In test of electronic voting, “hackers” attack Brazil’s system before 2022 elections

SÃO PAULO, BRAZIL – Since Monday (November 22),with the blessing of the Superior Electoral Court (TSE), twenty-six independent investigators from all regions of Brazil have tried to attack the electronic ballot box, and the Brazilian voting system, in a project dubbed the Public Security Test (TPS).

According to the TSE, by Friday (26), at least one of the ‘attacks’ had been successful.

“We were able to extract the data from the partitions that were encrypted inside the JE Connect Kit, which is like a pen drive, used to send voting data to the TSE”, Paulo César Hermann Wanner, an expert in federal crimes, was quoted as saying in the TSE website.

Over the past week, investigators worked individually, in pairs or groups to try to slip by the security barriers of the electronic voting process, identifying flaws and vulnerabilities so that they can be corrected in time for next year’s election general elections. The test consisted of 29 ‘attack plans’ on TSE servers to see how the systems react.

In its sixth edition, the event registered a record number of candidates seeking to “hack” the system, after Brazilian President Jair Bolsonaro expressed his concern regarding the attackability of the electronic voting system, pointing out its vulnerability to electoral manipulation.

“There is no way to prove that the elections were or were not rigged. (But) There are signs,” he declared in July of this year during his weekly video broadcast, showing videos that suggested it was possible to hack the source code to compute the vote of one candidate for another.

Earlier that month, the national newspaper Estado de S. Paulo ran a story in which Bolsonaro’s defense minister had supposedly stated that the 2022 election would not occur unless printed ballots were used.

For TSE’s Information Technology secretary, Julio Valente, the record number of candidates demonstrates “society’s interest in constructing an electoral system that belongs to the Nation”.

“This participation is very welcome and shows that Brazilians are willing to strengthen and make the Brazilian computerized electoral system increasingly safe and auditable,” Valente told journalists.

In practice since 2009, this year’s event will test the system’s security in the face of new technologies that are constantly emerging.

According to TSE president, Supreme Court Justice Luis Roberto Barroso, in addition to providing constant improvements in the electoral process, the TPS tests strengthen the reliability, transparency, and security of the casting and counting votes.

“That’s why it’s important to submit the electronic voting machine to attacks with new technologies to identify vulnerabilities,” he told journalists at the opening ceremony of the event.

Barroso pointed out that the Court provides the event’s participants with access to the source codes to carry out plans of attack to try to discover any vulnerabilities in the systems.

“We seek to improve systems through attacks from individuals, institutions, and good hackers, who want to try to undermine the different layers of system protection. It’s not a confrontation. It’s a partnership with society. These people are helping us to improve the system,” he concluded.

According to the TSE president, if TPS participants find any vulnerability during the execution of the attack plans, these vulnerabilities will be corrected. Those responsible for finding the flaws will be called upon later to verify that the issues have been resolved.

This year’s chosen ‘experts’ came from all fields and regions of the country.

Arnaldo Leao Souto Junior, who is a law professor and specialist in cybersecurity and “hackers”, says he is finding the experience of participating in the TPS and attacking the electronic voting system exciting, since he can “practice things considered illegal, like how to hack a system, with the consent of the TSE.”

One of only two women to be chosen for this year’s event, Attorney Lorenna Tredezini,
says that she applied to be part of the TPS investigators because she wanted to know how vulnerable the electronic ballots were to possible breaches of confidentiality.

“I plan to try to track the voting order to see if there is a possibility of a breach of confidentiality of the vote. It consists of three mock elections, and two have already been completed. Now, I need to increase the challenge and put combinations of different numbers to make this procedure more difficult,” she explained to local papers.

According to the TSE, upon completion of TPS 2021, the vulnerabilities found will be analyzed by an Evaluation Committee, composed of members from the Federal Public Ministry (MPF), the Brazilian Bar Association (OAB), National Congress, Federal Police (PF), Federal Council of Engineering and Agronomy (Confea), Brazilian Computer Society (SBC) as well as three academic and/or scientific experts.