19-year-old hacker reveals how he rigged voting machines and election in Brazil(translate.google.com)
translate.google.com
19-year-old hacker reveals how he rigged voting machines and election in Brazil
http://translate.google.com/translate?sl=pt&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.folhapolitica.org%2F2013%2F07%2Fhacker-de-19-anos-revela-como-fraudou.html%3Fm%3D1
45 comments
"Apparently, they meet." What makes you say that, if I may ask?
I noticed Globo/Folha/et al haven't reported on this despite it having been revealed in December of last year.
___
On a side note...
Anyone who speaks Portuguese, I recommend the documentary "Vocação do Poder", that follows 6 electorial candidates in Rio while on the campaign trail. http://www.youtube.com/watch?v=vI8_oz6lsbE
For those who don't speak Portuguese, search out the documentary "Send a Bullet" which looks at crime and fraud in Brazil.
I noticed Globo/Folha/et al haven't reported on this despite it having been revealed in December of last year.
___
On a side note...
Anyone who speaks Portuguese, I recommend the documentary "Vocação do Poder", that follows 6 electorial candidates in Rio while on the campaign trail. http://www.youtube.com/watch?v=vI8_oz6lsbE
For those who don't speak Portuguese, search out the documentary "Send a Bullet" which looks at crime and fraud in Brazil.
You may go to the TSE website and check every ballot's vote count and check against the printed voting report.
Voters and political parties have access to the printed copies of each ballot's report, printed before the ballot leaves the voting room. I used to work at the elections and I know they do, indeed, request these reports even before the ballot even leaves the room.
If you want to check a posteriori, the reports signed by everyone who worked at the voting room, plus the political parties representatives, are available at the electoral courts for anyone to check them.
As no one, specially no losing political party or this very guy who claims to have tampered the vote count, has ever came with an inconsistent ballot report, I can say that apparently, this is not a kind fraud that happens.
As I said, there are many problems with the current e-voting system in Brasil. The machines are closed-source, and there are no way to check the vote during the voting process.
But once the reports are printed, they are as good as any paper ballot, as this report works as well as a traditional manual voting counting report. Actually, better, as we can print several copies of the report in a distributed way.
Voters and political parties have access to the printed copies of each ballot's report, printed before the ballot leaves the voting room. I used to work at the elections and I know they do, indeed, request these reports even before the ballot even leaves the room.
If you want to check a posteriori, the reports signed by everyone who worked at the voting room, plus the political parties representatives, are available at the electoral courts for anyone to check them.
As no one, specially no losing political party or this very guy who claims to have tampered the vote count, has ever came with an inconsistent ballot report, I can say that apparently, this is not a kind fraud that happens.
As I said, there are many problems with the current e-voting system in Brasil. The machines are closed-source, and there are no way to check the vote during the voting process.
But once the reports are printed, they are as good as any paper ballot, as this report works as well as a traditional manual voting counting report. Actually, better, as we can print several copies of the report in a distributed way.
Hey - I had an idea for how electronic voting could work.
Voters would enter their vote into a computer. The computer would print out a card for you, and show it to you from behind a perspex card. You would then say "OK" to verify that it was correct and it would drop into a box.
Now there'd be a physical copy of the cards. These could be counted and checked by scrutineers as the current electoral process works. They would need to do a manual count independent of the electronic count, and the judiciary could oversee a wrap-up ceremony where the two were compared for correctness.
In order to rig a vote and get away with it, you'd need to hack both the computer system and the manual count. Chavez could do it, but joe random hacker definitely couldn't.
But you'd get a fast, clear result for television purposes. Voting cards would not be ambiguously filled in the way they are now. And if you had a compulsory preferential system, as in some jurisdictions now, you could cause the software to enforce that in a way that isn't possible with manual entry at the moment.
Voters would enter their vote into a computer. The computer would print out a card for you, and show it to you from behind a perspex card. You would then say "OK" to verify that it was correct and it would drop into a box.
Now there'd be a physical copy of the cards. These could be counted and checked by scrutineers as the current electoral process works. They would need to do a manual count independent of the electronic count, and the judiciary could oversee a wrap-up ceremony where the two were compared for correctness.
In order to rig a vote and get away with it, you'd need to hack both the computer system and the manual count. Chavez could do it, but joe random hacker definitely couldn't.
But you'd get a fast, clear result for television purposes. Voting cards would not be ambiguously filled in the way they are now. And if you had a compulsory preferential system, as in some jurisdictions now, you could cause the software to enforce that in a way that isn't possible with manual entry at the moment.
Your idea is very similar to Wombat Voting: http://www.wombat-voting.com/
Or you could do it all by paper. I hate to sound like a luddite here, but there's simply no place for electronics in the electoral process.
