19-year-old hacker reveals how he rigged voting machines and election in Brazil

http://translate.google.com/translate?sl=pt&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.folhapolitica.org%2F2013%2F07%2Fhacker-de-19-anos-revela-como-fraudou.html%3Fm%3D1

by luizgrp • 13 years ago

91 45 13 years ago

translate.google.com

swah3• 13 years ago

Interesting how the "TRE" (entity responsible for the voting process) keeps stating the system is safe.

jturolla• 13 years ago

Interesting how people believe in completely random and untrusted sources.

swah3• 13 years ago

http://www.viomundo.com.br/denuncias/amilcar-brunazo-ridicul...

chewit• 13 years ago

Well what else would you expect them to be saying?

swah3• 13 years ago

"We're embarassed and propose the next one is open source"?

aylons5• 13 years ago

His allegations are easily disprovable or provable.

Every eletronic ballot in Brazil prints the vote count for each candidate before leaving the voting room. Several copies of this report are printed, every citizen may ask for each and political parties often do it. I do it for the ballot I vote.

However, he claims to tamper the results after that, during the data consolidation process, when data from every ballot is summed. So, to prove him right, it is only a matter of checking if the ends meet.

Apparently, they meet. No political party has ever contested the results based on this difference.

Not to say Brazilian voting system is infallible - there are many problem with it. But this is not one.

personlurking• 13 years ago

"Apparently, they meet." What makes you say that, if I may ask?

I noticed Globo/Folha/et al haven't reported on this despite it having been revealed in December of last year.

___

On a side note...

Anyone who speaks Portuguese, I recommend the documentary "Vocação do Poder", that follows 6 electorial candidates in Rio while on the campaign trail. http://www.youtube.com/watch?v=vI8_oz6lsbE

For those who don't speak Portuguese, search out the documentary "Send a Bullet" which looks at crime and fraud in Brazil.

aylons5• 13 years ago

You may go to the TSE website and check every ballot's vote count and check against the printed voting report.

Voters and political parties have access to the printed copies of each ballot's report, printed before the ballot leaves the voting room. I used to work at the elections and I know they do, indeed, request these reports even before the ballot even leaves the room.

If you want to check a posteriori, the reports signed by everyone who worked at the voting room, plus the political parties representatives, are available at the electoral courts for anyone to check them.

As no one, specially no losing political party or this very guy who claims to have tampered the vote count, has ever came with an inconsistent ballot report, I can say that apparently, this is not a kind fraud that happens.

As I said, there are many problems with the current e-voting system in Brasil. The machines are closed-source, and there are no way to check the vote during the voting process.

But once the reports are printed, they are as good as any paper ballot, as this report works as well as a traditional manual voting counting report. Actually, better, as we can print several copies of the report in a distributed way.

rslonik• 13 years ago

It was so much better when politics & conspiratorial stuff was only Reddit's business.

DaviNunes• 13 years ago

Secureness of Brazilian voting system has been contested many times.

There are "The Alagoas case" which the candidate Joao Lyra requested a recount because he found out 1/3 of the ballots contained incorrect data and then asked for an audit, the court demanded 2 million for this audition, Joao Lyra then asked the the court itself to pay for it, since it would be in its interest to demonstrate the fairness of the process, the court refused to pay and even condemned the candidate for "bad faith litigation" for asking for an investigation and not paying for it(despite showing inconsistent ballot data).

It's true, our eletronic ballot prints the report but there is no way to check if the sum of digital records are the same as the printed reports. We have no way to tell if our votes has been correctly collected nor the political parties that the votes were correctly summed, thus impossible to make a recount. In a voting system where you are not sure on whom your vote was recorded and the Election Court goes against political parties that accuse it, IMHO thats a true threat to democracy.

For a safer election it must include a voter-verified paper audit trail, a VVPAT allows voters the possibility to verify that their votes are cast as intended and can serve as an additional barrier to changing or destroying votes.

German and Holland Court already banned this first generation eletronic ballot box for not being secure enough, and Brazil is the only country on the world who still uses it.

aylons5• 13 years ago

It's true, our eletronic ballot prints the report but there is no way to check if the sum of digital records are the same as the printed reports

Yes, there is: you can check the electronic records online and compare it against the printed reports.

