How Brazil's voting machine works and how votes are tallied

Almost every Brazilian election ends with a simple question: how do I know the number on the screen is the number of votes that were cast? The answer involves a computer that connects to no network, a set of digital signatures that work like a stamp on every file, printed paper that anyone can check at the door of the polling station, and a transport chain that only accepts data from an authorized machine. None of these pieces solves the problem alone. Together they form layers of security that reinforce each other.

This lesson starts from zero. First you will see what the machine is (and what it is not), then follow the software from development to election day, then the path of the vote inside the polling station, and finally the path of the data to the results site. At each step there is an explanation of the problem it solves, why it exists the way it does and where its limits are. The source for each claim appears in the text, and the full list is at the end. What could not be verified has its own section, with the phrase “not verified in this version of the lesson”.

A warning before we start: this lesson describes the system as the TSE (Tribunal Superior Eleitoral, Brazil’s Superior Electoral Court) documents it. Some TSE claims were read in the sources but have not been verified by independent third parties, and the lesson says so where that applies. In the Electoral Justice’s own sources, the word used for the voting machine is “equipment”, and this text follows the same usage. The machine itself is called the urna eletrônica, literally “electronic ballot box”, and the lesson uses “machine” for short.

lesson map

What the machine is and what it is not
Before the election: software, digital signatures and the chain of trust
The public ceremonies: source code, sealing and verification
On voting day: the zero report and the two tests
The vote: the RDV, encryption and secrecy
Closing: the results bulletin and the results media
From the polling station to the site: transport, receipt and tally
How to check the result
Limits and controversies
Myths and frequently asked questions
Exercises
Glossary
Unverified points
Sources

1. what the machine is and what it is not

The voting machine is a computer built for a single task: collecting votes and tallying the result for its polling station. That sentence sounds obvious, but it carries the first design decision, which is the limitation itself. An ordinary computer can browse, edit spreadsheets and install applications whenever someone asks. The machine refuses almost all of that. It does not run whatever you like, does not accept third-party programs and is not used for anything other than voting and tallying.

The TSE describes the equipment as a device that operates in isolation and has only two cables, one to the power outlet and one to the poll worker’s terminal. According to the same source, there is no physical or digital mechanism for putting the machine on a network, whether by Wi-Fi, Bluetooth or the internet (TSE, “Como nasce uma urna: segurança do software diferencia equipamento de computador comum”, May 15, 2024). The report “Urna eletrônica evolui no compasso da tecnologia” (April 5, 2023) calls this characteristic one of the system’s “cláusulas pétreas” (entrenched clauses), meaning something that never changes from one election to the next.

This choice has a direct effect on security. If the machine talks to no one over a network, no one can change a result over a network. The result has to leave the machine by some physical means, and the TSE uses removable media for that. The report “Como nasce uma urna: confira o passo a passo no dia da eleição” (May 17, 2024) explains that, because the machine is not connected to the internet, the data leaves on removable media called the results media. From there on, the path of the data depends on people, procedures and signatures, and section 7 details that stretch.

It helps to separate the roles. The machine uses biometrics to identify the voter at the station, records the votes and prints the bulletins. The official result, however, comes from the tally done by the TSE, based on the bulletins. Mixing up these functions is one of the most common mistakes when people talk about the subject, and section 10 returns to them.

2. before the election: software, digital signatures and the chain of trust

If the machine does not receive programs from outside, where do the programs it runs come from? They are developed by the TSE itself, and TSE Resolution 23.603 lists which systems must be inspected, audited and signed. Among them are the media generator, the tally system, the transporter, the file receiver and the machine’s operating system, called Uenux (TSE Resolution 23.603, art. 2, published in the DJe on December 27, 2019).

Uenux deserves an explanation. The name stands for “Urna Eletrônica com Linux” (Electronic Voting Machine with Linux), and the TSE describes it as a Linux distribution developed by the court’s own technical staff for use in the machines. According to the report “Como nasce uma urna: segurança do software”, every version of the equipment has run on this system since 2008. Before that, the machines used different systems depending on the model, such as VirtuOS in the 1996, 1998 and 2000 machines and Windows CE in the 2002, 2004 and 2006 models. The report says that maintaining three systems was unsustainable, because any change to the program had to be made at least three times. The same source states that no software or hardware involving communication networks was included when Uenux was prepared. That is a TSE claim, and the lesson records it as such.

Now comes the digital signature, which is the central point of this section. Resolution 23.603 defines a digital signature as an electronic way of guaranteeing the authenticity of a document or system, made with mathematical operations of asymmetric cryptography. In this kind of cryptography there are two keys: a public one, which can be shared, and a private one, which only the owner knows. Whoever has the private key produces the signature. Whoever has the public key can verify that the signature matches the content, without needing to know the secret. The TSE report uses a helpful comparison: the digital signature works like initials on a contract, because each handwriting is unique and the initials prove the person was there.

