Auditability and Black-Box Models: Brazil and Electronic Voting

What’s the problem with electronic voting? 🗳️

Electronic voting, or e-voting, is “voting by electronic means to assist or handle the casting and counting of votes.”

With many modern aspects of life, like banking and finance, already automated through technology (and no ordinary citizen seems to be questioning whether Visa or Mastercard are “really” safe when buying goods online), we already rely on security measures such as “air gap networking” and “cryptography.”

However, elections in democratic states are (definitely) a high-stakes scenario. The system has to work even under the malicious intentions of external attackers. This raises the question of whether “electronic voting” is safe and whether we should be using it.

As a first note, cybersecurity is a dense and intricate subject. And, understandably, questions of trust are not uncommon, given that the general public doesn’t master the subject. Still, it’s interesting to see that people’s distrust is selective. Many modern applications use the very same security measures as electronic voting systems, but (almost) nobody notices them.

You hand over your credit card information to Amazon’s servers every time you make a purchase. And you’re fine with that, because it’s safe to do so. But if an election doesn’t go the way the losing party expected, people become ready to “doubt” the very same security infrastructure they use every day.

A full lecture on the “robustness” of electronic voting in Brazil would become overly specific and dull for a general audience. Still, I’ll try to show in this post why electronic voting (in Brazil) can be considered safe and robust.

We’ll also take this opportunity to talk about transparency and auditing, two fundamental principles when debating the ethical use of technologies (like AI).

Recently, during Brazil’s last presidential election, many people dissatisfied with the results have been questioning and doubting the robustness and “legitimacy” of our electronic voting system. Some even think our current result is “fraud.”

So, as someone versed in cybersecurity and information systems technology, I’d like to show the reader how someone “could” (if they wanted to) try to rig an election in Brazil. But let me remind the reader that possibility, feasibility, and probability are very different concepts.

But first, let’s try to lay out the advantages of, and the doubts about, electronic voting.

The advantages of electronic voting 👍

Let’s present a few points in favor of electronic voting:

• Better user experience: In general, voting via electronic ballot machines is more efficient (in terms of speed) for several reasons. If there’s one thing computers are good at, it’s counting. And in a country like Brazil, with approximately 156 million voters, counting votes “by hand” would be extremely slow and inefficient (how many times have you botched an arithmetic calculation done by hand?). In the 1989 presidential election between Fernando Collor de Mello and Luiz Inácio Lula da Silva, counting the votes took nine days. Nowadays, however, we can finish an election and get the official result on the same day. Again, computers are good at counting.

• Paper ballots aren’t safe: As you probably know, paper isn’t a very robust material. Paper ballots can be lost, misplaced, tampered with, misused, stolen, and anything else you can do with paper. For example, the 2000 US presidential election used Votomatic-style machines (which are nothing more than a mechanical device that punches holes in a paper ballot). However, in Florida, due to some machine malfunction (maybe the punch got dull), many ballots had “incomplete holes,” and the tabulating machines didn’t count those ballots (the holes just weren’t there to begin with). In other words, some votes weren’t taken into account.

• It’s cheaper: Electronic voting lets the government cut costs. Every day you have to “count ballots” carries an associated cost. You need people to oversee it, people to oversee the supervisors, security, food, logistics, etc. Electronic voting can reduce all of that to a single day of work.

• No vote is left behind: Electronic voting is one of the most reliable ways of ensuring votes aren’t lost. Electronic information can be stored, protected, and counted robustly. Imagine using paper (instead of an electronic card) for your public transit pass. Which one turns into “mush” first after a heavy rain?

• Brazil is a model for electronic voting worldwide: Brazil is currently among the few countries, alongside India, where electronic voting is the standard. Many scholars cite Brazil as “ahead of its time” and “a model to follow,” standing at the forefront of the electronic voting movement. Moreover, paper voting is one of the most criticized, easiest to manipulate, and most vulnerable of existing voting systems.

