5 ms·

Brazilian hacker claims Bolsonaro asked him to hack into the 2022 voting system

pipo234 3y ago
> He said he told the leader he could not hack into the electronic voting system because it wasn’t connected to the internet. The lack of remote access is a major obstacle. But surely, Bolosonaro must have meant to apply a more creative "out of the box" solutions than "hack it HARDER, God damn it! Use sudo, or something". ;-) Like: hack the company building the electronic voting system. Surely, they are connected to the Internets?!
- pipo234 3y ago
  From another source: https://www.msn.com/en-us/news/world/hacker-testifies-that-bolsonaro-asked-him-to-tamper-with-voting-machines/ar-AA1futyi https://www.msn.com/en-us/news/world/hacker-testifies-that-b... > According to Delgatti, Bolsonaro wanted to him to "expose the fragility" of the voting machines [...]. And: https://www.securityweek.com/brazilian-hacker-claims-bolsonaro-asked-him-to-hack-into-the-voting-system-ahead-of-2022-vote/ https://www.securityweek.com/brazilian-hacker-claims-bolsona... > [Delgatti] said that after he explained why he could not hack into the electoral system, the Bolsonaro campaign asked him to tamper with a borrowed voting machine to make it appear, less than a month before the election’s first round, that the machine had been successfully hacked and results could be compromised. The fraudulent hack was to be shared with news media, Delgatti said, but it was canceled. So: the plan was not to rig the elections, but to shed FUD on result (in case Bolsonaro lost).
  - jl6 3y ago
    Sounds plausible, but it’s a risky move to bring this to court without evidence.
    - pipo234 3y ago
      More accurately, the evidence being (solely) testimony. But yes, this doesn't seem to be a very strong case.
      - whstl 3y ago
        There are also some articles claiming that he got money from a Bolsonaro ally, dunno how legit though: "The Federal Police told the Federal Supreme Court (STF) that the hacker Walter Delgatti Neto, known for having given rise to the "Vaza Jato" operation, received at least R$ 13,500 from advisors to federal deputy Carla Zambelli (PL-SP)." https://g1.globo.com/politica/noticia/2023/08/02/assessores-de-carla-zambelli-repassaram-ao-menos-r-135-mil-a-walter-delgatti-diz-pf.ghtml https://g1.globo.com/politica/noticia/2023/08/02/assessores-...
- rodrigodlu 3y ago
  Like using lot's of public money to offer cheap populist assistance through loans on public banks? Or the known-but-hidden connections to certain types of associates. Or using the federal highway police to stop lot's of buses for "safety inspection" on the election day on a state that voted for the adversary. :)
pdrbrtt 3y ago
In recent months, I've had the opportunity to work with some individuals involved in the creation of the digital election system in Brazil. The system has been under development for over 15 years. These are extremely serious companies and individuals who are experts in cryptography, cybersecurity, hardware security, and, above all, the logistical process to make it happen on the scale of Brazil. All companies involved in the creation and production of the technology possess the most relevant international certifications in their fields. Among all the problems our country faces the digital election is not one of them. In reality, it is a profound source of pride that something so complex is developed by Brazilians, bringing together the public and private sectors in an integrated and productive manner.
- _trackno5 3y ago
  Just because those companies have certifications it doesn’t mean they can’t make a mistake. In addition to that, the source code is closed and not generally auditable by third parties. I was a student under Diego Aranha (a cryptography researcher from Brazil, now based in Denmark) many years ago when he got the chance to participate in the public test/audit of the voting system software. At the time they did find issues with the code that would allow you to de-anonimize the votes cast in a voting machine [1]. EDIT: If anyone wants to take a look at the vulnerabilities found at the time, check the paper [2]. In fairness the paper is from 2013, so a lot may have changed. [1] In portuguese https://thehack.com.br/o-dia-que-o-tse-revelou-o-codigo-da-urna-a-historia-de-diego-aranha/ https://thehack.com.br/o-dia-que-o-tse-revelou-o-codigo-da-u... [2] https://www.researchgate.net/publication/313421477_Vulnerabilidades_no_software_da_urna_eletronica_brasileira https://www.researchgate.net/publication/313421477_Vulnerabi...
  - rbanffy 3y ago
    > In addition to that, the source code is closed and not generally auditable by third parties. That's not correct. While you can't get it from GitHub, there is a process to audit it and any Brazilian citizen (or resident, I'm not sure) over 21 can request and be part of it. The process extends for many months starting the year prior to the election. Input from the multiple audits and tests are valuable in guiding the evolution of the software and hardware. In Portuguese: https://www.tse.jus.br/internet/temporarios/urna-seguranca/oportunidades-de-auditoria-e-fiscalizacao.html https://www.tse.jus.br/internet/temporarios/urna-seguranca/o...
veave 3y ago
>Walter Delgatti Neto did not provide any evidence for his claim All said then.
- nunobrito 3y ago
  Accusation is all it takes nowadays. And you'll get down voted for pointing out the obvious.
  - pipo234 3y ago
    Indeed, mostly smoke so far. But there might be some leads, like: > Delgatti said he met with Ministry of Defense technical experts to discuss the electronic voting system on five occasions. The first time, he said, was right after meeting with Bolsonaro, when he was driven from the presidential residence to the Ministry of Defense, entering through the back entrance. https://www.securityweek.com/brazilian-hacker-claims-bolsonaro-asked-him-to-hack-into-the-voting-system-ahead-of-2022-vote/ https://www.securityweek.com/brazilian-hacker-claims-bolsona... MoD should be able to confirm or deny that the meeting took place. Possibly, from there evidence of wrong doing might surface. But then again, it might not.
