Since its first use in the 1996 municipal elections, the electronic voting machine has gone through different hardware generations, software updates, and changes in auditing procedures. The core structure, however, remains based on the idea of digitally recording the voter's choice, preserving vote secrecy, and allowing the results of each polling station to be verified.

Behind the screen and the numeric keypad lies a technological chain involving electoral systems, storage media, digital signatures, verification codes, isolation mechanisms, and different audit stages. The voting machine does not work alone either. It is part of a larger process that begins with the preparation of the equipment and ends with the consolidation of the ballot box result reports.

How the electronic voting machine emerged in Brazil

The first Brazilian Electoral Code of 1932 already mentioned the possibility of using a voting machine. In the following decades, different experiments attempted to apply electronic resources to the collection and counting of votes.

The most consistent progress occurred in the 1980s, with the computerization of the electoral registry and the development of systems capable of supporting the consolidation of results. In 1989, Santa Catarina conducted experiments with microcomputer voting. Other initiatives took place in 1994 and 1995, including municipal plebiscites in the state of São Paulo.

In 1995, the Superior Electoral Court (TSE) published the public notice that gave rise to the project of the so-called Electronic Vote Collector, equipment that would later become known as the electronic voting machine. In the following year, the model was used for the first time in a municipal election.

The adoption occurred gradually. In the 1996 elections, about one-third of the electorate voted electronically. The expansion continued in the following elections until the system became the standard for Brazilian voting.

The voting machine was designed to support a large-scale electoral operation, with millions of voters distributed across thousands of polling places. Therefore, its requirements are not limited to processing speed. The equipment also needs to operate in locations with limited infrastructure, preserve secrecy, and allow verification procedures.

What is inside the electronic voting machine

Although it has elements familiar to a conventional computer, such as a processor, memory, and storage devices, the voting machine is a computational equipment dedicated to voting and was not designed to run general-purpose applications.

Its operation is controlled by systems developed specifically for elections. The equipment has an interface that uses visual and sound features to guide the voter while making their choice.

Among the components involved in its operation are:

Hardware: set of physical components of the voting machine, including processor, memory, screen, and storage devices.

Voting software: program responsible for presenting the candidates, receiving the input, and recording the choice.

Electoral data: information about voters, candidacies, offices, and territorial divisions.

Storage media: devices used in the preparation, loading, and collection of data from the polling station.

Security mechanisms: digital signature, integrity verification, cryptography, and access control features.

Consolidation systems: programs that receive results from polling stations and calculate the official total.

The voting machine does not need to access the internet to perform its main function. It receives the programs and data necessary for voting beforehand. During operation, the equipment operates in isolation, with no connection via Wi-Fi, Bluetooth, or internet.

This isolation reduces the exposure surface to remote attacks. Instead of depending on a permanent connection, the process uses controlled media and procedures to prepare the equipment and transport the results at the end of voting.

How the vote is recorded and stored

When the voter types a candidate's number, the voting machine displays the corresponding information on the screen. The voter can check the data, correct their choice, or confirm their vote. After confirmation, the system records the information in the so-called Digital Vote Record, known by the acronym RDV.

The RDV works as a digital structure designed to store the votes recorded by the voting machine. It does not contain the voter's identification associated with their choice. This separation is essential to preserve the secrecy of the vote.

The record is not a conventional list with the name of each voter and their respective candidate. The architecture was developed to allow the tallying of choices without revealing the individual order in which the votes were cast.

In simplified terms, the process can be described as follows:

1. The voter types the candidacy number.

2. The voting machine presents the corresponding option.

3. The voter checks the data on the screen.

4. The confirmation records the choice.

5. The vote is stored digitally in the voting machine's system.

6. At the end of voting, the data required for counting are consolidated into the polling station's result.

The RDV also has an important auditing function. After the polls close, the records can be used in verification and recount procedures, when provided for in the electoral rules. They can be compared with the results presented in the ballot box result reports.

It is important not to confuse the RDV with the Ballot Box Result Report (Boletim de Urna). The first relates to the digital storage of registered votes. The second presents the consolidated result of that polling station, with the number of votes attributed to each candidacy, as well as blank and null votes.

Zerésima, Ballot Box Result Report, and transmission of results

Before voting begins, the voting machine prints the "zerésima", a document that proves there are no votes recorded on the equipment at that moment. The printing occurs in the presence of poll workers and auditors, allowing the initial condition of the machine to be verified.

The "zerésima" does not show the election result. Its function is to register that the voting machine has zero votes recorded before the opening of the polling station.

Throughout the day, votes are stored in the system. When voting ends, the voting machine closes the process and produces the Ballot Box Result Report, known as BU (Boletim de Urna). This document presents the result of that polling station, including:

• votes per candidate;

• party-list votes, when applicable;

• blank votes;

• null votes;

• identification of the polling station and voting machine;

• result control information.

A copy of the report is posted at the polling place. Others can be designated for auditing entities, such as party representatives. With this, the polling station's data can be verified even before the national total is published.

