Towards Genuine Transparency: Rethinking Audits of Brazil’s Electronic Voting System
By Hotspotnews
Brazil’s electronic voting machines, known as urnas eletrônicas, have long been a source of national pride for enabling fast, clean elections in a vast country. Yet they remain a focal point of debate, particularly around the transparency of their software. The Superior Electoral Court (TSE) has expanded access to the source code, now opening it 12 months before elections for review by political parties, universities, technical societies, and oversight bodies. Recent inspections by groups such as the Brazilian Computer Society and parties like União Brasil show the system in action. But many experts and citizens ask whether these reviews deliver real accountability or merely the appearance of it.
The core issue is simple: controlled access is not the same as open verification. Auditors typically examine the code in supervised environments at TSE facilities. They can review lines of code, ask questions of technical staff, and even test machines. However, restrictions often limit deeper scrutiny. Copies may not be freely taken, independent compilation on external hardware is constrained, and unrestricted use of personal analysis tools is frequently prohibited. Confidentiality agreements further prevent broad dissemination of findings. This setup resembles a guided tour more than a rigorous, adversarial audit.
What would genuine transparency require?
First, auditors need the ability to perform reproducible builds. They should receive the full source code, exact build instructions, and dependencies so they can compile the software themselves and compare cryptographic hashes against the official sealed versions. Matching hashes would confirm that the code running on election day is identical to what was examined. Without this, doubts about hidden modifications or supply-chain issues persist.
Second, unrestricted offline analysis is essential. Experts should be allowed to take secure copies for thorough examination using their own laboratories and tools—static analyzers, dynamic testers, fuzzers, and formal verification methods. Subtle vulnerabilities, such as timing attacks or logic flaws, are difficult to spot under time pressure and constant supervision. True security benefits from many eyes, including skeptical ones.
Third, greater public disclosure would build broader confidence. While sensitive cryptographic elements deserve protection, releasing a redacted or post-election version of the codebase for global expert review aligns with best practices in critical software. Perpetual secrecy in a system central to democracy inevitably fuels suspicion, even when intentions are honest.
Fourth, the system needs stronger end-to-end verifiability. Complementary measures like risk-limiting statistical audits, enhanced paper trails (where voters can confirm their choices were recorded correctly), and public cryptographic proofs could allow independent confirmation of results without compromising ballot secrecy. Brazil already conducts multiple audit stages, including public safety tests and digital sealing ceremonies, but layering voter-visible or statistically robust checks would close remaining gaps.
Fifth, oversight must be ongoing, diverse, and adversarial. Inviting international experts, red-team security professionals, and a wider range of civil society voices—while maintaining necessary safeguards—would strengthen the process. Public summaries of all audit findings, including any concerns raised, should become standard. Development of the software could also be monitored continuously rather than through periodic snapshots.
These changes would not imply the current system is fraudulent; Brazil’s electronic voting has successfully reduced traditional ballot-stuffing and accelerated results for decades. However, trust in elections cannot rest solely on institutional assurances. In an era of sophisticated cyber threats, transparency must be engineered to be observable and verifiable by independent parties.
Under current leadership at the TSE, including coordination involving Minister André Mendonça, there is an opportunity to move beyond incremental improvements. If new initiatives expand access into meaningful, hands-on auditing—with reproducible results, independent testing, and public reporting—they could mark a significant step forward. Without those elements, the process risks remaining a controlled demonstration rather than the gold standard of electoral integrity.
Ultimately, democracy thrives when citizens can reasonably verify that their votes are counted as cast. Strengthening the audit regime for Brazil’s voting software is not about distrusting institutions—it is about equipping them with processes that earn enduring public confidence. As the country prepares for future elections, prioritizing verifiable transparency will reinforce the legitimacy that electronic voting was designed to protect.