Brazil’s electronic voting: paperless machines, public tests, and the fight over a paper trail

Brazil’s electronic voting system uses paperless direct recording electronic (DRE) machines, the urna eletrônica, introduced from 1996 and, in the Supreme Court’s account, universal by 2002, administered by the Superior Electoral Court (TSE).⁠^2,1 Because the machines keep no voter-verified paper record, the TSE relies on source code review, Public Security Tests (since 2009), election day integrity tests, and poll tape checks; Brazil’s Supreme Court struck down a printed vote requirement in 2018 to 2020, and the Chamber of Deputies rejected a constitutional amendment for printed ballots in August 2021.⁠^1,2,3

In plain words

In Brazil, voters type numbers for their candidates into a voting machine and press a green button. There is no paper ballot. Results for the whole country come in within hours.

Brazil chose machines partly because paper elections there had a long history of fraud. But a paperless machine raises a question: if the software made a mistake, or someone tampered with it, how would anyone know? There is no paper to recount.

The electoral court answers with many tests: experts can study the code, researchers can try to hack the machines in a public contest, machines picked at random are tested on election day, and every machine prints a public receipt of its totals. Researchers have found real weaknesses over the years, and the court has fixed them. Some politicians want each machine to print a paper copy of every vote. The courts said one such law endangered secret voting, and Congress voted down another proposal. The debate continues.

Defined terms

• DRE (direct recording electronic) machine. A machine that records votes directly in electronic memory. The Carter Center notes that Brazil’s “pure direct recording electronic machine design places the onus of results integrity on the voting software”.⁠¹
• Voter-verified paper audit trail (VVPAT). A paper record of each vote that the voter can see before it is stored, so it can later be counted independently of the software.
• Software independence. A system property in which an undetected software error cannot cause an undetectable change in the outcome. A digital vote record produced by the machine itself is, as the Carter Center puts it, “not software independent”.⁠¹
• Registro Digital do Voto (RDV), Digital Record of Votes. A public file of each machine’s individual votes stored in shuffled order, which replaced printed records in 2003.⁠^4,1
• Boletim de urna (BU), poll tape. The printed totals each machine produces at close, posted publicly; since 2016 it includes a signed QR code.⁠¹
• Teste Público de Segurança (TPS), Public Security Test. A TSE event since 2009 in which approved researchers submit attack plans against the voting system.⁠¹
• Integrity test. An election day exercise, held since 2002, in which randomly drawn machines are removed and fed a recorded set of votes so the printed totals can be compared.⁠¹

What happened

Brazil’s move to machines began in the 1990s. The Supreme Court’s 2020 judgment recounts that the system was implemented gradually from 1996 and that a 2002 law ordering printed vote records was tried that year, especially in the Federal District and Sergipe; the court’s rapporteur in an earlier case described the experiment as “um fracasso” (a failure), and a 2003 law repealed the printing requirement.⁠² The Carter Center reports the TSE’s stated reasons: mechanical failures, voters needing help with jams that compromised secrecy, and evidence that “60 percent of voters did not actually look at the paper” in Rio de Janeiro state.⁠¹

Congress tried again. A 2009 law would have required printing by 2014; the Supreme Court declared it unconstitutional.⁠^2,1 In 2015, Law 13.165 added article 59-A to the Elections Law, requiring the machine to print each vote into a sealed receptacle “sem contato manual do eleitor” (without manual contact by the voter) and requiring the voter to confirm the printed record.⁠² The Prosecutor General challenged it in ADI 5889. On June 6, 2018, the Supreme Court suspended the provision, and on September 16, 2020 it confirmed that suspension and declared article 59-A unconstitutional.⁠² The judgment’s summary finds that the hybrid model “não mantém a segurança conquistada, trazendo riscos à sigilosidade do voto” (does not maintain the security achieved, bringing risks to the secrecy of the vote) because of the “potencialidade de identificação” (potential for identification) of the voter.⁠²

A constitutional route followed. PEC 135/2019 proposed requiring “cédulas físicas, conferíveis pelo eleitor” (physical ballots, verifiable by the voter) for audit purposes.⁠³ On August 10, 2021, the Chamber of Deputies rejected it in the first round, 229 yes, 218 no, 1 abstention.⁠³ Constitutional amendments require three fifths of the members of each house in two rounds,⁠⁵ so the proposal fell well short of the 308 votes needed in the 513 member Chamber despite a plurality in favor.

