linux-based operating system and the apps related to the election are made by in-house teams,” says systems analyst Celio Castro Wermelinger, advisor to the Secretariat of Modernization and Strategic and Socio-Environmental Management at the TSE.
Disagreements
Wermelinger’s confidence in the electronic voting machine is not shared by every researcher studying the subject. Some argue that the voting technology employed in Brazil today is not the state-of-the-art in electoral systems. “Computerization brought agility and stability to a process that, in the past, was marked by fraud and distrust,” observes Jeroen van de Graaf from the Department of Computer Science at the Federal University of Minas Gerais (UFMG). “The problem now is that the voter has to blindly trust how the TSE structures the voting system, based on the concept of security through obscurity, which follows the logic of a military or intelligence service, not a democratic, transparent civil society.”
Currently, a large part of the IT science community is favorable to the concept of software independence, which is in direct opposition to the TSE system. “The idea is that the voting system be transparent so that anyone can verify whether the software is working correctly,” explains Diego Aranha, an associate professor of systems security at the University of Aarhus in Denmark. Aranha has been able to expose Brazil’s electronic voting machines’ vulnerabilities on two occasions. The first time, while at the University of Brasília in 2012, he demonstrated that it was possible to determine who each citizen voted for by unscrambling the Digital Vote Register (RDV), a file in spreadsheet format that stores the digitally recorded votes in random rows and columns. The second time, in 2017, Aranha was able to tamper with the voting software before it was installed, making its behavior malicious.
These attacks took place during security tests the TSE conducted with the goal of identifying possible security flaws in their electronic voting machines. “Experts attack the system and any vulnerabilities found are fixed,” explains Wermelinger. In 2009, Aranha says one invited white-hat hacker detected the radio transmission frequency emitted as each voting button is pressed, which breaks vote secrecy. It would be difficult to make such an attack under actual conditions, considering the traffic within the polling station and the presence of voters and pollsters. “Still, we modified the keyboard in the EVMs with shielding, so the signal no longer propagates,” Wermelinger observes.
The TSE analyst also cites other measures the electoral courts have taken to certify the system’s reliability. The printout of the “zeroth” is a physical report showing that no votes are already recorded in the EVM when voting begins. There are also parallel tests, conducted with randomly selected voting machines to simulate the election, in which voters are videotaped registering their votes in both the EVM and on paper, with the votes being verified at the end. The cryptographic procedures are also constantly updated in order to make it impossible to decrypt the security keys necessary to access the voting machines’ software and hardware, which are not connected to the internet.
Paulo Matias, from the Department of Computing at the Federal University of São Carlos, offers one caveat regarding Wermelinger’s arguments: “An attacker doesn’t need to bypass every one of these security protocols. Once one loophole is found, they’re inside the system.” Aranha adds: “The voter has no guarantee that the software wasn’t tampered with before being installed in the voting machines, a few weeks before the election.”
Although the researchers point out the EVM’s vulnerabilities and question the way in which the TSE develops it, all those interviewed by Pesquisa FAPESP agree that there is no evidence of fraud. “I have no reason to say that there’s been fraud with the electronic voting machine, although I continue to point out that it’s designed to not be transparent or auditable,” stresses Van de Graaf. According to Aranha, a material copy of the vote is fundamental for auditing the EVMs. “A transparent voting system should produce physical records so that an unspecialized auditor can verify that the resulting count is correct without depending on the software,” the researcher adds. The goal being that any undetected software problem would not have an undetected impact on the results.
Barroso, at the TSE, does not see how auditing via printed ballots improves the system. “What is the point of creating an audit mechanism, the printed ballot, which is less secure than the object of the audit, the electronic vote?” the justice asked during a symposium on the Brazilian political system, on July 5th. In his view, the system already has ten stages of auditing, all of which provide for participation by the political parties.
During his lecture Barroso stated that the TSE is going to begin increasing the number of EVMs being independently audited during each election in order to verify that the votes counted are equal to those that reach the electoral court. “On the eve of the elections, with the electronic voting machines already in place, 100 of them are randomly selected throughout Brazil. They’re taken from their locations and brought to the TRE,” he says. “At the TRE they’re audited by an independent auditing company and, in a controlled environment with video recording, the vote is passed from a ballot to the electronic voting machine and then printed, and the auditing company verifies that what came out is identical to what went in.”
The justice is also concerned with the logistics of implementing the printed vote and with the possible judicialization that could result if it is approved by Congress. “What is the reasoning behind why the TSE has been working against the printed vote? It’s just that we’d have to transport 150 million votes in the country of cargo theft, militias, the Comando Vermelho, the PCC, the Amigos do Norte [Red Command, PCC and Amigos do Norte are criminal organizations based primarily in Rio de Janeiro]. That’s one big problem to start with,” Barroso stated in an interview with the newspaper Estado de S. Paulo.
Regarding the judicialization of the election results, the TSE president stated that the manual count will show a difference in relation to the electronic tally. “Even a bank teller has to do a reconciliation. And then they’re going to ask the EVM to be annulled and say that it was out of sync, that there was a mismatch. In this country, where everything becomes a judicial process, the election will be judicialized as well,” he argued. “Nobody thinks that a new audit mechanism is being created. An argument is being created to increase the potential for fraud.”
Reliance on the electronic voting machine has not immobilized the TSE. In May 2020, the institution established a working group to study ways to improve the Brazilian voting system. One stage in the study involved a public dialogue phase with companies interested in demonstrating other forms of voting, such as online systems. “We talked to developers from several countries, such as the Czech Republic, Russia, and Estonia,” recalls Wermelinger. Twenty-five companies presented their systems. The objective was to discover what is already available globally in order to understand security challenges that may arise in the future.
“Having parts of the process online, with voter equipment, could be advantageous. Justice Barroso told the development team that we need to prioritize the ‘security tripod’—especially in relation to vote secrecy—as well as voter efficiency and experience. We are preparing an enhancement project in this regard, with an eye towards 2024 and beyond,” explains Wermelinger. He anticipates that the project will take into consideration one persistent demand from academia: “We are negotiating with a Brazilian public university to develop this project together,” he says.
Global panorama Other countries use technologies similar to the Brazilian systemSeventeen countries out of a total of 176 analyzed by the International Institute for Democracy and Electoral Assistance use voting terminals similar to the Brazilian e-voting machine. “Most electronic electoral processes have a physical vote linked to the digital information. In several American states, voters fill out a form by marking their selections with a pen. These votes can be accumulated and scanned all at once, automatically, or scanned as they are deposited,” describes Paulo Matias, from the Federal University of São Carlos. “In Argentina, you vote with a machine, but the information doesn’t stay in it. It all goes onto the ballot, printed with an identification chip.”
In India, electronic voting began in the 1990s and there, as in Brazil, it reduced fraud and speeded up the vote count. It also increased representation among the poorest citizens: for the illiterate, filling out votes on paper was more difficult than pressing keys. The invalid vote rate in this population group dropped significantly. Since 2013, India has printed the votes that are typed into the EVMs.
In Estonia, voters have the option to vote online. In 2019, 44% of Estonians (more than 247,000 voters) voted online, using a computer app.
Republish