Signing solves half of the problem. The other half is making sure a modified file does not pass as signed. This is where the digital digest, called a hash, comes in. The same resolution defines the digest as a short sequence of characters computed from a set of data, so that any change to the original file produces a different digest. The 2026 report on the verification of the systems sums up the effect in a sentence worth keeping: if any part of the file, however small, is changed, the digest no longer matches. With that, the hash exposes any change made after signing.

Finally, there is the chain of trust, which ties all of this to the equipment. The machine has a physical microprocessor, called the security hardware, placed next to the motherboard. It is not part of the programs the voter uses. Its job is to check the digital signature of each software component as that component is loaded. Only after the signature is checked does the program run. The report “Como nasce uma urna: segurança do software” says this hardware guarantees that the software audited at the ceremony is the same one that runs on any machine on voting day. The figure below shows that sequence.

The figure reads from top to bottom. The sealing ceremony generates the reference signatures. The security hardware is the first to check, and it checks each component before letting it run. If a component’s signature does not match, the red path shows what happens: the program does not load. That barrier is what turns the machine from an ordinary computer into equipment with a specific purpose. The TSE states that the operating system itself is part of the checks, and that the Linux verification mechanism used by the machine was later incorporated into the original system (TSE, “Como nasce uma urna: segurança do software”, May 15, 2024).

3. the public ceremonies: source code, sealing and verification

Signing a program is only worth something if the people who will check the signature have seen the program beforehand. That is why the TSE holds ceremonies and opens the code to oversight bodies, instead of asking anyone to simply trust it.

Source code is the set of instructions written in a programming language, and it is what the program is generated from. The report “Como nasce uma urna: segurança do software” says the machine’s code is written in C++. Opening the code for inspection has existed since 2004, according to the same report. What changed was the deadline. The 2024 report says that before 2021 the code was open for the six months leading up to the election, and that from 2021 the period became one year before the vote. The 2024 elections report (June 21, 2024) says that, for that election, the code was opened in October 2023, more than a year before the vote. The October 2023 opening is consistent with the one-year period. Resolution 23.603 (art. 8), from 2019, speaks of six months before the first round. The report cites Resolution 23.673, from 2021, which deals with oversight and audit procedures, and it is likely that it changed the deadline, but this lesson did not read that rule. Anyone citing the deadline needs to check the resolution in force for the election in question.

Who may look at the code is a list of oversight bodies. The 2024 elections report gives the list: political parties, federations and coalitions, the Brazilian Bar Association (OAB), the Public Prosecutor’s Office, the National Congress, the Comptroller General (CGU), the Federal Police, the Brazilian Computer Society, Confea, the CNJ, the CNMP, the Federal Court of Accounts (TCU), entities of the Industry System and the “S” System, non-profit private entities accredited with the TSE and IT departments of accredited universities. Code analysis, by prior appointment, also gives access to the machine’s full set of software.

There is also the Public Security Test (Teste Público de Segurança da Urna, TPS), which the 2024 elections report describes as a permanent event on the Electoral Justice calendar. In it, specialists from outside the TSE try to find flaws. The most recent edition cited in the same source ran from November 27 to December 2, 2023, with 33 investigators who carried out 35 plans. Months later, a Confirmation Test, held May 15 to 17, 2024, checked whether the suggestions had been adopted. The first TPS was in 2009.

After development comes the Digital Signature and Sealing Ceremony for the Systems. According to Resolution 23.603 (art. 1, item IV), this is where the systems are presented to the oversight bodies, as source programs and executables, and, once checked, signed and sealed. Sealing, in turn, is writing the signed programs to non-rewritable media, which is then stored in an envelope signed by hand. The 2024 report says sealing is a mathematical procedure that prevents any change to the programs after they are signed. What happens at this ceremony is therefore a freeze: after it, the software does not change for that election.

The systems for the 2026 elections were signed and sealed on September 4, 2026, according to the TSE report of October 3, 2026. On that day representatives of the TSE, the OAB/DF, the Federal Public Prosecutor’s Office and Confea signed. The ceremony takes place about a month before the election, as the 2024 report also says.

Finally, there is the verification of the systems, done on the eve of the first round. In the October 3, 2026 report, the TSE verified four systems: the Transportador Web, the Receptor de Arquivos de Urna (RecArquivos), the Informação de Arquivos de Urna (InfoArquivos) and the Sistema de Gerenciamento da Totalização (Sistot). The check compares the digital signatures and digests of the programs installed at the TSE with those that were inspected and sealed. If the hash matches, the program running at the TSE is the same one everyone saw during the year. After this verification, the Sistot issued the zero report of the tally database for president and vice-president. At each regional electoral court (TRE) a similar procedure takes place for state offices, and each machine prints its own zero report on Sunday, before voting.