The voting machine also generates the files necessary for transmitting the results. These data are taken by specific means to the transmission points defined by the Electoral Justice. The transmission and consolidation occur in systems separate from the machine used by the voter.

This separation is relevant because the equipment that records the vote is not the same system responsible for tallying the results of the entire country. Each voting machine produces the result of its polling station. The consolidation combines the reports of the various polling stations to form the official result.

The model also allows for independent verification. Since the reports are made available at polling places and the results are published by the Electoral Justice, parties, auditing entities, and interested parties can compare the data of each polling station with those presented in the total consolidated results.

Digital signature, hashes, and physical isolation

The security of the voting machine combines digital mechanisms and physical measures. One of the most important stages occurs before the election, when electoral systems go through digital signature and sealing procedures.

The digital signature allows verifying the origin and authenticity of the programs. Meanwhile, the hash is a mathematical summary generated from a file or set of data. It works as a kind of fingerprint of the analyzed content.

If the content of a program is modified, the corresponding hash changes. Comparing the summaries allows identifying discrepancies between the approved material and what is being verified.

During the preparation of the voting machines, the systems are presented to the auditing entities, digitally signed, and sealed. Then, the programs and electoral data are loaded into the equipment according to the procedures defined by the Electoral Justice.

Protection does not depend solely on software. The physical access ports of the voting machine are sealed with security seals produced by the Mint (Casa da Moeda). These seals help evidence attempts to open or manipulate the equipment.

The security of the process depends on the combination of equipment architecture, access control, system signatures, integrity verification, operational procedures, and audits conducted at different moments.

How do electoral system audits work?

Auditing begins before voting day and continues after the voting machines close. The Brazilian model provides for the participation of political parties, the Public Prosecutor's Office, the Federal Police, universities, technical entities, and other groups authorized to follow specific stages of the process.

One of the main mechanisms is the source code opening of the electoral systems. The code brings together the instructions that define how the programs work. By making this material available for inspection, the TSE allows auditing entities to analyze the structure of the systems, identify potential problems, and submit questions or suggestions.

For the 2026 Elections, the transparency cycle began in 2025, with the opening of the source codes one year before the election. This extended period allows institutions more time to examine the programs and prepare tests.

Another procedure is the Public Security Test of Electoral Systems, known as the Voting Machine Test. The initiative brings together specialists who present test plans to try to identify vulnerabilities in the systems. The findings are analyzed by the Electoral Justice, which can implement corrections or improvements when necessary.

The existence of a finding in a test does not automatically mean that fraud occurred or that the result of an election is compromised. The objective of this type of procedure is precisely to find potential weaknesses in a controlled environment and verify whether they can affect the security of the process.

On voting day, integrity and authenticity tests are also conducted.

Integrity Test: simulates a vote with paper ballots and compares the votes recorded in the simulation with those tallied by the voting machine. The procedure is publicly monitored and seeks to verify whether the equipment correctly records the choices made.

In certain locations, the Integrity Test with Biometrics is also conducted. In this case, volunteer voters participate in the opening of the voting machine through biometric identification, following the rules of the procedure.

Authenticity Test: verifies whether the programs installed on the voting machine correspond to the systems that were previously signed and sealed. The audit involves checking media, digital signatures, and cryptographic summaries.

While the Integrity Test observes the behavior of the voting machine when recording simulated votes, the Authenticity Test focuses on the identification and correspondence of the installed systems.

Both checks serve different and complementary functions.

What happens after voting ends?

When voting is closed, the voting machine finalizes the records of the polling station and prints the Ballot Box Result Report. The result is available for verification at the location itself, through the printed copy posted at the polling station.

From there, the data are forwarded to the transmission and consolidation structure of the Electoral Justice. The process gathers the results of thousands of polling stations, respecting the rules of each office and territory.

Consolidation does not depend on a single voting machine. It is built from the reports produced individually by each equipment. This organization makes it possible to verify the origin of each portion of the result.

The data released by the TSE can also be compared with the reports collected by parties, auditing entities, and other interested parties. An independent consolidation can be done from the polling station results, provided that the corresponding official documents and data are used.

The distributed architecture also reduces dependence on a single point of registration. Each polling station produces its own result, which can be compared with the data published later.

FAQ: common questions about the electronic voting machine

Does the electronic voting machine have internet access?

No. During voting, the voting machine does not use internet, Wi-Fi, or Bluetooth. The equipment operates in isolation and receives the programs and data necessary for the election beforehand.

Is the vote stored with the voter's name?

No. The Digital Vote Record stores the choice made, but does not associate the vote with the voter's identity. This separation is necessary to preserve the secrecy of the vote.

What is the "zerésima"?

The "zerésima" is the document printed before voting begins to prove that the voting machine has zero votes recorded. It is presented in the presence of poll workers and auditors.

What can the voter take into the voting booth?

The voter can take a voting cheat sheet, preferably on paper, with the numbers of the candidates they intend to vote for. Using this note helps prevent typing errors.

Cell phones are not allowed in the voting booth. The device must be left in the place indicated by the poll workers. Voters must also not photograph or film their vote, as this can compromise the secrecy of the choice.