Public safety tests (PSTs)

A Public Safety Test, also known as PST, is a fixed event in the electoral calendar - provided for in Resolution No. 23,444, of the TSE - where any Brazilian can present a plan to attack the electoral systems involved in the generation of media, voting, counting, transmission, and receiving files.

The PST involves several steps, including presenting the attack plans, presenting the system to investigators, opening the code and the attack period itself, ending months later when the TSE invites those involved to retest the system and check if the flaws have been fixed.

The TSE introduced the PST with the objective of strengthening the reliability, transparency, and security of the attainment, counting, transmission and receipt of votes, in addition to providing improvements in the electoral process.

When an investigator and his/her team succeed in their plan of attack, everyone wins, as the failure will be fixed, and the system will become increasingly secure.

The first edition of the Public Safety Test took place in 2009 and six other editions have been held since then: 2012, 2016, 2017, 2019, 2021 and 2023.

In 2016, it became mandatory and regulated by Resolution No. 23,444, of the TSE. The rule provides that the tests are carried out, preferably, in the year before the election, so that any flaws can be corrected in the ballot boxes that will be used in the election.

So far, 157 investigators have participated in public safety tests. In these seven editions of the Public Safety Test, 112 test plans have been carried out and 247 hours of testing have been executed.

Any Brazilian, age 18 or over, who meets the requirements of the PST call for proposals can participate in the public test.

The technical reports presented by the researchers analytically demonstrate the executed test plans and, consequently, their results. Whenever failures are pointed out, opportunities for improvement are indicated, or the success of a plan of attack is proven, the TSE will carry out corrections and evolutions, as well as promote a new test - called the Confirmation Test - in which investigators will be able to apply a new attack along the same line and under the same conditions as the initial test and thus confirming the improvement.

In short, investigators are called upon to verify the improvements implemented and rerun their test plans to prove that the flaws have been addressed.

So that the PST can be put into practice, four commissions are set up at each edition:

• Organizing: plans and prepares the overall project, organizing activities. It is formed by professionals from different areas of the TSE.

• Regulatory: defines the procedures and methodology, in addition to overseeing all stages of the process. It is also formed by professionals from the TSE.

• Evaluation: validates the methodology and judgment criteria, as well as evaluating and approving the results. It has representatives from the academic/scientific community, the Federal Public Prosecutor’s Office, the Brazilian Bar Association, the National Congress, the Federal Police, and the Brazilian Computer Society, in addition to an electrical/electronic or computer engineer duly registered with the Regional Council of Engineering and Agronomy (Crea), appointed by the Federal Council of Engineering and Agronomy (Confea) and a representative appointed by the president of the TSE.

• Institutional Communication: responsible for publicizing the PST, as well as responding to inquiries from the public and the press, formed by members of the TSE.

The details of the attributions and composition of each one of the commissions can be found in Resolution no. 23,444, of the TSE.

Based on institutional transparency – one of the pillars of the Brazilian Electoral Justice’s work –, the test brings together specialists in Information Technology and Information Security from the most diverse organizations, academic institutions, and public bodies to carry out plans to attack the software and hardware of the electronic ballot box and related systems.

With the test, the TSE mainly seeks to:

• Identify possible vulnerabilities in electoral procedures and software.

• Enable corrections and improvements to be made based on the results presented.

• Test the reliability of the attainment and counting of votes.

• Verify the robustness and maturity of the Brazilian Electronic Voting and Vote Counting System, with the main purpose of making continuous improvements in the electoral process, following the advances in world technology, especially in the areas of Technology and Information Security.