Paper is excellent for ballots. It's easy to understand (put a mark next to whoever you want to elect). It's easy to collect (put ballot in a box). It's easy to count (have multiple people look at ballot, tally result). It's easy to secure (seal the boxes, keep them in a secure location). It's easy to verify (unseal the boxes, count again). It's tamper evident (examine ballots closely). You can ensure that the whole process is fair by having observers physically present each step of the process watching for shenanigans.
The only downside is that it's labour-intensive. But really, that's minor. Accept that as the cost of being confident in the election results. There are fewer things more important in a democratic society than free and fair elections.
Paper is excellent for ballots. It's easy to understand (put a mark next to whoever you want to elect). It's easy to collect (put ballot in a box). It's easy to count (have multiple people look at ballot, tally result). It's easy to secure (seal the boxes, keep them in a secure location). It's easy to verify (unseal the boxes, count again). It's tamper evident (examine ballots closely). You can ensure that the whole process is fair by having observers physically present each step of the process watching for shenanigans.
The only downside is that it's labour-intensive. But really, that's minor. Accept that as the cost of being confident in the election results. There are fewer things more important in a democratic society than free and fair elections.
I actually work in a company that has a similar voting system. We print out a card, and we also burn the content of the vote in a rfid chip, that voters can check themselves. The rfid speeds up the counting, but you can always do the manual count to check up with the system. Neither the machine nor the card contain any information that can identify the person, so we can preserve the anonimity. Perhaps you can check out our site :) http://www.vot-ar.com.ar/en/system-votation/
I don't know about other voting machines, but the ones here in Northwest Arkansas had a receipt of your vote behind plexiglass that you could watch print out as you made your selections. Pretty similar to what you suggest, except that I don't believe they use the paper for anything unless their is worry of fraud.
I worked in the last elections in Brazil.
Every machine (which is never online) prints a sum of all votes at the end of the day, and several copies are given out to those who are working the poll site.
So there is a hard copy of the votes, and anyone can check.
Every machine (which is never online) prints a sum of all votes at the end of the day, and several copies are given out to those who are working the poll site.
So there is a hard copy of the votes, and anyone can check.
> So there is a hard copy of the votes, and anyone can check.
Otherwise you can come up with situations like that described in the comment elsewhere here by DaviNunes, where a request for a check cound was denied by courts. In that election - it wasn't true that anyone could check.
You'd get all the institutional protections of the current system. But you could minimise confusing/invalid ballot entries, and get a decisive election result for media purposes on the day of the election.
This seem like a lot more complicated and expensive.
Why not just give the voter a unique hashed password that he can enter the internet and verify the vote that was computed for that password. Then the voters are the ones that will verify the election.
Why not just give the voter a unique hashed password that he can enter the internet and verify the vote that was computed for that password. Then the voters are the ones that will verify the election.
It breaks voter ananimity which is vary important to avoid people directly paying for votes.
Because it does not make anybody sure that their vote was correctly added, and it will make it possible for the voter to prove to a third party how he voted.
This is old - and unverified - news.
This has been posted verbatim in several places already.
http://www.lucaspeperaio.com.br/blog/hacker-de-19-anos-conta... http://www.pragmatismopolitico.com.br/2012/12/hacker-fraude-... http://www.tecmundo.com.br/brasil/34010-em-evento-no-rj-hack... http://jornalistaflavioazevedo.blogspot.com.br/2013/01/hacke...
All from blogs. Not a single major news source.
This is, most likely, complete bullshit.
This has been posted verbatim in several places already.
http://www.lucaspeperaio.com.br/blog/hacker-de-19-anos-conta... http://www.pragmatismopolitico.com.br/2012/12/hacker-fraude-... http://www.tecmundo.com.br/brasil/34010-em-evento-no-rj-hack... http://jornalistaflavioazevedo.blogspot.com.br/2013/01/hacke...
All from blogs. Not a single major news source.
This is, most likely, complete bullshit.
I agree totally its not real!
The real issue here is not if voting machines are the perfect solution, it is about what is the better solution. And if anyone knows voter fraud in Brazil, these machines are a lot better than the manual system. At least it demands the people committing the fraud to be a lot smarter than they used to be in manual counting.
I have no knowledge what so ever about voter fraud in Brazil, but I am pretty certain it cannot be worse than using voting machines (See: http://www.cs.princeton.edu/~appel/voting/SealsOnVotingMachi...). I think there is many things in this world that "needs a chip", voting is however not one of them.
This is the 3rd world, things work different in here, this is a 180 million people country with mandatory vote. Before voting machines elections would take almost a month to have their results computed. During all this time the ballots were subject to be stolen, inflated or replaced. This was very common in Brazil up until the late 80's. Stories like this are much more uncommon today.
In Canada, we do elections by paper ballot. Yet, somehow, preliminary results are available on election election. That's when the winners are known for virtually every riding and therefore the prime minister is known as well. The final, validated results are available seven days later. I believe that Elections Canada is legally obliged to fulfill that seven day deadline: no more, no less.