The other allegations are surely important to the voting transparency discussion, but are not related to the allegations on the OP.

sanoli3• 13 years ago

The problem is, if you vote for candidate X, there's no way of checking if your vote was really computed or tampered with by the machine. The report will print something like 'candidate X = so many votes', but beyond that you can't know if that number was altered. If you had individual printouts on a ballot along with the electronic vote, you could have the ballot counted, and know. What if some wacko starts claiming he accessed 50 voting machines and altered to switch 20% of votes for cadidate X into votes for candidate Y, as the votes are being cast? How do you check?

speeder2• 13 years ago

There is newer.cases, like a guy that took his family.to vote.for him, and claims he voted.on himself.and still.ended with zero.votes. He sued.TSE but the reply was that he probably typed wrong and confirmed.a.wrong person.

Since there is no per vote paper ballot, it.is.his.word.against the judge word, so guess who win.

dserodio2• 13 years ago

What's up with the period instead of a space to separate words?

cturner2• 13 years ago

Hey - I had an idea for how electronic voting could work.

Voters would enter their vote into a computer. The computer would print out a card for you, and show it to you from behind a perspex card. You would then say "OK" to verify that it was correct and it would drop into a box.

Now there'd be a physical copy of the cards. These could be counted and checked by scrutineers as the current electoral process works. They would need to do a manual count independent of the electronic count, and the judiciary could oversee a wrap-up ceremony where the two were compared for correctness.

In order to rig a vote and get away with it, you'd need to hack both the computer system and the manual count. Chavez could do it, but joe random hacker definitely couldn't.

But you'd get a fast, clear result for television purposes. Voting cards would not be ambiguously filled in the way they are now. And if you had a compulsory preferential system, as in some jurisdictions now, you could cause the software to enforce that in a way that isn't possible with manual entry at the moment.

im_dario• 13 years ago

Your idea is very similar to Wombat Voting: http://www.wombat-voting.com/

gamegoblin• 13 years ago

I don't know about other voting machines, but the ones here in Northwest Arkansas had a receipt of your vote behind plexiglass that you could watch print out as you made your selections. Pretty similar to what you suggest, except that I don't believe they use the paper for anything unless their is worry of fraud.

IanMalcolm2• 13 years ago

I worked in the last elections in Brazil.

Every machine (which is never online) prints a sum of all votes at the end of the day, and several copies are given out to those who are working the poll site.

So there is a hard copy of the votes, and anyone can check.

cturner2• 13 years ago

    > So there is a hard copy of the votes, and anyone can check.

I think it's not enough to have the ability to do a count. It needs to be inherent to the system. Think of it as being similar to double-entry book-keeping.

Otherwise you can come up with situations like that described in the comment elsewhere here by DaviNunes, where a request for a check cound was denied by courts. In that election - it wasn't true that anyone could check.

You'd get all the institutional protections of the current system. But you could minimise confusing/invalid ballot entries, and get a decisive election result for media purposes on the day of the election.

dudus• 13 years ago

This seem like a lot more complicated and expensive.

Why not just give the voter a unique hashed password that he can enter the internet and verify the vote that was computed for that password. Then the voters are the ones that will verify the election.

Retric• 13 years ago

It breaks voter ananimity which is vary important to avoid people directly paying for votes.

marcosdumay• 13 years ago

Because it does not make anybody sure that their vote was correctly added, and it will make it possible for the voter to prove to a third party how he voted.

a-priori2• 13 years ago

Or you could do it all by paper. I hate to sound like a luddite here, but there's simply no place for electronics in the electoral process.

Paper is excellent for ballots. It's easy to understand (put a mark next to whoever you want to elect). It's easy to collect (put ballot in a box). It's easy to count (have multiple people look at ballot, tally result). It's easy to secure (seal the boxes, keep them in a secure location). It's easy to verify (unseal the boxes, count again). It's tamper evident (examine ballots closely). You can ensure that the whole process is fair by having observers physically present each step of the process watching for shenanigans.