Now, since this is clearly a “pro electronic-voting post,” let’s try to answer some of the common questions raised by people who oppose electronic voting.

• How do we guarantee one vote per voter? In Brazil, a photo ID is required to vote. Before voting, poll workers verify the voter’s identity, and once confirmed, the voter is (literally) removed from the list of “voters yet to vote.” On top of that, 75.52% of voter identification in Brazil involves biometrics.

• How do we guarantee anonymity? The Electoral Roll isn’t public, and the order in which votes were cast isn’t recorded, making individual voter inference impractical.

• Can we trust a machine that gives us no paper proof? Brazilian electronic ballot machines produce paper records called “zerésima” and “boletim de urna” (ballot bulletin). The zerésima guarantees there were no votes in the machine to begin with (“this machine had zero votes at the start”). The boletim de urna gives you a vote count that can be matched against the number of voters present at a given polling station. Both documents are published on the TSE’s website and via the Boletim na Mão app.

• But what if poll workers vote for people who didn’t show up? Poll workers are randomly selected and never work alone. For something like that to happen, an entire team of randomly selected people would have to coordinate the attack, evade the police forces monitoring polling places and voters, and be willing to face the consequences of an electoral crime (voting in someone else’s place is a crime punishable by up to three years in prison — art. 309 of the Electoral Code).

As you can see, I haven’t yet addressed the problems related to “voting accuracy,” “counting security,” “fraud prevention,” and “rigged voting machines.” So, how can we guarantee the robustness of this whole “black-box” system?

Through Randomness and Auditing.

Auditing “Black-Box” Systems 🔎

In Brazil, research and development of electronic voting systems is funded and maintained by the Superior Electoral Court (TSE). The code for these machines hasn’t been released to the general public, but it is accessible to certain interested parties, such as the Armed Forces, Political Parties, and the OAB (Brazilian Bar Association).

One of the reasons the software isn’t “publicly available” (technically it is available to representatives of the Executive, Legislative, and Judiciary branches) is that this lets us achieve “Security through Obscurity.”

In other words, “it’s hard to attack something you don’t know how it works.”

However, security through obscurity alone is discouraged and not recommended. We need more than that (and we have it). So, how can we be sure the code running on the voting machines is working the way it should?

Simply put, we hold a simulated election before the real one and verify the results. The process works as follows:

1. On the eve of an election, election officials in each state draw several ballot machines by lottery, and instead of being used at actual polling stations, these selected machines are kept at the headquarters of each Regional Electoral Court for a “simulated voting session.” This session is carried out for auditing purposes in the presence of representatives appointed by the political parties.

2. The simulated voting happens on the same date as the actual election (making it harder for any software update to be slipped in after the audit). During this simulated voting session, the votes entered into the machines are not secret. They are witnessed by all party representatives present in the auditing process (everyone knows how many votes went to each candidate). The political parties decide on a random number of votes to enter into the machine for each candidate. The entire process is filmed.

3. The number of votes decided by the parties is decided on the spot (nobody knows it beforehand). The only way for it to be known by others is if there is collusion between rival parties.

4. The votes are then entered into the machines, and electronic vote counting proceeds. The result produced by the ballot machine’s software has to match the random number of votes decided by all parties.

5. Since the machines are chosen at random, the reliability of the ones tested is considered representative of the reliability of the rest (something that has held true in every election so far). If the audit fails to produce a match between the counted votes and the sum decided beforehand, the entire election in that state would be voided.

This is a sort of “zero-knowledge proof” of the integrity of our voting system. If all the premises and steps outlined above can be accepted (and they can), we can all agree the machines are secure without needing to open up the source code.

OK. But transparency matters. And we would like to know the source code. Unfortunately, ordinary citizens can’t have that information at the moment. But representatives of the three branches of government can. Given the reports delivered by these various organizations (we’ll use the Armed Forces Report for this blog post), what can we learn about the robustness of our ballot machines?