4. on voting day: the zero report and the two tests

On election day the sequence starts early. According to the May 17, 2024 report, the station chair powers on the machine from 7 a.m., in the presence of poll workers and party observers, and the machine analyzes the installed software. Right after that it prints the zerésima, the zero report: a paper document with the machine’s identification, the list of candidates and the statement that all of them have zero votes. That is where the name comes from. The March 11, 2024 report describes the procedure: the zero report comes out before voting starts and must be signed by the station chair, the poll workers and the observers present. A summary of the zero report is printed and posted in a visible place at the station, so any voter can check it.

The zero report has a function the name suggests but that is worth explaining. It proves that the machine started the election with no votes recorded. If someone had stored votes inside the machine before the day, the report printed in the morning would not show zero. This only works because the machine itself prints the document, and because the document is signed by those present, including party observers.

With the zero report printed, the audit work that happens on the same day begins. The 2024 elections report lists two tests with similar names, and the difference between them matters.

The Authenticity Test is done by sampling. According to the May 17, 2024 report, it is public and takes place in real time, at some stations, very early, before voting starts. The stations are drawn the day before the election. The goal is to verify that the machine’s software is the same one that was inspected and sealed. To do that, the team breaks the seal on the results media compartment, removes and reinserts the media, checks signatures and digests against the TSE program and seals the lid again. Parties, the OAB and the Public Prosecutor’s Office are called in. The stations are drawn in each federative unit, according to the 2024 elections report and art. 51 of Resolution 23.603.

The Integrity Test is different. It does not verify the program, but the machine’s behaviour. In it, some machines are taken to a controlled environment on the same day and at the same time as the official vote. Paper ballots already filled in with known votes are typed, one by one, into the machines, between 8 a.m. and 5 p.m. At the same time, the same votes are recorded in a support system on a computer. At the end of the day, the machine totals are compared with the totals of the support system. The voting is filmed, and no real voter takes part. The test has existed since 2002, according to the 2024 elections report and the TSE’s IT Glossary. Before its current name, it was called parallel voting. The 2021 presentation by Júlio Valente records this change of name, and Resolution 23.603 calls the procedure an audit of the machines’ operation under normal conditions of use.

There is also a variation with biometrics. In it, volunteer voters who have already voted in the official election place their fingerprint on the test machine, and the machine confirms it. The 2024 elections report says this variation is applied in every state capital, with a minimum of 5% and a maximum of 10% of the machines assigned to the Integrity Test. In 2026, the TSE brought two machines from the Federal District to test at the court’s own premises, in partnership with the TRE-DF, according to the October 3, 2026 report.

Why two tests? Because they answer different questions. The Authenticity Test asks whether the program is the official one. The Integrity Test asks whether, running the official program, the machine adds up the votes it receives correctly. One does not replace the other, and section 9 shows what each leaves uncovered.

5. the vote: the RDV, encryption and secrecy

Now we reach the moment of the vote, which is the most delicate part of the system. The requirement is twofold. The vote must be recorded faithfully, so it can be counted and checked. At the same time, no one may be able to say who voted for whom. The two requirements seem to clash, and the TSE’s solution is called the Registro Digital do Voto, the RDV (Digital Vote Record).

The flow starts with the poll worker. According to the May 17, 2024 report, the voter presents an ID, the poll worker types the voter registration number into the terminal and, by the name that appears on the screen, identifies the person and unlocks voting. Under the Elections Law (art. 91, cited by the report), the voter may not take a phone or other image-recording device into the booth, so the device stays with the poll worker. After voting, the voter returns the ID and gets the phone back.

Inside the booth, the vote is typed in and goes to the machine. That is where the record begins. The report says votes are stored exactly as they were typed and that the system prevents linking the stored vote to a voter. All of them are protected by encryption and digital signature throughout the voting. It is worth recalling what encryption is, because the word comes up often. Encryption is the set of techniques that make information unreadable to anyone without the key. The TSE distinguishes two kinds of algorithms: standardized ones, in the public domain, and so-called “State algorithms”, for the exclusive use of public bodies for more sensitive communications. The 2024 report says the State encryption software is supplied by Cepesc, linked to Abin, and that the secret keys are kept confidential by the TSE.

