The Registry Under the Ballot

    Yesterday, Brazil ran the second round of its 2026 presidential election. About 158.7 million people were registered to vote, spread across roughly half a million polling sections. By Sunday night, 100% of sections had been totalized and the country knew the result: 64.3 million votes to 59.8 million, a margin of 3.58 points. Every cycle, friends abroad send me some version of the same message: your voting system is amazing. (They are right), but what they usually compliment is the machine, and the machine is not the most interesting part. So here is the claim, and I know it is a bit controversial, especially for my friends in the US: you cannot run an election like Brazil's without an identity infrastructure like Brazil's. And once you take that seriously, you inherit a problem I spent years warning/talking about.

The machine is the visible layer

Why you can't copy-paste it

    The urna eletrônica gets the applause and it really deserves. It was first used in 1996, and by the 2000 municipal elections the entire electorate voted electronically. The machines are offline, results are tallied per machine, and the country gets a national count in hours. But a fast count is only possible because the hard question was answered long before election day: who is allowed to vote here, and has this person already been registered somewhere else? That answer lives in the cadastro eleitoral, the national voter registry run by the Electoral Justice. That registry has been quietly turning biometric. For 2026, 141.3 million of the 158.7 million eligible voters had biometrics on file, 89.01% of the electorate, up from 75.51% in 2022.     Voters without biometrics still vote; the machine falls back to other checks, such as asking for the year of birth. And the registry did not stay electoral. When Brazil created the Identificação Civil Nacional in 2017, the national civil ID database was placed under the electoral court and built on top of the electoral biometric base.     Meanwhile, the new Carteira de Identidade Nacional is converging every citizen onto a single number, the CPF, valid across the country. The voter registry became, without much public debate, a backbone of Brazilian identity itself. Keep that in mind; it matters later. The US has no national ID and no national voter registry. Elections are run by states and counties, each with its own rolls, rules and machines. The Help America Vote Act of 2002 pushed states toward statewide registration databases, but there is no single issuer for the whole country, and no biometric base underneath. That is a deliberate federalist choice, rooted in privacy concerns and a long resistance to centralized registries. So when someone asks why the US can't just do what Brazil does, the honest answer is that you cannot copy a voting system without copying the identity infrastructure underneath it.

There are some caveats to have a similar voting system that is fast, difficult to tamper and auditable:

Caveat one: expensive to tamper is not the same as auditable by anyone

    Brazil's system makes large-scale fraud logistically expensive and detectable. That part is real. But how the result gets verified deserves care because the verification runs through a chain of digital and institutional checks: per-machine result bulletins, the digital record of each vote, machine logs, source-code inspections, and audits before and after the election. Those checks are meaningful, but they are performed by institutions and specialists, so there's no way the civil society can audit it too.

    The design works as long as people trust the institutions doing the verifying, which is exactly what makes that trust a target. The registry has its own tension... Biometrics make duplicate registration hard, but enrollment requires showing up at an office, and roughly 17 million voters still had no biometrics on file this year. Brazil is careful not to block them at the polls, and that choice is what keeps a deduplication tool from becoming an exclusion tool. But it also shows that digital verification has its shortcomings. Another is the problem inherent to biometric algorithms themselves: a citizen might not have readable fingerprints, or the algorithm might be low quality. And the database is also a central registry, and therefore a honeypot, prone to attacks and data leaks.

Caveat two: the attack moves to where the machine isn't

    Because tampering with the machines and the registry is so expensive, the 2022 to 2023 effort to overturn the result never really went after them. It went after legitimacy instead: preemptive fraud narratives, pressure on the military, road blockades, and finally the storming of the three branches of government in Brasília on January 8, 2023. The former president was later convicted and sentenced to more than 25 years in prison for the coup plot.

    That is the same pattern I described in my fraud series: good infrastructure does not end the attack, it displaces it. Harden the core and the pressure moves to the edges.