Looking inside the Black Box ⬛

As far as is known, TSE voting machines run on the Linux operating system (nicknamed UEnux), and the proprietary software that handles counting and recording is not disclosed (around 17 million lines of code written in C or C++ - probably).

The machines have many redundancy mechanisms to ensure data isn’t lost or tampered with. For example, as already mentioned, the “boletim de urna” leaves a paper record that can be used to verify the votes of a given machine (also checking whether the vote count matches a given registration area). All of this information is made publicly available here and here.

All the results from the ballot machines are also stored on a hard-disk device called “mídia de resultado” (results media), similar to a USB flash drive. These devices run special software and can only communicate with machines that also run the software owned by the TSE. So, you can’t plug this drive into a regular machine, guaranteeing that its contents cannot be altered by third parties (unless they have access to the up-to-date TSE software and encryption keys).

Once the voting session ends, both the “mídia de resultado” and the “boletim de urna” are taken to the local electoral registry office. There, the drive is connected to a computer that has the correct software and keys, is verified and compared against the paper-trail copy, and then the data is transmitted to the Superior Electoral Court (TSE) in Brasília.

In cases where the drive is lost or destroyed, the electronic ballot machines used in Brazil have further safeguards beyond the paper record (the machines themselves keep a record of votes on internal and external memory cards). The only way to lose votes is if the entire machine (before the “Boletim de Urna” is generated) is completely destroyed or stolen (something that, to this day, has never happened). If a machine breaks down, the memory cards can ensure the data (the votes) is transferred to a new voting machine.

In terms of cryptography, the TSE software uses the same techniques to guarantee legitimate identities as online banking apps do. All information, from the votes themselves to the data stored on the machines, is signed using digital signatures, meaning asymmetric encryption methods.

In short, digital signatures are used to verify the authenticity of an electronically sent message, such as a vote, or the tally of all votes on a given machine. Cryptographic algorithms like RSA let us guarantee that a given piece of data can only be modified by the owner of a given key. If you want to learn more about asymmetric cryptography and the standard used for any verification step in cybersecurity, check out these two links.

Just like all digital messages, credit card transactions, and online purchases, votes are also verified using public-key cryptography techniques. Each vote can only be cast by a given key (associated with a unique voter ID number), each machine is tied to its own key, and the only way to “obtain these keys” is to break an encryption key (via brute force) within an extremely short window of time (these keys aren’t static — they’re generated dynamically). If you want to understand just how practically impossible it is for computers to break encryption keys of a given size, check out this video.

In short, all the data held on an electronic ballot machine, as well as all the results it produces, are protected by digital signature. It isn’t possible to modify candidate or voter data present on these machines. This information depends on a combination of keys that (literally) no one has access to, having been generated during the Signing and Sealing Ceremony of the Electoral Systems.

But couldn’t the keys be hacked? Again, breaking an encryption key via brute force takes (much) longer than the voting period itself. Furthermore, voting machines use air gaps to defend against attacks. This means the machines don’t even have the hardware needed to connect to something like the internet. They’re just boxes that count votes. They don’t have a radio or wifi antenna. The Linux operating system on the machines is configured by the TSE to include no software mechanism that allows network connections or remote access.

By the time votes are transmitted to the TSE’s supercomputer in Brasília, everything is already encrypted. And as far as we know, there are no viable attacks that could be carried out against public-key cryptography techniques within the time window that would be needed to tamper with the encrypted data/votes. Moreover, the data received must match the paper record, which is a physical record of the votes.

Additionally, you can’t alter the source code of a single voting machine. The TSE uses modern version-control tools to check whether the electronic ballot machine’s source code has been tampered with. Only a restricted group of TSE staff and collaborators have access to the source-code repository and are authorized to make changes to the software. The software used in the elections is the same across all of Brazil and is under strict TSE control, overseen by all three branches of government.

But what if the TSE has rigged machines with different source code? If they control the source code, couldn’t they make the machines do whatever they want?

No, they can’t, and that’s exactly why we have our simulated voting session before the elections.