The RDV is the file where the votes are kept. Resolution 23.603 defines it as a file generated by the machine in which votes are stored separated by office and in random order. The April 5, 2023 report says the RDV was created in 2003, with each voter’s vote inserted randomly, encrypted and signed by the machine, in a table whose size equals the number of voters at the station. The IT Glossary, for its part, says the machine keeps the votes ordered according to the number typed. The May 15, 2024 report gives the most concrete example: for mayor, voter 1 chose candidate 92, voter 2 voted for 95 and voter 3 voted for 90. In the RDV, the three votes appear in the sequence 90, 92 and 95, so it is not possible to link a person to the vote cast.

How do these three descriptions fit together? One consistent reading is the following. The vote is not stored in the order in which people arrived, but in a position that depends on the number typed. That way, the final sequence of the file shows how many votes each candidate received, but not the order of the line at the station, and the line is the only thing that would link a vote to a person. This reading explains the 90, 92 and 95 example. Even so, the sources use the word “random” in different senses, and the full mathematical mechanism was not read in this version of the lesson. Section 13 records that gap.

A useful detail about the RDV is that it is not just a file of votes. According to the May 15, 2024 report, the file is updated and digitally signed after each vote is confirmed, with a timestamp recorded in a log file. The RDV is also the basis of two reports: the zero report at the start and the results bulletin at the end. For the reader, this means the same file serves both ends of the day.

When the equipment fails, the RDV and its duplication show what they are for. The May 17, 2024 report explains that the votes are kept on two media, an internal memory and an external one. This redundancy allows contingency procedures, such as replacing a station’s machine with a spare, without losing the votes already cast. The diagram below shows the sequence of the day inside the station, including that failure path.

The figure reads from top to bottom. The terracotta-bordered boxes are system procedures, the orange ones are people and decisions, the green ones are documents and media, and pink marks the failure. The dotted path to the spare machine represents the failure, and the closed arrow with an X shows that the vote does not pass to the faulty equipment. The diamond asks whether the station was drawn for the authenticity test. The arrow marked “yes” leaves on the right and leads to the test, which returns the flow to the zero report. The arrow marked “no” goes straight down from the diamond to the zero report, skipping the test.

6. closing: the results bulletin and the results media

At 5 p.m. voting ends and the part begins that matters most to anyone who wants to check results. The machine prints the Boletim de Urna, the famous BU (results bulletin), which is the report with that station’s votes. According to the May 17, 2024 report, the bulletins are printed in five mandatory copies and up to five additional ones. The mandatory copies are distributed as follows: one goes to the oversight observers, another to the station chair, two are attached to the minutes and sent to the electoral registry office (one of them travels with the results media), and the fifth is posted in a visible place at the station for public knowledge.

What is in the BU? The report “Comprovantes atestam a transparência e a segurança da urna no dia da eleição” (March 11, 2024) lists: municipality, electoral zone, polling place, station, total votes per party, total votes per candidate, blank votes, turnout, null votes, closing time, the machine’s internal code and a character sequence for validating the bulletin. That last part is what lets you check whether the bulletin was produced by that machine, and section 8 shows how.

Why is the BU printed and posted if the machine already has the result in a file? Because the paper posted on the station door lets anyone count and compare right there, before the result leaves the site. The TSE’s IT Glossary says the document lets observers and the public check, right after closing, the number of votes of every machine. This is the first public check, and it happens with no network involved.

After printing comes the results media. It is removable media carrying the data of the whole vote: the BU in digital format, the station, the machine and the number of voters who turned out (TSE, “Como nasce uma urna”, May 17, 2024). The IT Glossary adds that, after closing, the BU, the RDV and other files are written to this media. The May 17, 2024 report says that, after printing, the media is removed and sent to one of the transmission hubs. Because the report itself does not describe the link between vote and voter inside the media, that point stays in section 13.

7. from the polling station to the site: transport, receipt and tally

Now the data has to leave the polling place and reach the TSE. Resolution 23.603 (art. 2) lists four systems that do this work, and it is worth knowing each one before looking at the path.

The Transportador de Arquivos (File Transporter) reads the results media and transmits the files to the Electoral Justice’s database. The IT Glossary says it does more than read and send: it also guarantees the integrity of the files during transmission. If the Transporter does not find the digital signature generated by the machine, it does not read the media. The Receptor de Arquivos de Urna (RecArquivos) receives the packages sent by the Transporter, validates authenticity and integrity and stores the data in the database. The Informação de Arquivos de Urna (InfoArquivos) reports the status of the files sent and received. Finally, the Sistema de Gerenciamento da Totalização (Sistot) follows the receipts and manages the sum of the results, from the files already processed by RecArquivos.