- maleldil 3y ago
  You're not wrong. Although we can agree that this _sounds true_ because of who Bolsonaro has demonstrated he is, it doesn't mean that it's true until we see some evidence.
- giuliomagnifico 3y ago
  > …to the parliamentary commission of inquiry. But his detailed testimony raises new allegations against the former far-right leader Maybe he has something to prove his claim, and he doesn’t want to reveal it still? Otherwise yes, it’s a weird claim, also because people like “hackers” usually keeps the documentation of everything inside these conversations.
  - rbanffy 3y ago
    He was paid.
lelc 3y ago
Calling this guy a hacker is a joke... as is this whole story. He is a scammer who got famous for accessing phone numbers of authorities using tricks he learned while scamming bank clients.
- pipo234 3y ago
  But the question is: did Bolsonaro think he was a hacker?
  - lelc 3y ago
    That he did is the most revealing...
    - pipo234 3y ago
      Allegedly :-)
rpgbr 3y ago
Wow, lots of comments discrediting digital election. Brazilian authorities run open testing from time to time and fixes (tangencial so far) vulnerabilities. So far, there were zero proof that any hacking or flaw in our voting system. This only became an “issue” because discredit the election became part of Bolsonaro’s coup attempt. (Which is, btw, the authoritarian wannabe playbook.) Anyway, you should witness the mess it was before, when votes were in paper and counting by hand. Frauds was widespread. I mean, look and the US election system… it’s a kind of meme in Brazil due to how rudimentary and prone to fraud.
- senectus1 3y ago
  Australia does paper voting, and excels at it. It can be done, safely and efficiently.
  - rpgbr 3y ago
    So does digital election.
  - brabel 3y ago
    Anything involving people can only be done safely if people can be trusted. While in Australia there is such trust in the local people involved, in Brazil that's just not the same story.
- lelc 3y ago
  I would argue that an election system in which fraud is easy but obvious for everyone when present is more robust than a system in which fraud is hard but impossible for anyone to see.
- aa_is_op 3y ago
  They're accounts operated from bot farms my dude! They're rampant all over the internet. It costs a multi-billionaire Russian oligarch $12k/year to pay one of these "trolls" and they produce thousands of comments per day, everywhere! It's cheap and long-lasting propaganda!
- Scoring6931 3y ago
nforgerit 3y ago
Maybe it's my underlying German-ness but I don't understand why people would want an electronic voting system. Being confronted with the gazillions of possible failures in hardware and software, the idea seems at least risky to me. And for what gain? Can't we simply think of election day as something to celebrate democracy by putting a mark on a physical piece of paper? Call me old-fashioned, but I really enjoy visiting the election office.
- rbanffy 3y ago
  In a country the physical size of Brazil, having trustworthy election results the day after an election is great. And we need to go to a voting place to cast the votes - it's electronic, but not online.
  - nforgerit 3y ago
    I remember an example of some arcane software that was used "internally" by some local German office to just sum up the votes and generate some kind of result sheet for the local area. It turned out, although it was air-gapped, it was susceptible to an attack against its update mechanism. Some white-hats showed it was possible to inject malicious code and change the results. You never know. That's the essence of the problem.
    - rbanffy 3y ago
      The nodes that transmit the votes back to the central office are, indeed, much higher value targets than the voting machines. In any case, the voting machine data is preserved, both digitally and in printed form (this last one generated at the end of the voting, before the ballot is locked down for transport), so any discrepancies can be flagged by individuals and parties. The printed summary is displayed publicly at the voting places and the data is encoded in an easy to copy QR code.
- rodrigodlu 3y ago
  From my pov I see that in Germany even if radicals try something funny, someone will be outspoken, denunciate the lame move, right? They will need to do something different, like either gaining public momentum like what's happening right now, or trying something much more dramatic. Or making the system rotten in a span of time that is measured in decades, not in days/months. Wdyt?
agubelu 3y ago
There's a lot of discussion about whether electronic voting _can_ be done reliably and safely, but I think the psychological factor is also very important here. An election shouldn't only be objectively trustworthy, it should _feel_ trustworthy. And all the cryptographic fundaments in the world simply don't provide the same certainty that your vote has been received anonymously, will be counted, and can be emited only once as introducing a sealed envelope in a transparent box while a person strikes your name from a list of voters. The counting process is supervised by representatives of all parties with competing interests, and if you're still not sure, you can observe it yourself here since it's open to the public. I simply don't understand the need to replace this process with an electronic one, which _at best_ provides the same guarantees, but in a way that is not immediately evident to the voters.

