Brazilian voting machines and my erosion of trust in institutions
An episode of institutional malfunction and embarrassment
Preface
This is an article about recent quarrels between the president of Brazil, Jair Bolsonaro, and the Brazilian Electoral branch of the Judiciary over the safety of Brazilian voting machines, its effects on other institutions such as the Press and my general erosion of trust in institutions as the aftermath.
I am a software engineer born, raised, and living in Brazil. This article is intended for people willing to accept what the reality of voting machines is — as per experts in computer science, not anyone else (links provided for interested ones).
I tried to make this for all audiences, from people who loathe Bolsonaro to those who adore him and everyone in the middle. I'll start this article with a humble request: do not let your political preferences interfere with your reading. There’s plenty of criticism for everyone in this article, so if you feel like your group has been poorly represented or overly criticized, keep reading to see the other side. But this is not about specific persons or political groups; it’s about institutions not doing what they’re supposed to do.
How the quarrel started
As far as I can remember, Bolsonaro and his supporters brought up that if he didn’t win the 2019 elections, it could only be due to fraud, conducted by modifying voting machines.
After he won, he dismissed it saying something like “I would’ve won with more votes had it not been the voting machines” but didn’t care to push this agenda any further and started his government.
At some point in 2021 during his mandate, he brought it up again. At the time many political analysts and journalists credited it to his declining popularity, and at that time a strong political opponent — Lula — had been declared innocent (by either some form of a mistrial or lack of evidence, but memory isn’t serving me well anymore) and could run again for president.
Things got very hot around August 2021 when Bolsonaro and political allies had a project to be voted on that would add VVPAT (Voter-Verified Paper Audit Trail) to Brazilian DREs. On the same day the project would be voted it was arranged for a military parade — including tanks — to happen right in front of the buildings of Congress and the Supreme Court, in what really felt and was described by everyone as a “fight” between powers (although in a very complicated relationship, the military is known in general to be very supportive of Bolsonaro, a former captain himself).
Bolsonaro’s supporters rallied online to be there on the same day, but despite a lot of anticipation and fears of an anti-democratic escalation, the whole thing turned out to be very timid.
The VVPAT project didn’t pass, and after that day everything cooled down a lot. It felt like Bolsonaro realized he didn’t have the support he needed to do what he wanted.
Amidst all this, the Press and society (mostly through social media, I believe) discussed electronic voting and ballot counting. The Judiciary also acted in defense of Brazilian DREs.
Let’s look at that discussion in more detail.
Bolsonaro and his supporter’s claims
I’ll keep this section short. Bolsonaro, or at least his supporters, shared all kinds of lies through social media. The most sensationalist and obviously false “Someone has revealed it”, “It is all a lie”, “It is all a plot” kind of claims were shared without a second thought.
Bolsonaro himself said several times he had proof of fraud but always diverted when called out by authorities to present them.
At one time, some random system from TSE (Superior Electoral Court) was hacked, and Bolsonaro pointed out this was proof that voting machines had been hacked once.
Among all lies and illogical conclusions, one thing was said and was true: that DREs without VVPAT are a very risky business. Their project in Congress wasn’t even bad itself, which I’m sure surprised a lot of people.
My interest as I continue to write this from here on is to discuss this last claim. The only one I remember coming out of Bolsonaro and his supporters which happens to be true. It also happens to be a very important claim.
Are Brazilian voting machines really unsafe?
Let us ignore politics, parties, who we like or dislike and reference only computer science specialists about this: the answer is a strong "Yes", they are not safe on their own.
There is abundant evidence and consensus among experts that it is unfeasible to keep software systems provably safe in general, and relying exclusively on them means having a central (or at least very localized) point of failure for the entire voting process.
The usual approach for critical systems is not only to be extra careful and spend more resources on safety but also to add redundancy and independent verification systems, which is what VVPAT is for. Such mechanisms are our best protection against both hacking and internal tampering. I'll not go in-depth into this discussion, as my interest is to discuss how institutions and society debated this question.