To transmit, the TSE mentions two paths. The first is JE-Connect. According to the IT Glossary, it is a kit of systems on media that transmits the data from computers already available at the polling place, through a VPN, which is a virtual private network over the internet, linked to the Electoral Justice’s private network. The data leaves the machine already encrypted, and the kit only sends data to the Electoral Justice’s network and ports. Resolution 23.603 (art. 1, item V) describes JE-Connect as a tool that transmits the BU over a private channel, without compromising security. The second path is satellite transmission, used in hard-to-reach places such as Indigenous villages and certain riverside communities (TSE, “Como nasce uma urna: confira o passo a passo”, May 17, 2024). That report does not say which satellite provider is used, and the lesson does not identify any.

The following diagram shows the complete route, including the case where the media is discarded.

The path starts at the media, at the top of the flow, and the first fork is at the Transporter. If the machine’s signature does not appear, the media is not read, and this is marked in pink with an X. The main route goes through the private network, while the dashed route represents the satellite for isolated places. Both arrive at RecArquivos, which validates and stores. Then the Sistot asks two things: are the signature and the totals consistent? If so, the result enters the tally. If not, the BU is discarded. This decision appears clearly in the May 17, 2024 report: if the number of votes and the number of voters who turned out disagree, the BU is automatically discarded.

The tally is the sum of the valid BUs. The report says it also takes place without human interference. The signature comes first: it guarantees that the result was issued by a registered machine verified for that specific station. Then come the inconsistency checks. Only then do the totals enter the result. Before entering, the authenticity of the votes is checked again at the TSE, according to the same report.

The last step is publication. The TSE makes available, on the portal, the BUs sent for the tally and the correspondence tables generated on receipt. The correspondence table is the instrument that associates each station with the machine prepared to vote at that station (Resolution 23.603, art. 1, item XIII). With it, whoever checks knows that the published bulletin really came from that machine. The published BUs can be compared with the bulletins printed at the stations. That comparison is what the next section describes.

Before that, it is worth seeing how this data reaches the internet. The sources read do not detail how the Sistot feeds the publication, so what follows describes only what can be observed at the TSE’s public addresses. Anyone following the count reads files that are already published, served by a content delivery network (CDN), and does not query a database. That keeps the tally database out of the internet’s direct reach, consistent with the isolation that protects the system.

Live results are at resultados.tse.jus.br. The starting point is the configuration file https://resultados.tse.jus.br/oficial/comum/config/ele-c.json. It lists the ballots and elections of each cycle, with round and offices by scope, and provides path templates for building the address of each file, such as <base>/<environment>/<cycle>/<cd_eleicao>/dados/<uf>. In the query I ran on October 27, 2026, the 2026 ordinary federal election (first round) appeared with the code 6257.

The heavy checking files are on the Open Data Portal (dadosabertos.tse.jus.br), which uses CKAN, free software for data catalogues. The diagram shows the two paths.

The figure reads from top to bottom. The Sistot tallies in an isolated environment and an export step generates the files. From there two paths leave: on the left, the result files served by the CDN to anyone following the count; on the right, the raw files that the CKAN portal offers for analysis and checking.

8. how to check the result

Checking is the part of the election that anyone can do, and the Electoral Justice designed the system so that checking does not depend on any one person. There are four main ways to check, and they complement each other.

The first is to compare the printed BU with the published BU. The bulletin posted at the station shows the number of votes. After the tally, the same bulletin appears on the TSE portal. If the numbers match, the result for that station arrived unchanged. The 2024 elections report describes the same idea by saying that the BU data serve to check results, since the TSE provides a site to follow the tally. The idea is that any voter can oversee their own station.

The second way is to read the QR Code. Since the 2016 elections the BU carries a QR Code with the bulletin’s content. The QR Code manual published by the TSE explains that the code is limited to 1,100 characters by the capacity of the machine’s thermal printer, which uses alphanumeric mode. That is why candidate names do not appear in the code, and up to four QR Codes may be needed for a bulletin with many candidacies. The content is organized in key-value pairs. A real excerpt from the manual shows the shape of the record:

QRBU:1:1 VRQR:1.5 VRCH:20240507 ORIG:VOTA ORLC:LEG PROC:1000 DTPL:20241006 ...

Each QR Code has three parts: header, bulletin content and security. The security part is the one that matters here. It contains a SHA-512 hash computed cumulatively, meaning the hash of each QR includes the data of the previous ones. In the last QR, an ASSI field carries the Ed25519 digital signature, computed over the last hash. That signature is also printed on the paper. The manual says the public key used for verification is 256 bits and the signature 512 bits, and that there is one key pair per federative unit, published after the Sealing Ceremony. The official app, called Boletim na Mão, does the reading and verification. The manual also gives instructions for anyone who wants to build their own app.

The diagram below shows that chain of hashes and the role of the public key.