> He said he told the leader he could not hack into the electronic voting system because it wasn’t connected to the internet. The lack of remote access is a major obstacle. But surely, Bolosonaro must have meant to apply a more creative "out of the box" solutions than "hack it HARDER, God damn it! Use sudo, or something". ;-) Like: hack the company building the electronic voting system. Surely, they are connected to the Internets?!

pipo234 3y ago
From another source: https://www.msn.com/en-us/news/world/hacker-testifies-that-bolsonaro-asked-him-to-tamper-with-voting-machines/ar-AA1futyi https://www.msn.com/en-us/news/world/hacker-testifies-that-b... > According to Delgatti, Bolsonaro wanted to him to "expose the fragility" of the voting machines [...]. And: https://www.securityweek.com/brazilian-hacker-claims-bolsonaro-asked-him-to-hack-into-the-voting-system-ahead-of-2022-vote/ https://www.securityweek.com/brazilian-hacker-claims-bolsona... > [Delgatti] said that after he explained why he could not hack into the electoral system, the Bolsonaro campaign asked him to tamper with a borrowed voting machine to make it appear, less than a month before the election’s first round, that the machine had been successfully hacked and results could be compromised. The fraudulent hack was to be shared with news media, Delgatti said, but it was canceled. So: the plan was not to rig the elections, but to shed FUD on result (in case Bolsonaro lost).
- jl6 3y ago
  Sounds plausible, but it’s a risky move to bring this to court without evidence.
  - pipo234 3y ago
    More accurately, the evidence being (solely) testimony. But yes, this doesn't seem to be a very strong case.
    - whstl 3y ago
      There are also some articles claiming that he got money from a Bolsonaro ally, dunno how legit though: "The Federal Police told the Federal Supreme Court (STF) that the hacker Walter Delgatti Neto, known for having given rise to the "Vaza Jato" operation, received at least R$ 13,500 from advisors to federal deputy Carla Zambelli (PL-SP)." https://g1.globo.com/politica/noticia/2023/08/02/assessores-de-carla-zambelli-repassaram-ao-menos-r-135-mil-a-walter-delgatti-diz-pf.ghtml https://g1.globo.com/politica/noticia/2023/08/02/assessores-...
rodrigodlu 3y ago
Like using lot's of public money to offer cheap populist assistance through loans on public banks? Or the known-but-hidden connections to certain types of associates. Or using the federal highway police to stop lot's of buses for "safety inspection" on the election day on a state that voted for the adversary. :)

