Brazilian hacker claims Bolsonaro asked him to hack into the 2022 voting system

That's not correct. While you can't get it from GitHub, there is a process to audit it and any Brazilian citizen (or resident, I'm not sure) over 21 can request and be part of it. The process extends for many months starting the year prior to the election. Input from the multiple audits and tests are valuable in guiding the evolution of the software and hardware.

In Portuguese: https://www.tse.jus.br/internet/temporarios/urna-seguranca/o...

Electronic voting is a good idea here because it raises the "barrier to commit fraud".

Basically, back when we ran our elections on paper, there was a lot of fraud as it's pretty easy to pull off fraud schemes.

With electronic voting, the system is so complex that almost no one can pull off a fraud scheme with two major expectations: voter intimidation and voter impersonation.

Although even that last one is getting tougher as we now scan peoples' fingerprints. The poll worker can manually override the system but this will be recorded and they will be in hot waters of they override too much.

Yes, in theory non-electronic elections are more secure, but in practice it's more complicated as we are dealing with a country with a horrible history at implementing rule of law and we have a significant amount of local authoritarian leaders (e.g. drug lords) that would definitely make it near impossible to run paper elections fairly.

for instance it's in our constitution that after the identification that someone can vote, the vote MUST be anonymous. even on the paper time. unlike votes by mail where you have identification (we simply can't have here, for instance)

I'm skeptical on many things, but what you said is much harder to happen than just buying votes on poor neighbourhoods or influencing local militias on our second biggest city.

This is less far off from reality specially for legislative positions.

It's much easier to attack a democracy through disinfo campaigns and sponsoring coups. It was like that in the ousting of Dilma in 2016 (yesterday yet another court of law ruled she didn't commit an impeachable offense). Far-right ultra-nationalist propaganda has been used - with enormous success, I must add - to destabilize both countries like Brazil up to the whole EU (Brexit, anyone?).

In Brazil we are amidst a scandal that points to the president himself ordered higher highway patrol enforcement specifically in regions where the opposition candidate was expected to win more votes, in an attempt to limit participation in those specific demographics.

> What we try to do is to make hacking not worthwhile by raising the difficulty level.

I worked in the 2002 election (for Unisys, who made a lot of the voting machines) and the machine itself, its software, and all the handling protocols around it are designed to make hacking it a very high-effort/low-return affair. As I mentioned before, there are many ways to push an election they way of a candidate, but, in Brazil at least, none of those pass through the voting system.

Can you explain how you expect those countries to be able to achieve that, and why the experts in Brazil would be unable to counter those mechanisms?

People invalidating valid paper votes on 80s were a thing, impossible to prove, unlike the auditing we have today.

It's not online also, it's offline with uploaded encrypted data through encrypted channels.

Same used to be the case in Brazil. In fact, the people counting the votes were members of the public, chosen prior to the elections.

I know quite a few who have been in vote countings. The stories they tell are not very reassuring.

Electronic voting was and is a major source of democratic stability in Brazil.

Edit: to those downvoting (fair game, it's your vote to cast!), care to explain your reasons?

I (I worked in the Brazilian electronic voting system in 2002) agree. That's why the voting machines can't connect to the internet and voting is completely offline (totalization is entirely based on signed files in flash cards transferred via sneakernet under strict chain-of-custody protocols).

Another aspect of the election that's very important in Brazil is secrecy of the vote - to the point that, if a voting machine records only votes to a single candidate (effectively disclosing the option of all its voters) it's either discarded or merged with another machine in the same polling place.

Voting machines in Brazil are not online, there are no plans for online voting as far as I know.

Even though paper voting is not perfect and has its own issues it offers several distinct advantages over electronic voting (whether online or offline):

(1) Paper voting and counting is inherently manual process. Therefore, election fraud (ballot tempering, stuffing, etc) is also manual and is hard to scale up.

(2) Because paper ballot fraud at scale involves many people it is harder to hide and easier to uncover and prove.

(3) Because of its simplicity, election observers can go deeper in the paper counting process and in some cases (e.g. Ireland) participate in counting and publish their own numbers providing additional independent confirmation.

(4) Chain of custody of physical objects (paper ballots) is easier to understand for an average people and easier to track for an average election observer.

(5) The last and the most important -- it is easier to audit and explain to skeptical and bitter supporters of the loosing party that it was a fair fight and their loss is legitimate. Without this last point everything else is meaningless no matter how objectively better it is.

It’s funny how all of sudden the forward thinking, all-digital tech community turn itself in old school conservative when discussing digital elections without even considering the bigger issues with alternatives.

It was largely attributed to the fact that incumbents did not know how to “hack” this new system (yet?) but were pretty adept at cost effectively manipulating paper ballots.

For example they would infiltrate remote areas with little to no observers and stuff the ballot boxes.

Once the new electronic voting system was introduced, suddenly they didn’t know what to do, so the votes ended up more representative, e.g. much closer to projected numbers than before.

Now the system is “electronic counting + paper ballot” So you still go to a voting place, there are still independent/multi party observers, there are still paper ballots available for recount, but you have cryptography on top of it to prevent traditional tempering.

It turned out, although it was air-gapped, it was susceptible to an attack against its update mechanism. Some white-hats showed it was possible to inject malicious code and change the results.

You never know. That's the essence of the problem.

> Delgatti said he met with Ministry of Defense technical experts to discuss the electronic voting system on five occasions. The first time, he said, was right after meeting with Bolsonaro, when he was driven from the presidential residence to the Ministry of Defense, entering through the back entrance.

https://www.securityweek.com/brazilian-hacker-claims-bolsona...

MoD should be able to confirm or deny that the meeting took place. Possibly, from there evidence of wrong doing might surface. But then again, it might not.

He went as far as saying in an interview he'd hire a white-hat hacker to prove the election can be easily rigged via the voting system.