    Yesterday gave a small, much less dramatic example: both campaigns reported a shortage of buses taking voters to the polls in different municipalities. Close to 5 p.m., a Supreme Court justice ordered voting extended by two hours across the whole country, then clarified that the extension applied only to sections still open. Totalization paused at about 0.25% of sections and resumed two hours later. Commentators were already talking about a "third round" before the count finished. I am not arguing about whether that decision was right, even because that extension made no difference in the result (Lula won). My point is narrower: none of the contested ground was the machine. It was transport, opening hours and courts. Election integrity is identity infrastructure plus logistics plus institutional trust. If you can’t have all three, the problem keeps jumping around like a hot potato.

The argument I used to make

    For years, I argued, with many other scholars, that central registries are infrastructure for authoritarians, and I still think that is true. A single database of every citizen, with biometrics attached, is a single point of capture. Whoever controls the server controls who counts. Also, Registries tend to grow. The Brazilian electoral biometric base was built to stop people from voting twice, and it became the foundation of a national civil ID. Nobody planned that as a risk - It just made sense at each step, which is how function creep usually works. The standard answer from my field is to decentralize: hold credentials, not a database.

    Put verifiable credentials on people's devices, verify them with cryptographic proofs instead of lookups, and disclose only the attribute a verifier needs, like "over 18" or "lives in this district". The EU Digital Identity Wallet is built around selective disclosure. Federated models, like the one Canada has been developing, let several issuers recognize each other without one national database. For most identity uses, I still believe this is the right direction.

Why the ballot breaks the decentralize-everything answer

    But elections are a special case, and the decentralized identity literature tends to glide past it. I believe that Digital Public infrastructure for Democracy has to include the set of tech ecosystem that allows for elections. A wallet credential is good at answering "is this person who they say they are?" without calling home. An election needs something harder: global deduplication. Not "this person is eligible", but "this person is eligible and is not registered, or has not voted, anywhere else in the jurisdiction". You cannot prove that locally, by the nature of the activity. Somebody has to hold the set, period. This is how democratic voting is designed: one institution organizes the ballot, and one person holds one vote.

    By construction, there is a central trusted issuer. Even systems that call themselves decentralized, like proof-of-personhood schemes, end up resting on some anchor: a biometric enrollment, a trusted social graph, a signed credential from someone. Brazil's answer to "who is the anchor" was institutional. The electoral court is a specialized branch of the judiciary with career judges, its own administrative structure, and inspection roles for political parties. It was designed to be hard for any single executive to capture. It also sits in an unusual position, both running elections and judging disputes about them, which is part of why attacks on its legitimacy land so hard.

Centralize the deduplication, minimize everything else

    So because I've worked a lot with Digital Government (what we call DPI today), one of my internal debate was always asking: how can we build centralized registries that resits authoritarian demands? The honest design target is not "no central issuer". Elections need one! The question is whether that issuer can be stripped down to the one function only it can perform. An electoral registry needs to know three things: this person exists, this person is eligible, and this person has or has not voted in this election. It does not need to know how they voted, which other services they use, or anything resembling a behavioral profile. In cryptographic terms, it can be a purpose-limited nullifier authority rather than a comprehensive identity database.

    The credential presented at the polls can be a proof of eligibility and non-duplication that cannot be linked to the person's other civic records. Technology alone will not hold that line, so the design has to combine layers:

The machine is just the interface       

To my friends that compliment the Brazilian voting system: just know that what you are admiring is three decades of identity infrastructure, built imperfectly, with real costs, and held up by institutions that are constantly being tested.

To my own field: I no longer think "decentralize everything" survives contact with the ballot. The more interesting design problem is a central issuer that knows almost nothing, can do almost nothing beyond its one job, and can be stopped by a single honest actor when it tries. Ah! I was forgetting access control: the central issuer has to be the top notch expert in access control from the universe, otherwise there will be abuse.

I would love to hear from people working on this from other angles. What does a minimal electoral registry look like where you are? Has anyone moved nullifier-style voter credentials from papers into a real election? And how do you keep a voter registry from becoming everything else?

Yasodara Córdova thinks and builds at the intersection of digital identity, fraud ecosystems, privacy, security and why systems break in ways nobody planned for. She has developed work with Harvard University, the World Bank, W3C, the World Economic Forum, and SXSW, among others.