If you're interested in the technical analysis, a few links are provided below, although more links will appear throughout this article:
- https://en.wikipedia.org/wiki/DRE_voting_machine
- https://blog.mozilla.org/en/mozilla/leadership/why-getting-voting-right-is-hard-part-v-dres-spoiler-theyre-bad/
Summary of Brazilian voting machines and their presence in Brazilian culture
The Brazilian DRE voting machine in the image above
Don’t quote me on this as I’m sure this is not very precise, but the Brazilian DRE voting machine was developed in the ’90s to make vote counting quicker and safer; one of the problems at the time was no anonymity in voting and easy tampering of paper ballots if I understand correctly. The DRE machines were very successful at addressing those problems at the time.
I and everyone born in the mid-80s and 90s grew up seeing propaganda of the Brazilian voting machines on TV and hearing them on the radio. I just heard a new one on the radio a few weeks ago, saying something along the lines of “the voting machine is the path and Democracy is the road”. Oh, found it on Facebook.
Before being highly politicized by Bolsonaro, voting machines were a reason for pride in Brazil. Even after the whole quarrel, my guess is most Brazilians have forgotten about it and don’t care too much. There are many memes even making fun of USA’s ballot-counting process.
In the meme above, left side in a very liberal translation: “Elections BR - 5 hours later a winner is announced - 6 hours later everyone’s already drunken happy or sad - 7 hours later first impeachment request - 8 hours later negotiating with political groups”. On the right: “Elections USA - Don’t know how to count”.
This is a page from a widely circulating magazine with more memes if you are interested: https://guiadoestudante.abril.com.br/estudo/memes-eleicoes-eua/
The Judiciary's attitude
In public security tests conducted in 2017, Brazilian computer scientists that have studied our voting machines for some time were able to hack voting machines with an arbitrary code execution bug (see https://www.researchgate.net/publication/323470546_The_Return_of_Software_Vulnerabilities_in_the_Brazilian_Voting_Machine?channel=doi&linkId=5a9761de0f7e9ba42974d0c9&showFulltext=true), an extremely dangerous kind of bug. They demonstrated this by changing a string rendered to the screen and were in the last minutes of the last day of testing able to change a AddVote() function used by the software. The bug was later fixed, of course, but look at TSE’s twitter summary of that year’s edition:
“The Public Security Test (#TPS) of 2017 brought about two important improvements to the electronic voting system stemming from the contributions of investigators: @TSEjusbr improved the machines’ media’s cryptography and improved the digital signing mechanism”
All of it is factually true but extremely dodgy. It should really have been closer to “Grave arbitrary code execution flaw fixed”. I can’t find it now, but some authority said at the time that “they would’ve detected this kind of attack after the elections”; but that is such an absurd response! What then? Let’s try one more time, and this time we promise it’s going to be ok, our machines are truly magnificent, after all! It’s been hard for me to take the Judiciary seriously after this.
If I remember the dates correctly, at the height of the disputes between Bolsonaro and the Judiciary, TCU (Tribunal de Contas da União, an institution responsible for auditing the Federal budget) emitted a report saying voting machines could be audited in all stages and are perfectly safe (article from 2021-08-11).
Why in the world would an institution that concerns itself with producing reports on budgetary issues — e.g. pension systems — feel like it had any say in such a technical matter? This was a turning point in my general confidence in institutions (plural). What is the point if they reinforce — instead of check or act independently of — each other, and what is the point of them analyzing strictly technical questions they have no competence in? This had a strong smell of political contamination.
The then-president of TSE, Barroso, lobbied frequently in Congress in defense of DREs without VVPAT. He also frequently misrepresented VVPAT as if it were going back to old paper ballots, and said things like “The DREs are not connected to the Internet, which makes them very safe” (article from 2021-06-09). I never found any occurrence of him addressing criticism from the scientific community, though.