Yes, the TSE controls the software, but the software itself is audited by representatives of every political party, the OAB, and the Armed Forces. Since the machines used in the simulated voting session are chosen at random, the TSE could not know in advance which voting machines to safely alter without anyone noticing.

At the same time, it’s not as though a small group of developers has total power over the ballot machines’ source code. All of the TSE’s work in this area is compartmentalized. In other words, the team responsible for the machine’s software isn’t the same one responsible for the counting system. The team that commits the source code isn’t the same one that reviews and tracks that commit.

From an attacker’s point of view, the number of electoral systems involved in running an election is so large that it’s impractical for an insider to have a level of knowledge of the whole system that would allow them to carry out any kind of attack.

Regardless, what would it actually take to pull off such an anti-democratic act?

What would it take to rig an election in Brazil? 🐱‍💻

Let’s list all the systems used to ensure a black-box system (like the electronic ballot machines) is applicable in a high-stakes situation such as Brazilian elections:

• Multiple Redundancy: the entire vote-counting system has redundant verification mechanisms to ensure that (1) all information matches; and (2) information cannot be lost.

• Code Auditing: political parties, the Public Prosecutor’s Office, the Armed Forces, and the OAB can follow the software’s development by inspecting the source code.

• Functional Auditing: The function of the ballot machines can be audited and tested before the election. A kind of “zero-knowledge proof” lets stakeholders and regional electoral courts test the integrity of the machines by randomly choosing which ones to test.

• Cryptography: Public-key cryptography ensures that information recorded/transmitted by the ballot machines cannot be altered.

• Air Gap Security: Voting machines lack the hardware needed to allow them to communicate with other unauthorized machines.

• Security through Obscurity: Since outside agents don’t know how the ballot machines work internally, real-time attacks become extremely difficult during the short window in which the machines operate online.

• System Incompatibility: election officials cannot bypass the software and hardware that make up the machines. Only specific machines (with specific software) can be used to retrieve the information stored inside them.

Now, let’s imagine for a minute how one could rig an election in Brazil.

First, we’d need to alter some (or all) of the electronic ballot machines (software and hardware). Since the development of the machines is compartmentalized, this isn’t a “one-man” job. It’s a team effort that would require espionage and infiltration.

Many people, working toward the same goal, would have to infiltrate many different (highly secure and monitored) government offices, staying in contact with one another without getting caught. And let’s imagine this highly motivated team managed (by some miracle) to control the final “commit” of the source code and the final build of the machines.

But this team still needs to pass a voting test (“the simulated election”). If, for example, the generated code and machines had some kind of configuration able to detect whether they were being “monitored for auditing purposes” or used for “real elections” (as in the Volkswagen emissions scandal), they might be able to fool the auditing procedure.

Something like this could only fool the simulated voting session if every single machine had been tampered with (which would be extremely difficult to pull off). If only some of the machines were tampered with, getting only the untampered machines selected for the simulated vote would come down to luck.

But let’s suppose our team is wealthy and managed to bribe every state in Brazil. All the regional electoral courts are in their pocket. And they were able to ensure only untampered machines got selected. Or let’s suppose our team of spy hackers infiltrated every single organization that safeguards the development of the TSE’s proprietary software and hardware, turning every machine into a rigged one.

But now we (somehow) have to hide all of our work. These changes could still be detected during the source-code audit (carried out by political parties, the Public Prosecutor’s Office, the Armed Forces, and the OAB). So, we’d have to have representatives of all of these organizations in our pocket too. How much bribery, threats, and espionage would that take? A lot.

By now, the reader probably has enough information to understand the herculean task involved in rigging an election in Brazil. The whole system is designed to have as many fail-safe points as possible. “Hacking” the election isn’t a one-person job (not even a 100-person job). It would require a level of intelligence, espionage, and corruption that is nearly impossible to hide. Operations like this could collapse if even a few insiders came forward.