Mind you, we have a population of 35 million people. But the size of the population doesn't matter: vote counting is an embarrassingly parallel problem.
The only explanation for election results taking a month is corruption, plain and simple. And voting machines will not solve that. Election fraud is a human problem and requires a human solution, not a technological one. If a nation cannot properly administer their own elections, then the people should insist that a third party (e.g. the UN) monitor them.
Mind you, we have a population of 35 million people. But the size of the population doesn't matter: vote counting is an embarrassingly parallel problem.
The only explanation for election results taking a month is corruption, plain and simple. And voting machines will not solve that. Election fraud is a human problem and requires a human solution, not a technological one. If a nation cannot properly administer their own elections, then the people should insist that a third party (e.g. the UN) monitor them.
If you allow people a month to count the votes anything could happen to them. In Sweden we count them in a couple of hours to get a preliminary result and then count them again the next day to get a final result. The Swedish votes do not pass through many hands before being counted and always during the counting there are plenty of eyes watching them.
The exception in Sweden is pre-election day votes which quite easily could quite easily be tampered with if we were more corrupt.
The only reason I can see why counting the votes could take a month is to make it easier to rig the election. There is no technical reason for it.
The exception in Sweden is pre-election day votes which quite easily could quite easily be tampered with if we were more corrupt.
The only reason I can see why counting the votes could take a month is to make it easier to rig the election. There is no technical reason for it.
Yeah, but the stories may be much more uncommon not because it's safer, but because electronic fraud is much easier to conceal then physical fraud.
What kind of fraud was committed with the manual counting? Here in Sweden I would be more worried about electronic voting than the current manual counting, but social pressures vary across cultures.
EDIT: There have been both allegations and convictions of election fraud in Sweden, but never anything related to the counting of votes.
EDIT: There have been both allegations and convictions of election fraud in Sweden, but never anything related to the counting of votes.
> What kind of fraud was committed with the manual counting? Here in Sweden
Trust me, your country is very different from the rest of the world and I mean that in a good sense (such as a parameter of good governance).
This a country with more than 180 million people and mandatory vote, elections here are massive. Every time someone touches a vote there is a chance for it to be defrauded or replaced. In the past, stories of lost and inflated ballots and replaced votes where trivial. Because a lot of the voters are poor another trick was to give to the voter an already marked vote and demand the original valid one back so the candidate could buy a vote in a election.
Trust me, your country is very different from the rest of the world and I mean that in a good sense (such as a parameter of good governance).
This a country with more than 180 million people and mandatory vote, elections here are massive. Every time someone touches a vote there is a chance for it to be defrauded or replaced. In the past, stories of lost and inflated ballots and replaced votes where trivial. Because a lot of the voters are poor another trick was to give to the voter an already marked vote and demand the original valid one back so the candidate could buy a vote in a election.
I still wonder if most of these problems could not be fixed by changing the manual system.
> Because a lot of the voters are poor another trick was to give to the voter an already marked vote and demand the original valid one back so the candidate could buy a vote in a election.
For example wouldn't it be trivial to make this impossible? Simply make sure people can get more than one paper and there would be no original vote that could be used as proof. They would have to have a guy standing there watching you which would work with voting machines too.
> Because a lot of the voters are poor another trick was to give to the voter an already marked vote and demand the original valid one back so the candidate could buy a vote in a election.
For example wouldn't it be trivial to make this impossible? Simply make sure people can get more than one paper and there would be no original vote that could be used as proof. They would have to have a guy standing there watching you which would work with voting machines too.
Secureness of Brazilian voting system has been contested many times.
There are "The Alagoas case" which the candidate Joao Lyra requested a recount because he found out 1/3 of the ballots contained incorrect data and then asked for an audit, the court demanded 2 million for this audition, Joao Lyra then asked the the court itself to pay for it, since it would be in its interest to demonstrate the fairness of the process, the court refused to pay and even condemned the candidate for "bad faith litigation" for asking for an investigation and not paying for it(despite showing inconsistent ballot data).
It's true, our eletronic ballot prints the report but there is no way to check if the sum of digital records are the same as the printed reports. We have no way to tell if our votes has been correctly collected nor the political parties that the votes were correctly summed, thus impossible to make a recount. In a voting system where you are not sure on whom your vote was recorded and the Election Court goes against political parties that accuse it, IMHO thats a true threat to democracy.
For a safer election it must include a voter-verified paper audit trail, a VVPAT allows voters the possibility to verify that their votes are cast as intended and can serve as an additional barrier to changing or destroying votes.
German and Holland Court already banned this first generation eletronic ballot box for not being secure enough, and Brazil is the only country on the world who still uses it.