pdrbrtt 3y ago

In recent months, I've had the opportunity to work with some individuals involved in the creation of the digital election system in Brazil. The system has been under development for over 15 years. These are extremely serious companies and individuals who are experts in cryptography, cybersecurity, hardware security, and, above all, the logistical process to make it happen on the scale of Brazil. All companies involved in the creation and production of the technology possess the most relevant international certifications in their fields. Among all the problems our country faces the digital election is not one of them. In reality, it is a profound source of pride that something so complex is developed by Brazilians, bringing together the public and private sectors in an integrated and productive manner.

_trackno5 3y ago
Just because those companies have certifications it doesn’t mean they can’t make a mistake. In addition to that, the source code is closed and not generally auditable by third parties. I was a student under Diego Aranha (a cryptography researcher from Brazil, now based in Denmark) many years ago when he got the chance to participate in the public test/audit of the voting system software. At the time they did find issues with the code that would allow you to de-anonimize the votes cast in a voting machine [1]. EDIT: If anyone wants to take a look at the vulnerabilities found at the time, check the paper [2]. In fairness the paper is from 2013, so a lot may have changed. [1] In portuguese https://thehack.com.br/o-dia-que-o-tse-revelou-o-codigo-da-urna-a-historia-de-diego-aranha/ https://thehack.com.br/o-dia-que-o-tse-revelou-o-codigo-da-u... [2] https://www.researchgate.net/publication/313421477_Vulnerabilidades_no_software_da_urna_eletronica_brasileira https://www.researchgate.net/publication/313421477_Vulnerabi...
- rbanffy 3y ago
  > In addition to that, the source code is closed and not generally auditable by third parties. That's not correct. While you can't get it from GitHub, there is a process to audit it and any Brazilian citizen (or resident, I'm not sure) over 21 can request and be part of it. The process extends for many months starting the year prior to the election. Input from the multiple audits and tests are valuable in guiding the evolution of the software and hardware. In Portuguese: https://www.tse.jus.br/internet/temporarios/urna-seguranca/oportunidades-de-auditoria-e-fiscalizacao.html https://www.tse.jus.br/internet/temporarios/urna-seguranca/o...

veave 3y ago

>Walter Delgatti Neto did not provide any evidence for his claim All said then.

nunobrito 3y ago
Accusation is all it takes nowadays. And you'll get down voted for pointing out the obvious.
- pipo234 3y ago
  Indeed, mostly smoke so far. But there might be some leads, like: > Delgatti said he met with Ministry of Defense technical experts to discuss the electronic voting system on five occasions. The first time, he said, was right after meeting with Bolsonaro, when he was driven from the presidential residence to the Ministry of Defense, entering through the back entrance. https://www.securityweek.com/brazilian-hacker-claims-bolsonaro-asked-him-to-hack-into-the-voting-system-ahead-of-2022-vote/ https://www.securityweek.com/brazilian-hacker-claims-bolsona... MoD should be able to confirm or deny that the meeting took place. Possibly, from there evidence of wrong doing might surface. But then again, it might not.
maleldil 3y ago
You're not wrong. Although we can agree that this _sounds true_ because of who Bolsonaro has demonstrated he is, it doesn't mean that it's true until we see some evidence.
giuliomagnifico 3y ago
> …to the parliamentary commission of inquiry. But his detailed testimony raises new allegations against the former far-right leader Maybe he has something to prove his claim, and he doesn’t want to reveal it still? Otherwise yes, it’s a weird claim, also because people like “hackers” usually keeps the documentation of everything inside these conversations.
- rbanffy 3y ago
  He was paid.

