arXiv
Electromagnetic leakage reads test voting displays through walls
A private voting screen is not enough to protect a secret ballot if its electronic leakage can be read and matched to the person using it. Researchers reconstructed Brazil’s official voting interface through a masonry wall, using an antenna about 45 centimetres from a conventional display. At a polling place, voters entering together could make that link useless if deployed machines prove vulnerable and officials vary the voting order.
A voting booth can hide a screen from everyone else in the room. It cannot, by itself, hide the electronic signals that screen sends into the air. If those signals can be read from nearby, a person outside the room might recover what was displayed without ever seeing the ballot directly. The secrecy of the ballot would then depend not only on a privacy barrier, but also on whether the machine leaks and whether a vote can be matched to the voter who cast it.
What the signal can reveal
This kind of attack is called a TEMPEST attack. Video electronics and their cables produce unintended electromagnetic emissions, a little like a radio signal that was never meant to be broadcast. A receiver can sometimes use those emissions to infer the pictures on a screen.
The result depends on the particular display, cable, enclosure, signal format, distance, building materials, and surrounding radio noise. A signal that is readable from one screen may be useless from another. That is why a screen’s location alone cannot prove that a vote is protected.
Ballot secrecy also requires more than hiding the choice. An observer must not be able to connect a recorded choice to an identified voter. If one person watches who enters the booth and another records the screen at the same moment, timing can become the link between a person and a ballot.
Reading the screen through a wall
The researchers tested this idea using conventional VGA and HDMI displays running the official Brazilian voting interface. These were not official electronic voting machines. From an antenna about 45 centimetres from a display, with a masonry wall between the antenna and the screen, they captured electromagnetic emissions and reconstructed the displayed vote images.
The reconstructed images used common screen formats: 1280×720 and 1920×1080, both at 60 hertz. The equipment included a software-defined radio and a conventional digital HDTV antenna. In the experiment, the recovered frames could be shown as real-time video.
The attack described in the paper uses two people. One stands near the polling room and captures the emissions. The other watches when a particular voter enters or uses the booth. If the screen recording shows a choice at that time, the two observations can be joined. A screen that looks private to people in the room could therefore become part of a record tied to a named voter.
For one tested setup, the researchers inspected five possible signal components for about two seconds each. They report an initial search time of about 10 seconds. The paper says this supports the attack’s feasibility under the test conditions. It does not establish that Brazil’s official voting machines emit a signal that can be recovered in the same way.
What would have to change
At a school used as a polling place, several voters could enter together. The door could close behind them, and poll workers could vary the order in which they reach the machines. Someone watching the entrance would no longer be able to turn one person’s arrival time into a record of one ballot. This would matter if tests show that deployed machines leak readable signals and election authorities adopt those procedures.
The paper also points toward a different kind of equipment test. Certification could ask what a receiver outside the room can infer from a machine’s display electronics, rather than checking only whether a passerby can see the screen. That would require repeatable tests on the actual voting hardware under realistic polling-site conditions.
The next unanswered question is the most important one: whether an official Brazilian electronic voting machine crosses the same threshold as the stand-in displays. The authors plan to seek access to one at a future public security test. If the attack works on deployed equipment, protecting the ballot would require both reducing electromagnetic emissions and breaking the timing link between voters and votes. Hardware shielding, emissions testing, and procedures that conceal voting order could all become part of election security.