There are "The Alagoas case" which the candidate Joao Lyra requested a recount because he found out 1/3 of the ballots contained incorrect data and then asked for an audit, the court demanded 2 million for this audition, Joao Lyra then asked the the court itself to pay for it, since it would be in its interest to demonstrate the fairness of the process, the court refused to pay and even condemned the candidate for "bad faith litigation" for asking for an investigation and not paying for it(despite showing inconsistent ballot data).
It's true, our eletronic ballot prints the report but there is no way to check if the sum of digital records are the same as the printed reports. We have no way to tell if our votes has been correctly collected nor the political parties that the votes were correctly summed, thus impossible to make a recount. In a voting system where you are not sure on whom your vote was recorded and the Election Court goes against political parties that accuse it, IMHO thats a true threat to democracy.
For a safer election it must include a voter-verified paper audit trail, a VVPAT allows voters the possibility to verify that their votes are cast as intended and can serve as an additional barrier to changing or destroying votes.
German and Holland Court already banned this first generation eletronic ballot box for not being secure enough, and Brazil is the only country on the world who still uses it.
> It's true, our eletronic ballot prints the report but there is no way to check if the sum of digital records are the same as the printed reports
Yes, there is: you can check the electronic records online and compare it against the printed reports.
The other allegations are surely important to the voting transparency discussion, but are not related to the allegations on the OP.
Yes, there is: you can check the electronic records online and compare it against the printed reports.
The other allegations are surely important to the voting transparency discussion, but are not related to the allegations on the OP.
The problem is, if you vote for candidate X, there's no way of checking if your vote was really computed or tampered with by the machine. The report will print something like 'candidate X = so many votes', but beyond that you can't know if that number was altered. If you had individual printouts on a ballot along with the electronic vote, you could have the ballot counted, and know.
What if some wacko starts claiming he accessed 50 voting machines and altered to switch 20% of votes for cadidate X into votes for candidate Y, as the votes are being cast? How do you check?
This is part of the "other allegations". I'm not discussing them.
The allegation in the OP has nothing to do with this - he says he can change the results AFTER the ballots have printed the results.
The allegation in the OP has nothing to do with this - he says he can change the results AFTER the ballots have printed the results.
There is newer.cases, like a guy that took his family.to vote.for him, and claims he voted.on himself.and still.ended with zero.votes. He sued.TSE but the reply was that he probably typed wrong and confirmed.a.wrong person.
Since there is no per vote paper ballot, it.is.his.word.against the judge word, so guess who win.
Since there is no per vote paper ballot, it.is.his.word.against the judge word, so guess who win.
What's up with the period instead of a space to separate words?
Issues when I type stuff using a phone...
I mistype dots a lot (it is right next to space) and HN layout on mobile combined with how my phone keyboard works make impossible to see what I am typing (so any typos also go through)
I mistype dots a lot (it is right next to space) and HN layout on mobile combined with how my phone keyboard works make impossible to see what I am typing (so any typos also go through)
I think this is bull*, where are the logs? How did he manipulate the results? Did he use a API Call? From a packet interception? If then how? at what time?.. Did he call the application or the database? What's the server call in? Is it Webservice? You know.. It's a lot more questions than answers.. I think we need real proof of what the heck is going on before we assume this is real, he needs to be the ultimate master of manipulation in order for noone to have seen this since there are so many people comparing the printed results versus the final one...
It was so much better when politics & conspiratorial stuff was only Reddit's business.
There used to be a separate printer attached to the voting machines, which would print each individual vote, in the presence of the voter, and would automatically go into a ballot, and it would be used in case there was an allegation of fraud. They of course did the dumb thing and did away with the printer, now they only have printouts of the total votes after the session is done and the machines are about to leave the place.
From Wikipedia:
"The 2002 version had a printer module that printed each vote, but the printed vote was abandond after Law 10.740/2003 and should only be reintroduced in 2014, according to Article 5 of Law 12.034/2009"
This is because vote buyers would ask for the receipt after the vote is concluded, to prevent this they do a unified printing.
You didn't get to keep your receipt. You didn't even put your hands on it. It was merely shown to you, as it was leaving the printer, and would go on to a sealed ballot.
Interesting how the "TRE" (entity responsible for the voting process) keeps stating the system is safe.
Interesting how people believe in completely random and untrusted sources.
I don't think it's viable to do this type of offline hacking in a voting session, unless you steal the voting machine.
Every eletronic ballot in Brazil prints the vote count for each candidate before leaving the voting room. Several copies of this report are printed, every citizen may ask for each and political parties often do it. I do it for the ballot I vote.
However, he claims to tamper the results after that, during the data consolidation process, when data from every ballot is summed. So, to prove him right, it is only a matter of checking if the ends meet.
Apparently, they meet. No political party has ever contested the results based on this difference.
Not to say Brazilian voting system is infallible - there are many problem with it. But this is not one.