The only downside is that it's labour-intensive. But really, that's minor. Accept that as the cost of being confident in the election results. There are fewer things more important in a democratic society than free and fair elections.

flomincucci• 13 years ago

I actually work in a company that has a similar voting system. We print out a card, and we also burn the content of the vote in a rfid chip, that voters can check themselves. The rfid speeds up the counting, but you can always do the manual count to check up with the system. Neither the machine nor the card contain any information that can identify the person, so we can preserve the anonimity. Perhaps you can check out our site :) http://www.vot-ar.com.ar/en/system-votation/

leot• 13 years ago

http://www.scantegrity.org/

ttty• 13 years ago

They should put a public list of names and whom they voted for... Crystal clear and no doubts...

aylons5• 13 years ago

And perfect for manipulation and black-mailing.

diego_moita3• 13 years ago

The real issue here is not if voting machines are the perfect solution, it is about what is the better solution. And if anyone knows voter fraud in Brazil, these machines are a lot better than the manual system. At least it demands the people committing the fraud to be a lot smarter than they used to be in manual counting.

a1a• 13 years ago

I have no knowledge what so ever about voter fraud in Brazil, but I am pretty certain it cannot be worse than using voting machines (See: http://www.cs.princeton.edu/~appel/voting/SealsOnVotingMachi...). I think there is many things in this world that "needs a chip", voting is however not one of them.

diego_moita3• 13 years ago

This is the 3rd world, things work different in here, this is a 180 million people country with mandatory vote. Before voting machines elections would take almost a month to have their results computed. During all this time the ballots were subject to be stolen, inflated or replaced. This was very common in Brazil up until the late 80's. Stories like this are much more uncommon today.

jeltz3• 13 years ago

What kind of fraud was committed with the manual counting? Here in Sweden I would be more worried about electronic voting than the current manual counting, but social pressures vary across cultures.

EDIT: There have been both allegations and convictions of election fraud in Sweden, but never anything related to the counting of votes.

diego_moita3• 13 years ago

What kind of fraud was committed with the manual counting? Here in Sweden

Trust me, your country is very different from the rest of the world and I mean that in a good sense (such as a parameter of good governance).

This a country with more than 180 million people and mandatory vote, elections here are massive. Every time someone touches a vote there is a chance for it to be defrauded or replaced. In the past, stories of lost and inflated ballots and replaced votes where trivial. Because a lot of the voters are poor another trick was to give to the voter an already marked vote and demand the original valid one back so the candidate could buy a vote in a election.

sanoli3• 13 years ago

There used to be a separate printer attached to the voting machines, which would print each individual vote, in the presence of the voter, and would automatically go into a ballot, and it would be used in case there was an allegation of fraud. They of course did the dumb thing and did away with the printer, now they only have printouts of the total votes after the session is done and the machines are about to leave the place. From Wikipedia: "The 2002 version had a printer module that printed each vote, but the printed vote was abandond after Law 10.740/2003 and should only be reintroduced in 2014, according to Article 5 of Law 12.034/2009"

ramon4• 13 years ago

This is because vote buyers would ask for the receipt after the vote is concluded, to prevent this they do a unified printing.

sanoli3• 13 years ago

You didn't get to keep your receipt. You didn't even put your hands on it. It was merely shown to you, as it was leaving the printer, and would go on to a sealed ballot.

ramon4• 13 years ago

I think this is bull*, where are the logs? How did he manipulate the results? Did he use a API Call? From a packet interception? If then how? at what time?.. Did he call the application or the database? What's the server call in? Is it Webservice? You know.. It's a lot more questions than answers.. I think we need real proof of what the heck is going on before we assume this is real, he needs to be the ultimate master of manipulation in order for noone to have seen this since there are so many people comparing the printed results versus the final one...

IanMalcolm2• 13 years ago

This is old - and unverified - news.

This has been posted verbatim in several places already.

http://www.lucaspeperaio.com.br/blog/hacker-de-19-anos-conta... http://www.pragmatismopolitico.com.br/2012/12/hacker-fraude-... http://www.tecmundo.com.br/brasil/34010-em-evento-no-rj-hack... http://jornalistaflavioazevedo.blogspot.com.br/2013/01/hacke...

All from blogs. Not a single major news source.

This is, most likely, complete bullshit.

ramon4• 13 years ago

I agree totally its not real!

19-year-old hacker reveals how he rigged voting machines and election in Brazil

Related Stories