13 ms·

In recent months, I've had the opportunity to work with some individuals involved in the creation of the digital election system in Brazil. The system has been

• _trackno5 3y ago
  Just because those companies have certifications it doesn’t mean they can’t make a mistake. In addition to that, the source code is closed and not generally auditable by third parties. I was a student under Diego Aranha (a cryptography researcher from Brazil, now based in Denmark) many years ago when he got the chance to participate in the public test/audit of the voting system software. At the time they did find issues with the code that would allow you to de-anonimize the votes cast in a voting machine [1]. EDIT: If anyone wants to take a look at the vulnerabilities found at the time, check the paper [2]. In fairness the paper is from 2013, so a lot may have changed. [1] In portuguese https://thehack.com.br/o-dia-que-o-tse-revelou-o-codigo-da-urna-a-historia-de-diego-aranha/ https://thehack.com.br/o-dia-que-o-tse-revelou-o-codigo-da-u... [2] https://www.researchgate.net/publication/313421477_Vulnerabilidades_no_software_da_urna_eletronica_brasileira https://www.researchgate.net/publication/313421477_Vulnerabi...
  • rbanffy 3y ago
    > In addition to that, the source code is closed and not generally auditable by third parties. That's not correct. While you can't get it from GitHub, there is a process to audit it and any Brazilian citizen (or resident, I'm not sure) over 21 can request and be part of it. The process extends for many months starting the year prior to the election. Input from the multiple audits and tests are valuable in guiding the evolution of the software and hardware. In Portuguese: https://www.tse.jus.br/internet/temporarios/urna-seguranca/oportunidades-de-auditoria-e-fiscalizacao.html https://www.tse.jus.br/internet/temporarios/urna-seguranca/o...
    • _trackno5 3y ago
      You literally proved my point. It’s not generally auditable. Even if you ignore the fact that the audit window is restricted and that the software is developed behind closed doors, just the first step in the process is absurd if you want this to be practical for anyone to audit: > A Justiça Eleitoral prepara uma sala segura para deixar os sistemas a serem utilizados na eleição vindoura à disposição das entidades fiscalizadoras interessadas. As entidades podem utilizar ferramentas automatizadas e solicitar os esclarecimentos que julgarem necessários. Caso encontrem alguma inconformidade, deverão apresentá-la ao TSE, que deverá corrigi-la e apresentar o ajuste realizado. É importante destacar que todas as alterações realizadas nos sistemas são rastreáveis e ficam disponíveis para verificação das entidades fiscalizadoras.
      • rbanffy 3y ago
        Anyone can apply. You'll need to go there in person. I just don't see that as a huge hurdle, but, if you have a medical reason to be unable to be there in person, you can petition the election court. They are extremely reasonable with accommodations that don't create problems for their own tight schedules (remember the logistics are anything but trivial).
    • Scoring6931 3y ago
      Security through obscurity. As a matter of public interest, the source code should be open for all.
• teddyh 3y ago
  Please explain how a “digital election system” could ever be a sane idea? • Why Electronic Voting is a BAD Idea <https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI> • Why Electronic Voting Is Still A Bad Idea <https://www.youtube.com/watch?v=LkH2r-sNjQs https://www.youtube.com/watch?v=LkH2r-sNjQs>
  • pipo234 3y ago
    If Bolsonaro wasn't interested in rigging the elections, but rather to cast doubt on the result (as suggested in https://www.securityweek.com/brazilian-hacker-claims-bolsonaro-asked-him-to-hack-into-the-voting-system-ahead-of-2022-vote/ https://www.securityweek.com/brazilian-hacker-claims-bolsona...), then he might have (unintentionally) done a good service by trying to persuade a hacker to poke holes in this implementation of this "insane idea".
    • dunslandsboo 3y ago
      Allegedly
      • rbanffy 3y ago
        I believe we are waaay past that point now.
    • rbanffy 3y ago
      > trying to persuade a hacker to poke holes in this implementation of this "insane idea". This is a lot easier said than done. I have lost count of how many times I shot down people saying "I can hack the Brazilian voting machines" by citing hardware, software, and process countermeasures. I won't say we thought about everything (I worked on it in 2001-2002) but we thought a LOT about it and couldn't come up with one single idea that wouldn't fail in an obvious, easily detectable, manner.
  • gjvnq 3y ago
    Brazilian computer science student here. Electronic voting is a good idea here because it raises the "barrier to commit fraud". Basically, back when we ran our elections on paper, there was a lot of fraud as it's pretty easy to pull off fraud schemes. With electronic voting, the system is so complex that almost no one can pull off a fraud scheme with two major expectations: voter intimidation and voter impersonation. Although even that last one is getting tougher as we now scan peoples' fingerprints. The poll worker can manually override the system but this will be recorded and they will be in hot waters of they override too much. Yes, in theory non-electronic elections are more secure, but in practice it's more complicated as we are dealing with a country with a horrible history at implementing rule of law and we have a significant amount of local authoritarian leaders (e.g. drug lords) that would definitely make it near impossible to run paper elections fairly.
• the-dude 3y ago
  > possess the most relevant international certifications in their fields. Such as?
• rmbyrro 3y ago
  I suppose the goal of your message was to assert the security of the country's voting system. I think it's naive to think that any digital system is secure. What we try to do is to make hacking not worthwhile by raising the difficulty level. But when it comes to an entire country, especially the size and regional relevance of Brazil, the stakes are so high that it becomes too attractive to not hack. I wouldn't be worried about Bolsonaro or Lula hacking it. I'd be worried about the US, China, Russia, Israel, North Korea. They all possess the ability to hack Brazilian elections. From distance, they don't even have to go there. And they all have a history of systematically interfering in other countries' internal matters.