The reading is from top to bottom. Each QR Code carries a hash that depends on the previous content, so data altered at any point changes all the following hashes. The last hash is signed. The app recomputes the chain with the data it read, checks the signature with the state’s public key and reports an error if any hash does not close. The figure shows the failure in pink, for the case where the check does not match. Note that the app does not need to trust the paper: it only needs the public key to be the right one, and the key is published by the Electoral Justice.

The third way is to recount from the RDV. The report on the RDV says it allows the votes to be recounted at any time, and the IT Glossary adds that parties and coalitions can do that recount, and that the file also allows an independent tally of the official procedures. This is the most laborious way, and so it is the one the public uses least. It is the one that lets you check the tally without depending on anyone’s statements.

The fourth way is to check at scale through the Open Data Portal API. The first three work well for checking your own station or a sample of bulletins. Checking the whole country that way is not practical, so the TSE publishes the election’s raw files on the Open Data Portal (dadosabertos.tse.jus.br), which is built on CKAN. CKAN offers a standardized API, the Action API, based at https://dadosabertos.tse.jus.br/api/3/action/. With it, a script in Python, Go or R queries the catalogue without relying on scraping HTML pages.

package_search, for example package_search?q=boletim+de+urna, searches the datasets in the catalogue.
package_show, for example package_show?id=resultados-2024-boletim-de-urna, returns a JSON with the resources list, which holds the links to the ZIP files (with CSV) of the BUs split by state.

Besides the BUs, the portal has the dataset resultados-2024-arquivos-transmitidos-para-totalizacao, described as “bu imgbu log rdv vota”, the logs of the machine preparation system and the correspondence table between internal number and machine model. With these files, anyone can redo the sum on their own and compare it with the official result.

9. limits and controversies

No audit system is complete, and the machine is no exception. This section treats the limits as a topic with sources. Most of them appear in the TSE’s own sources, and the lesson records them with the same honesty with which it records the guarantees.

The first limit is that of the test itself. The Integrity Test verifies a sample of machines, in a controlled environment, with simulated votes. It does not test every machine in the country on election day. The October 3, 2026 report offers an explanation that the TSE itself presents as a guarantee: according to Júlio Valente, the machine does not know whether it is being used in a test or with real voters. This lesson found no independent verification of that claim. It is a TSE statement, and the lesson treats it as such.

The second limit is the sample. The Authenticity Test and the Integrity Test are done by draw, in each federative unit. If a machine with different software were at a station that was not drawn, these tests would not catch it on the day. What covers that case, according to the TSE, is the digital signature and the security hardware: every machine checks the same signature before running, so altered software would not load. That is why the chain of trust in section 2 matters so much. But, again, the effectiveness of that chain depends on the reference signature having been generated and stored correctly at the ceremony, and the sources read state this without detailing the implementation.

The third limit is secrecy. The RDV was designed so that the vote is not linked to a person, but the full mathematical explanation of that mechanism was not read in this version of the lesson. Section 5 describes what the sources say, and the very divergence of terms between them (random, ordered by number) shows the subject deserves a direct reading of the technical specification before any strong conclusion.

The fourth limit is transmission. The transport chain depends on people, procedures and a private channel. JE-Connect uses a VPN, and satellite is used in isolated places. The TSE states that the data is encrypted and that only valid signatures are accepted. But a communication channel, however well protected, has to exist, and the TSE documents this path in detail in its sources. In this part, the system’s guarantee is the signature, not the channel.

There are controversies the lesson cannot treat with sources in this version. The search in this version of the lesson was limited to the TSE’s official documents and a few news reports. Criticism from parties, academics or civil society organizations was neither researched nor cited. Anyone who wants to go deeper should look for those texts and separate what is technical from what is opinion. The 2024 elections report itself shows that oversight has institutional room for this: the list of bodies that can analyze the code is long and includes parties and organized civil society.

10. myths and frequently asked questions

Every election brings rumours about the machine. Júlio Valente’s September 14, 2021 presentation organizes some of them in a “fact or rumour” format, and the answer to each appears in the TSE’s own material. It is worth knowing the answers, because they show how the pieces described in the earlier sections fit together.

“The voting machine was made by Smartmatic.” The presentation answers that the machine was developed by the TSE, debuting in 1996, by a group of specialists in computing, electronics and communications, with the participation of institutions such as the ITA and INPE. Section 1 itself shows the part the TSE says it develops.

“A hacker uses the internet to break into NASA and the Pentagon, so why not the machine?” The TSE’s answer is that the machine operates in isolation, with no network channel. Modifying the data, according to the presentation, would happen in the transmission of the results, which is exactly the stretch covered by the signature and the transport chain in section 7.

“The machine does not allow a recount.” The presentation answers with the RDV, which exists precisely to allow auditing the vote with a recount.