The 2022 general election took place amid what the Carter Center described as peak public distrust in the voting system, fueled by allegations from elected officials and the armed forces.⁠¹ The TSE created an Electoral Transparency Commission, widened oversight, and, at the suggestion of the armed forces and federal police, piloted the use of real voter biometrics in integrity tests.⁠¹ In October 2026, the Carter Center, which sent an expert mission for that year’s general election, said Brazil’s investment in voting technology produced “a robust and inclusive voting experience,” with results announced within hours.⁠⁶

How it worked

Brazil’s election day process, as researchers described it to an academic audience in 2012, runs in fixed steps: machines are loaded with software from flash media; a “zero” tape is printed before opening to show no votes; voters cast ballots; at close the machine writes the results media; and it transmits authenticated public products (partial sums, the RDV, and a log) to the central tally.⁠⁴ The Carter Center adds that poll tapes are printed and posted at each machine, with signed QR codes since 2016, and that the TSE publishes digital poll tapes online so anyone can compare them with printed copies.⁠¹ Voters are identified at the machine with biometrics where enrolled.⁠²

The TSE’s audit scheme, per the Carter Center, has five parts:⁠¹

1. Source code review. Reviewers nominated by oversight entities (parties, the bar association, prosecutors, police, the armed forces, universities and others) get 12 months before the election, but on TSE premises, with TSE-approved static analysis tools, no compiling, handwritten notes only, and nondisclosure agreements. In 2022, three public universities (UNICAMP, UFPE, USP) were allowed to examine code on their own premises with their own tools.
2. Public Security Test. Approved researchers propose attack plans to an evaluation committee; fixes are retested in a confirmation round.
3. Sealing ceremony. Final code is compiled and cryptographic hashes of source and binaries are published, so later loading can be checked.
4. Integrity test. Machines drawn at random the day before are run in a recorded parallel vote on election day.
5. Poll tape audit. Printed tapes are compared with published digital versions.

What the scheme lacks is a post-election check against an independent record. The Carter Center writes that “since there is no paper backup, there are no provisions for either risk-limiting audits or partial recounts of paper after election day”.⁠¹ Compare Colorado’s risk-limiting audits.

Evidence: measured findings

Brazil’s record contains both researcher-found weaknesses and official checks that found no discrepancies.

The 2012 Public Security Test. A University of Brasília team led by Diego Aranha found that the shuffling meant to protect ballot secrecy in the RDV used a weak pseudo-random number generator seeded with the time in seconds, and that the seed was printed in public products.⁠⁴ They reported “absolute success” recovering votes in the order cast in test elections with 10, 16, 21, and 475 voters, and noted that the log associates each vote with a timestamp, so knowing when a voter voted could reveal that voter’s choice.⁠⁴ They also reported shared encryption keys, keys in source code, insufficient integrity verification, and use of SHA-1.⁠⁴ The evaluation committee classified the attack as an attempt to cause “failure instead of fraud,” noted that it required physical access, and scored it 0.0313 on a 0 to 400 scale.⁠⁴

The 2017 Public Security Test. A later team reported that cryptographic keys “hard-coded directly in source code and shared among all machines” allowed full inspection of installation memory cards, that two shared libraries lacked authentication signatures, and that injecting code into them “allowed the execution of arbitrary code in the machine, violating the integrity of the voting software”.⁠⁷ They traced several weaknesses to the 2012 analysis.⁠⁷

The 2021 Public Security Test. The Carter Center reports 26 researchers, 29 attack plans, and five that “uncovered security-relevant issues, although none of them were rated as critical,” with fixes retested.⁠¹

2022 checks. On the first and second round days (October 2 and 30, 2022), 641 machines went through the standard integrity test and 58 through the biometric pilot in 19 states and the Federal District; the TSE reported no differences between poll tapes and the votes entered, though participation by voters in the biometric pilot was “consistently low”.⁠¹ The armed forces audited a sample of 385 poll tapes and the Federal Court of Accounts (TCU) audited 4,161; “neither the armed forces nor the TCU discovered discrepancies”.⁠¹ The three university code reviewers “stated that they had not found significant problems,” while noting that complete verification of roughly 17 million lines of code and “guarantees of the absence of malicious code” were beyond their scope.⁠¹

Failures and criticisms

Brazil’s critics fall into distinct groups, and their arguments should not be merged.