The Press
I’ve always thought the Press was an institution whose aim was to seek the truth, no matter whom it might hurt. The coverage of the professional Press — which I still pay to read because it still is the best source of information I know — was most frequently technically wrong, often misleading, nearly always devoid of any investigation. Few articles were technically correct and showed the journalist had done their investigation properly.
To clarify what I mean, I googled for articles containing “urna eletrônica” in Brazil’s major news outlets and came up with this table after selecting a few articles from my searches (I strongly recommend you do this as well because I did skip news articles I thought contained almost no analysis and were purely reporting political events related to the urnas eletrônicas, so beware!). Also, I don’t know how to make tables on Substack, so this is a screenshot. Sorry.
* The only interviewed computer scientist says something along not believing there has been fraud, but that the voting machines' technology must be discussed in all seriousness. "The voting machines must evolve, but the debate has been contaminated by politics"
** Fact-checked that "Brazil is not the only country to use voting machines without VVPAT". True, and a lie spread by Bolsonaro’s supporters. However, it adds up to the fact-checking articles that address trivial lies without addressing the most important point.
Links for those who are interested links follow in the same order as in the table above:
https://piaui.folha.uol.com.br/lupa/2020/11/16/verificamos-urnas-eletronicas-votos/
https://piaui.folha.uol.com.br/lupa/2021/05/19/verificamos-brasil-urnas-eletronicas-voto-impresso/
I know this is not a sufficiently large selection of articles for any kind of conclusion taking. I was, in fact, surprised to find so many articles reaching the right conclusion, though I suspect if I had searched more I’d find a worse proportion of bad articles. But I could be wrong, so do your own research if you’re suspicious!
At some point, the different declarations by Bolsonaro — most of them false, but an important one true — got all mingled together in journalism and any reference to the quarrels was contextualized as an institutional fight against fake news.
It is very reasonable to be wary of what a serial and aggressive liar such as Bolsonaro says, but to assume falsehood upfront and skip all decent investigation is terrible. Add that to taking the Judiciary's word as truth means the Press fundamentally did the opposite of what it exists for: it became a one-sided replicator instead of an investigator.
But there are articles interviewing real specialists about this. So I wonder what happens inside a professional news outlet; do journalists not talk among themselves? Or is it even worse and they discussed this but chose to ignore specialists for ulterior reasons?
In any case, it's all terrible, and my confidence that I'm being well informed when reading articles not in domains of my expertise (almost all of the news I read) plummeted. I'm no longer able to assign a reasonable degree of confidence to many subjects. I’m afraid of fact-checking articles misleading me. When asked things of almost any nature, my most frequent response these days by far is "Erm… Yeah.. maybe.. I don't know". My wife even scolded me for it these days, saying it makes it seem like I don’t care for anything anymore. But really, how can I parse through so much bad journalism?
Conclusions
It’s hard to trust so many things at this point. Adding more checking would of course be nice, but how can we trust these new efforts won’t be contaminated by politics as well? Even if I had all the power in the world, I don’t know what I could do to fix this situation. The only suggestion that comes to mind is for everyone to calm down. Too much political attachment and tribal thinking are screwing all the good things we have.
On the specific episode of voting machines, these are roughly the ways out for Brazilian society that I can see now:
- Keep the unsafe voting machines until time wears out political passion and thins our memory of these events sufficiently that pride and tribalism are forgotten, putting the institutional embarrassment this was behind us, and then reform our voting system.
- Wait for Bolsonaro to leave office, engage in massive collective hypocrisy and pretend something's changed to then start reforming the system.
- Engage in massive collective stupidity and insist that our voting system is great while keeping it and hoping for the best.
- Put pride aside, have institutions and Bolsonaro recognize their mistakes and lies (a mea-culpa) and engage in constructive self-criticism, then reform our voting systems.
The sad part is it’s impossible to read that last option as anything other than a joke. I can only hope there are other options I’m not thinking of. I think, however, that my wife was partially right: I really don’t care as much anymore. And to be honest, the greater distance from daily journalism has been great.