In the end, as an attacker, once you look at all these security measures and redundancies, the first thing that comes to mind is: “it’s not worth it…”

If you want to tamper with or interfere with an election, the “easy way” (as almost every political party does) is to invest all that money that would go into a “doomed spy-hacker mission” into disinformation and marketing instead.

In trustworthy applications, where encryption and end-to-end protection are guaranteed, you don’t attack the servers or the machines. You attack the endpoints. We attack people. That’s why more than 90% of all cyberattacks are “social engineering attacks”.

So, could someone actually hack the elections in Brazil? Not really. Not in the sense of it being likely. The amount of effort required to tamper with elections undetected would have to rival (and exceed) events like the Stuxnet exploit (a nearly 10-year project orchestrated by foreign countries against Iran’s nuclear program).

But what about the vulnerabilities presented in the report delivered by the “Armed Forces Team for Oversight and Auditing of the Electronic Voting System (EFASEV)”?

What vulnerabilities?

Let’s look at the main points raised in this report:

1. The EFASEV report has many complaints about not being able to test the source code. And to be fair, the STF only allowed a static analysis of the code, not a dynamic one. Honestly, it’s hard to find vulnerabilities without some amount of tinkering. However, that isn’t the same as saying vulnerabilities exist in the code. If they do, they weren’t detected by the EFASEV report.

2. Questions were raised about whether the source-code version could be changed after the audit (a commit being run later or reverted). However, it was verified that the digital signatures on the commits matched those signed at the Sealing Ceremony. In other words, the audited code was the code that was used.

3. EFASEV concluded that the security test regarding the Biometric Pilot Project was inconclusive, since voter adherence to biometrics wasn’t in the 75%–82% range. Biometrics is still being rolled out, but an inconclusive result doesn’t mean there are irregularities. It means it wasn’t possible to certify the machines’ security based on a small sample (not representative of Brazil’s voting population).

4. During “Compilation, Digital Signing, and Sealing of the Electoral Systems,” the whole system is brought “online” to allow every machine to be updated with the same software. According to EFASEV, this is the only moment where there could (hypothetically) be a security breach (when the machines are online, updating the source code to be used).

5. All other components, such as the generation of the “Result Media,” “Boletim de Urna,” and the “Zerésima,” were found to be secure (no vulnerabilities were found).

To be fair, I agree with the part of the EFASEV report that says “without dynamic testing, a complete security analysis cannot be carried out.” However, that doesn’t mean the TSE doesn’t run dynamic tests (it does). Would making the source code available outside of controlled environments to third parties pose risks to the source code’s integrity? Probably. Is that risk small enough to justify “fully opening up” the source code used by the ballot machines? Unknown.

Transparency and reliability are sometimes at odds. Finding the gray areas where these principles don’t communicate very well is part of the whole debate around ethics and security in information systems.

Still, is this “possible vulnerability” presented in the EFASEV report enough to make us doubt the Brazilian electronic voting system? No.

Again, the amount of hacking, engineering, espionage, and corruption that would be needed to “modify the source code” in the brief window in which it’s being uploaded/downloaded to the machines is “excessively large.” Several zero-day exploits would have to be used and abused by attackers (in a way that wouldn’t raise suspicion). Even as an inside or outside job, it’s not feasible.

As mentioned above, nowadays, if you want to attack these kinds of systems, you don’t go after the system. You go after the endpoints (the voters). The spread of disinformation and vote-buying is a far more serious threat to our democracy than “hacking.”

A multi-billion-dollar conspiracy with several infiltrated agents would still face an (impossible) task in tampering with the election. But with a few million, a political party could automate the spread of disinformation and targeted marketing to distort voter perception and gain support, as has been done once, twice, three times, and who knows how many more times to come.

If you don’t know which side to take in this debate, let philosophy help you with a priori simplicity.

“The simplest solution is almost always the best.” − William of Ockham

What’s more likely (the simpler explanation)? A multi-billion-dollar conspiracy with several infiltrated agents breaking robust public-key cryptography? Or that in a polarized country like Brazil, a candidate won by 1%? 🤔

What do you think?