Security researchers argue that a paperless DRE cannot provide software independence and that the TPS format limits what can be found. Aranha’s teams criticized short testing windows, restricted tools, and an evaluation committee that minimized their 2012 finding.⁠^4,7 They also documented the TSE’s 2012 position that VVPATs give “a false (and expensive) sense of security” and that reintroducing them over a fixable flaw “is a threat to democracy,” which they called a “fallacy of the perfect solution”.⁠⁴

International observers commend the TSE’s audits while recommending more. The Carter Center wrote that the TSE views audits “mainly as confidence-building measures,” that there are no clear procedures if integrity tests or poll tape audits find unexplained discrepancies, and that a digital record made by the machine cannot replace a VVPAT for audits as defined in international best practice.⁠¹ It recommended independently administered funding for university code audits and noted the USP collaboration exploring end-to-end verifiable cryptography.⁠¹

Political critics in Brazil have alleged fraud in past elections. The Carter Center reports that after the 2014 and 2018 elections, in which candidates alleged fraud, “no evidence of significant fraud was documented or presented”.⁠¹ The Center also found that the armed forces’ prominent role in 2022 “undermined the independence of the election authorities” and was “inconsistent with core international standards” on electoral management body independence, while acknowledging that military involvement may have helped counter public doubts.⁠¹

The TSE and the Supreme Court, for their part, criticize printed vote proposals on secrecy, reliability, and cost grounds. The 2020 judgment cites an estimate by Justice Cármen Lúcia that printing would raise the cost per vote “em mais de 140%” (by more than 140 percent).⁠²

Competing interpretations

The machines work, and paper would reintroduce old problems. Supporters point to the 2002 printed vote trial’s failures,⁠^1,2 to the Supreme Court’s finding that the printed model created a risk of voter identification,⁠² to years of tests that found no outcome-altering problems in deployed elections, and to the 2022 poll tape audits with no discrepancies.⁠¹ On this view, Brazil’s history of paper ballot fraud makes paper a risk, not a safeguard.

The machines may work, but nobody can prove it after the fact. Critics, including security researchers who support the TSE’s good faith, argue that evidence must come from a record independent of the software, which Brazil lacks.⁠^1,4 Integrity tests and poll tape comparisons check that a machine reports what it recorded, not that it recorded what voters chose. The 2012 and 2017 findings show that serious weaknesses existed in deployed software.⁠^4,7

The question is how, not whether, to add independent evidence. A third view, reflected in the Carter Center’s report, favors keeping DREs while adding verifiability, through end-to-end verifiable cryptography or a paper record designed to protect secrecy, and publishing the full source code.⁠¹ The design problem the Supreme Court identified (voter identification through the printed record) is one that a well designed VVPAT must solve, not a reason no VVPAT can exist; whether it can be solved at Brazil’s scale and cost is contested.

Lessons

These are interpretations drawn from the record.

1. Secrecy and verifiability can be made to collide. Brazil’s courts weighed a printed record’s secrecy risks above its audit value;⁠² other democracies weigh them the other way. See the secret ballot.
2. Pre-election testing cannot replace post-election evidence. Brazil invests heavily in the former and lacks the latter.⁠¹
3. Open testing finds real flaws. Each TPS round that found issues led to fixes.⁠^1,4,7
4. Trust can erode even without evidence of fraud. The Carter Center describes a system once widely trusted that came under sustained attack, while documenting no evidence of significant fraud.⁠¹
5. Who oversees matters. The role of the armed forces in 2022 raised independence concerns separate from technology.⁠¹ See governance.

Application to this framework

Brazil’s case speaks to the My Vote Forward framework’s requirement that any official voting component offer evidence that does not depend on trusting the software or the operator (see audits and verification). Brazil shows how much assurance can be built around a paperless system and where it stops.

It also illustrates a tension the framework names directly: secrecy and verification are both requirements, and a design that strengthens one can weaken the other. The framework’s private voting principles treat neither as optional, and Brazil’s court decisions are a real-world example of a country choosing between particular designs rather than between the principles themselves.

Unresolved questions

• Can end-to-end verifiable cryptography give Brazil software-independent evidence without a paper record, at national scale?
• What would a printed record design look like that answers the Supreme Court’s identification concern?
• Should Public Security Test findings be publishable without nondisclosure limits?
• What post-election procedure should apply if an integrity test ever shows a discrepancy not explained by operator error?
• How do public trust levels respond to more open code publication, which the TSE’s university collaboration has proposed?