“The machine leaves no trail.” The answer is the machine’s log, which is the chronological record of all operations and events verified on the equipment, and which, according to the presentation, is published on the internet in upcoming elections.

“Someone else can vote in my place.” The presentation answers with the voter’s biometric identification, through the machine’s recognition of the fingerprint. The 2024 report adds that fingerprints are encrypted until they reach the machine, which decrypts them to confirm identity. Since biometrics was not studied in depth in this lesson, the answer stays at the level of what the TSE declares.

Some questions that come up often deserve a short answer. Are the zero report and the BU the same thing? No. The zero report proves the machine started without votes, and the BU proves the votes it recorded at the end. One is printed before, the other after. Does the Integrity Test touch the official result? No, it uses separate machines, in a controlled environment, with no real voters, and serves to compare the machine’s behaviour with a known answer key. Can the machine be connected to the internet to update software? According to the TSE, no: the machine has no mechanism for connecting to networks, and the software is fixed by signature and sealing before voting day.

11. exercises

Explain in your own words why the machine cannot be “hacked over the internet” and then identify at which stage of section 7 a change to the result would still be possible and which mechanism blocks it. Use figure 02 as support.
Take any results bulletin published on the TSE portal and a printed bulletin from a nearby station, if you have access. Compare the totals per candidate and the turnout. What would you do if there were a difference? See section 8 and Resolution 23.603, art. 69, which deals with divergence between the bulletin and the expected result.
A student claims the RDV stores votes in the same order in which voters arrived. Based on section 5, write a paragraph showing why this contradicts the TSE’s explanation of the 90, 92 and 95 example, and say what information is missing to settle the question with confidence.
Explain the difference between the Authenticity Test and the Integrity Test using one sentence for each. Then answer: if tampered software had been installed after sealing, which of the two tests would be more likely to find it, and why? Answer based on the sources, and say what the sources do not cover.
Draw on paper the path of a BU from the station to publication, marking where there is a signature, where there is a hash and where there is human intervention. Check your result against figure 02.
Why publish the count as static JSON files distributed through a CDN, instead of a dynamic API connected to the Sistot’s database? Think about the effect on denial-of-service (DDoS) attacks.
With curl or a simple script, make a GET request to https://dadosabertos.tse.jus.br/api/3/action/package_search?q=boletim+de+urna. In the returned JSON, find the result.results list, where each item is a dataset, and write down the names of two of them.

12. glossary

Digital signature: an asymmetric cryptography operation that attests to the origin of a document or system. There is a private key for signing and a public key for verifying. Definition from Resolution 23.603, art. 1.

Results bulletin (Boletim de Urna, BU): the report the machine issues at the end of voting, with that station’s results. It can be digital or printed.

Chain of trust: a sequence of checks in which each component verifies the signature of the next one before it runs. In the machine, it starts at the security hardware.

CKAN: free software for open data catalogues, used on the TSE’s Open Data Portal. Its Action API (/api/3/action/) lets you search datasets and list their files.

State encryption: an algorithm for the exclusive use of public bodies, mentioned by the TSE for sensitive communications. It is not detailed in the sources read.

Results publication (divulgação de resultados): result files published at resultados.tse.jus.br and served by a CDN. The ele-c.json file indicates where to find each one.

Hash (digital digest): a sequence of characters computed from a file, which changes with any change to the file. Definition from Resolution 23.603, art. 1.

JE-Connect: a kit of systems on media that transmits data from the machine over a VPN, using computers at the polling place.

Sealing (lacração): writing the signed programs to non-rewritable media, stored in a signed envelope after the Digital Signature and Sealing Ceremony.

Results media: removable media that leaves the machine with the voting data: digital BU, station, machine and turnout.

Open Data Portal: the TSE repository (dadosabertos.tse.jus.br) with raw BU files, RDVs, logs and other data from each election, to download in bulk.

RDV (Registro Digital do Voto, Digital Vote Record): a file in which the machine stores votes separated by office, so that it is not possible to link the vote to the person.

Sistot: Sistema de Gerenciamento da Totalização (Tally Management System), which follows receipts and manages the sum of the results.

Correspondence table: the association between a station and the machine prepared to vote there. Definition from Resolution 23.603, art. 1.

Authenticity Test: a check by sampling, on voting day, that the machine’s programs are the official ones, by comparing signatures and digital digests.

Integrity Test: a monitored simulation, on voting day, in which known ballots are typed into a machine and the totals are compared with a support system.

Zero report (zerésima): a report printed before voting that proves the machine has no votes recorded.

13. unverified points

The items below record what could not be confirmed in this version of the lesson. None of these points was filled in with an estimate.