  • rodrigodlu 3y ago
    secure x secure enough x better than before due to sheer scale needed for instance it's in our constitution that after the identification that someone can vote, the vote MUST be anonymous. even on the paper time. unlike votes by mail where you have identification (we simply can't have here, for instance) I'm skeptical on many things, but what you said is much harder to happen than just buying votes on poor neighbourhoods or influencing local militias on our second biggest city. This is less far off from reality specially for legislative positions.
    • rbanffy 3y ago
      > unlike votes by mail where you have identification (we simply can't have here, for instance) We could, but it'd need two envelopes, one that identifies the voter, and a second, without voter identification, with the vote itself. A first election official would validate that the outer package contains a vote from someone who has a right to vote, and would pass the inner envelope to be opened and the vote counted by another person. With a process that includes randomly selected witnesses, it should be possible. But, since all voters need to either vote or justify why they didn't/couldn't, the need for such systems is much diminished.
  • rbanffy 3y ago
    > They all possess the ability to hack Brazilian elections. It's much easier to attack a democracy through disinfo campaigns and sponsoring coups. It was like that in the ousting of Dilma in 2016 (yesterday yet another court of law ruled she didn't commit an impeachable offense). Far-right ultra-nationalist propaganda has been used - with enormous success, I must add - to destabilize both countries like Brazil up to the whole EU (Brexit, anyone?). In Brazil we are amidst a scandal that points to the president himself ordered higher highway patrol enforcement specifically in regions where the opposition candidate was expected to win more votes, in an attempt to limit participation in those specific demographics. > What we try to do is to make hacking not worthwhile by raising the difficulty level. I worked in the 2002 election (for Unisys, who made a lot of the voting machines) and the machine itself, its software, and all the handling protocols around it are designed to make hacking it a very high-effort/low-return affair. As I mentioned before, there are many ways to push an election they way of a candidate, but, in Brazil at least, none of those pass through the voting system.
• entropyie 3y ago
  As a Software Engineer with decades of experience working with PKI/cryptography/infosec, I believe that online voting is a fundamentally bad idea. It stems from a fundamental misunderstanding of the requirements of an election. The requirement is not "accurately count the votes". It is: "Allow people to vote, and have their votes counted, in a demonstrably fair way, so that an average person can have high confidence the outcome is fair, given the adversarial nature of the system and varying levels of education / honesty among all present". A election only means something because of the consent of a large number of average people to abdicate their freedom to someone else based on what they feel was a fair process. In Ireland, observers from multiple parties observe the votes as they are counted and publish their own numbers realtime (see tallymen). In this context it's very hard to argue the vote was rigged...
  • pennaMan 3y ago
    I'm not sure your argument makes any sense.... So you're saying it's not about the absolute mathematical results of the poll, but more about the feelings of the general population?
    • PavleMiha 3y ago
      It's both, the methods by which the election is made secure and accurate should be understandable by most people. Most people don't understand cryptography and cybersecurity.
    • entropyie 3y ago
      Of course it is about the feelings of the general population! The feelings of the general population decide whether you have a stable democracy or a revolution on your hands. There are no objective laws of physics when it comes to organizing society, no objective reality, only the perception of reality.
  • rodrigodlu 3y ago
    I urge you to take serious look on all methods we have for scrutiny and validation before such comments. People invalidating valid paper votes on 80s were a thing, impossible to prove, unlike the auditing we have today. It's not online also, it's offline with uploaded encrypted data through encrypted channels.
• cal85 3y ago
  The vast majority of computer professionals I have discussed this topic with are very clear: there will never, ever be a safe way to digitise elections. Your engineers may be proud of valiant efforts, but all computer systems are hackable in principle despite the best intentions of everyone involved. This problem is manageable even for big, important stuff like banks, because there are ways of resolving things when the systems inevitably get hacked from time to time. But elections are just too big and too important (not to mention highly targetable) to introduce layers of technical complexity in which there may lurk vulnerabilities. And, perhaps more importantly, digitisation makes the system impossible for regular folks to properly understand and trust. People can understand ink and paper ballots: you gather them in boxes and you count them. If the result is very close, you count them again (more carefully and with more eyes on it). Until everyone is agreed on who won. That clarity is very important so people can accept the result. Lots of human eyes on every step of the process. People are rightly suspicious of results from systems that include some black box of technical complexity that 99% of people can’t begin to understand.
  • rpgbr 3y ago
    The majority people everywhere is very clear: there will never, ever be a safe way to make elections with paper. It’s funny how all of sudden the forward thinking, all-digital tech community turn itself in old school conservative when discussing digital elections without even considering the bigger issues with alternatives.
    • chayesfss 3y ago
      [dead]
  • seer 3y ago
    When electronic voting was introduced in my country - Bulgaria, immediately the results were quite different than previous elections - with as much as 10% diff. It was largely attributed to the fact that incumbents did not know how to “hack” this new system (yet?) but were pretty adept at cost effectively manipulating paper ballots. For example they would infiltrate remote areas with little to no observers and stuff the ballot boxes. Once the new electronic voting system was introduced, suddenly they didn’t know what to do, so the votes ended up more representative, e.g. much closer to projected numbers than before. Now the system is “electronic counting + paper ballot” So you still go to a voting place, there are still independent/multi party observers, there are still paper ballots available for recount, but you have cryptography on top of it to prevent traditional tempering.
• lelc 3y ago
  The election system in Brazil is so perfect that you might go to jail if you say otherwise.