lelc 3y ago

Calling this guy a hacker is a joke... as is this whole story. He is a scammer who got famous for accessing phone numbers of authorities using tricks he learned while scamming bank clients.

pipo234 3y ago
But the question is: did Bolsonaro think he was a hacker?
- lelc 3y ago
  That he did is the most revealing...
  - pipo234 3y ago
    Allegedly :-)

rpgbr 3y ago

Wow, lots of comments discrediting digital election. Brazilian authorities run open testing from time to time and fixes (tangencial so far) vulnerabilities. So far, there were zero proof that any hacking or flaw in our voting system. This only became an “issue” because discredit the election became part of Bolsonaro’s coup attempt. (Which is, btw, the authoritarian wannabe playbook.) Anyway, you should witness the mess it was before, when votes were in paper and counting by hand. Frauds was widespread. I mean, look and the US election system… it’s a kind of meme in Brazil due to how rudimentary and prone to fraud.

senectus1 3y ago
Australia does paper voting, and excels at it. It can be done, safely and efficiently.
- rpgbr 3y ago
  So does digital election.
- brabel 3y ago
  Anything involving people can only be done safely if people can be trusted. While in Australia there is such trust in the local people involved, in Brazil that's just not the same story.
lelc 3y ago
I would argue that an election system in which fraud is easy but obvious for everyone when present is more robust than a system in which fraud is hard but impossible for anyone to see.
aa_is_op 3y ago
They're accounts operated from bot farms my dude! They're rampant all over the internet. It costs a multi-billionaire Russian oligarch $12k/year to pay one of these "trolls" and they produce thousands of comments per day, everywhere! It's cheap and long-lasting propaganda!
Scoring6931 3y ago

nforgerit 3y ago

Maybe it's my underlying German-ness but I don't understand why people would want an electronic voting system. Being confronted with the gazillions of possible failures in hardware and software, the idea seems at least risky to me. And for what gain? Can't we simply think of election day as something to celebrate democracy by putting a mark on a physical piece of paper? Call me old-fashioned, but I really enjoy visiting the election office.

rbanffy 3y ago
In a country the physical size of Brazil, having trustworthy election results the day after an election is great. And we need to go to a voting place to cast the votes - it's electronic, but not online.
- nforgerit 3y ago
  I remember an example of some arcane software that was used "internally" by some local German office to just sum up the votes and generate some kind of result sheet for the local area. It turned out, although it was air-gapped, it was susceptible to an attack against its update mechanism. Some white-hats showed it was possible to inject malicious code and change the results. You never know. That's the essence of the problem.
  - rbanffy 3y ago
    The nodes that transmit the votes back to the central office are, indeed, much higher value targets than the voting machines. In any case, the voting machine data is preserved, both digitally and in printed form (this last one generated at the end of the voting, before the ballot is locked down for transport), so any discrepancies can be flagged by individuals and parties. The printed summary is displayed publicly at the voting places and the data is encoded in an easy to copy QR code.
rodrigodlu 3y ago
From my pov I see that in Germany even if radicals try something funny, someone will be outspoken, denunciate the lame move, right? They will need to do something different, like either gaining public momentum like what's happening right now, or trying something much more dramatic. Or making the system rotten in a span of time that is measured in decades, not in days/months. Wdyt?

agubelu 3y ago

There's a lot of discussion about whether electronic voting _can_ be done reliably and safely, but I think the psychological factor is also very important here. An election shouldn't only be objectively trustworthy, it should _feel_ trustworthy. And all the cryptographic fundaments in the world simply don't provide the same certainty that your vote has been received anonymously, will be counted, and can be emited only once as introducing a sealed envelope in a transparent box while a person strikes your name from a list of voters. The counting process is supervised by representatives of all parties with competing interests, and if you're still not sure, you can observe it yourself here since it's open to the public. I simply don't understand the need to replace this process with an electronic one, which _at best_ provides the same guarantees, but in a way that is not immediately evident to the voters.