Centralization of the tally: José de Melo Cruz’s presentation (2021) lists the milestone on the timeline, under the year 2020, without detailing the change. The lesson cites only that record and does not describe how the tally was done before.

Full technical mechanism of the RDV, including how the vote stops being linked to the person: not verified in this version of the lesson. The sources describe the table, the ordering and the encryption, but use divergent terms, such as “random” and “ordered by number”.

State algorithm used in signing the tally: not verified in this version of the lesson. The QR Code manual says it exists and is regulated by a specific rule, without detailing it.

14. sources

Consulted on October 25, 2026, unless noted otherwise. The PDFs cited are in the same folder as this lesson in the author’s notes.

TSE. “Como nasce uma urna: confira o passo a passo no dia da eleição”, published May 17, 2024. https://www.tse.jus.br/comunicacao/noticias/2024/Maio/como-nasce-uma-urna-confira-o-passo-a-passo-no-dia-da-eleicao (PDF: “Como nasce uma urna_ confira o passo a passo no dia da eleição — Tribunal Superior Eleitoral.pdf”).

TSE. “Como nasce uma urna: segurança do software diferencia equipamento de computador comum”, published May 15, 2024. https://www.tse.jus.br/comunicacao/noticias/2024/Maio/como-nasce-uma-urna-seguranca-do-software-diferencia-equipamento-de-computador-comum (PDF: “Como nasce uma urna_ segurança do software diferencia equipamento de computador comum — Tribunal Superior Eleitoral.pdf”).

TSE. “Comprovantes atestam a transparência e a segurança da urna no dia da eleição”, published March 11, 2024. URL not recorded in the source PDF (PDF: “Comprovantes atestam a transparência e a segurança da urna no dia da eleição — Tribunal Superior Eleitoral.pdf”).

TSE. “Eleições 2024: conheça as etapas de auditoria da urna eletrônica”, published June 21, 2024. https://www.tse.jus.br/comunicacao/noticias/2024/Junho/eleicoes-2024-saiba-quais-as-etapas-de-auditoria-dos-sistemas-eleitorais-1 (PDF: “Eleições 2024_ conheça as etapas de auditoria da urna eletrônica — Tribunal Superior Eleitoral.pdf”).

TSE. “TSE verifica integridade dos sistemas eleitorais na véspera do 1º turno”, published October 3, 2026. https://www.tse.jus.br/comunicacao/noticias/2026/Outubro/tse-verifica-integridade-dos-sistemas-eleitorais-na-vespera-do-1o-turno (PDF: “TSE verifica integridade dos sistemas eleitorais na véspera do 1º turno — Tribunal Superior Eleitoral.pdf”).

TSE. “Urna eletrônica evolui no compasso da tecnologia”, published April 5, 2023. https://www.tse.jus.br/comunicacao/noticias/2023/Abril/urna-eletronica-evolui-no-compasso-da-tecnologia (PDF: “Urna eletrônica evolui no compasso da tecnologia — Tribunal Superior Eleitoral.pdf”).

TSE. “Glossário de TI”. https://www.tse.jus.br/comunicacao/glossario-de-ti (PDF: “Glossário de TI — Tribunal Superior Eleitoral.pdf”). Consulted in printed form on October 25, 2026.

TSE. Resolution no. 23.603, 2019, published in the DJe on December 27, 2019 (PDF: “tse-resolucao-n-23603.pdf”). The resolution in force in 2026 was not located.

TSE. “QR Code no Boletim de Urna: manual para a criação de aplicativos de leitura”. https://www.tse.jus.br/eleicoes/eleicoes-2024-content/arquivos/qr-code-no-boletim-de-urna/@@display-file/file/QRcode_no_boletim_de_urna.pdf (PDF: “QRcode_no_boletim_de_urna.pdf”).

Júlio Valente, presentation “Sistema eleitoral informatizado”, September 14, 2021 (PDF: “apresentacao-checadores-julio-valente-14-09-2021.pdf”).

José de Melo Cruz, presentation “Visão geral do processo eleitoral”, 2021. https://www.justicaeleitoral.jus.br/tps/arquivos/2021/apresentacao-1-tps-2021-csele-visao-geral-do-processo-eleitoral.pdf (PDF: “apresentacao-1-tps-2021-csele-visao-geral-do-processo-eleitoral.pdf”).

TSE. “Portal de Dados Abertos do Tribunal Superior Eleitoral” and the CKAN Action API documentation. https://dadosabertos.tse.jus.br/ and https://dadosabertos.tse.jus.br/api/3/action/ (accessed October 27, 2026).

TSE. “Divulgação de resultados: arquivo de configuração ele-c.json”. https://resultados.tse.jus.br/oficial/comum/config/ele-c.json (accessed October 27, 2026).

On this page