Security researchers say Georgia’s voting equipment still carries a flaw that can let voters be matched to their ballots after they’ve been cast, and state election officials haven’t fixed it before the November elections. That’s the core fact. The machinery of “secret ballot” democracy is still leaking names and choices, while the people running it argue over timing, funding, and what counts as enough damage to matter.
Who Holds the Keys
The vulnerability does not let anyone change votes or cast doubt on election results, but it can let someone see how others voted. That matters because ballot secrecy is a fundamental right under the state constitution, and violations could open the door to legal challenges. Georgia voters mark touchscreen machines that print paper ballots, then insert them into scanners to tally the votes. Cast-vote records and electronic ballot images are randomized, but the software flaw allows them to be put back in the order they were cast, according to researchers who found it in 2022.
J. Alex Halderman, a voting technology specialist at the University of Michigan who was part of the team that exposed the flaw, called the rise of AI “a bit of a wake-up call because it illustrates how much more easily vulnerabilities can be exploited now that AI can do all of the technical work for you.” That’s the new trick of the apparatus: a known weakness, left in place, then handed a faster tool.
Max Springer, a Princeton University researcher who studies AI and was not involved in the original research, said he gave a publicly available AI assistant the research and it reversed the shuffling of electronic ballot records from Georgia’s May primary. He said the assistant then told him what other records it would need to match names to ballots. After he added the early voting list for the counties he examined and the cast-vote record file, which could be obtained through a public records request, the AI created “buckets of ballots and potential voters,” he wrote in a blog post. In many instances, that made it possible to match voters to their ballots.
What People at the Bottom Face
In cases where ambiguity remained, Springer wrote, he got the public audit log for the ballot scanners and precinct check-in records and was able to match most ballots to specific voters. “AI coding tools are essentially supercharging laymen people to exploit vulnerabilities,” Springer said in an interview. The people exposed by that process aren’t the ones making the rules. They’re the ones told to trust them.
Georgia’s Constitution says elections “shall be by secret ballot” and state law requires voting machines to “permit voting in absolute secrecy so that no person can see or know any other elector’s votes.” The state also says a lack of ballot secrecy can make it easier to buy or sell votes and increase the danger of coercion by family members, political organizations, employers or government officials. It can also be valuable to political campaigns. That’s the hierarchy in plain sight: the ballot is supposed to protect ordinary people from pressure, but the system itself can expose them.
Gabriel Sterling, special projects manager in the secretary of state’s office, pushed back. He said it would be easier to use mail ballots if vote-buying or coercion were the goal and that it likely would be cheaper for campaigns to increase outreach to voters who fit a certain profile than try to identify voters this way. The office’s answer is not to fix the flaw outright, but to manage the fallout.
What They Call a Fix
At the State Election Board’s August meeting, member Salleigh Grubbs proposed a rule that would have required the secretary of state’s office to apply the software update recommended by the manufacturer by Tuesday. “Each (voter) has one vote, and no one is entitled to know how it was cast,” Grubbs said. “That privacy protects more than the individual voter. It protects the integrity of the entire election.”
An agency lawyer answered in a letter that the update has not been certified by the secretary of state, that implementation would take months and that the legislature has not provided necessary funding. The board rejected Grubbs’ proposal. Some members said they did not believe they had the authority to order the secretary of state to act, and they raised concerns about the short timeline before the November midterms. So the chain of command stays intact, and the flaw stays in place.
Board member Sara Tindall Ghazal, who voted against the proposal, said it is “intensely frustrating” that the software update has not been applied. She also pointed out that it is a felony to reveal how someone voted, which should serve as a deterrent. “I hate the fact that it’s even physically possible, but there are very, very severe penalties if somebody were to actually do this,” she said. The law, in other words, is supposed to scare off the people who get caught after the damage is already possible.
The secretary of state’s office sent guidance to county election officials telling them to refer open records requests for certain records to the secretary of state’s office. It will release them with the problematic information blacked out and decline to release other information and documents. Sterling said the office is working with a vendor to scramble the original order of ballot images and cast-vote records before they are made public. Halderman said that precaution would be necessary to keep someone from reconstructing the order.
Who Gets to Decide
Other jurisdictions across the country use the same voting equipment made by Dominion Voting Systems, a company that has since been sold and renamed Liberty Vote. Many have applied a software update to fix the flaw, and some other states do not allow the public release of records needed to exploit it, said Mark Lindeman, policy and strategy director at Verified Voting, a nonpartisan group focused on election technology. Georgia, though, is the only place where the system is used statewide. Lindeman said that, combined with an open records law that has allowed access to key documents, creates a “perfect storm.”
“It’s really embarrassing that this is still a possibility,” Lindeman said.
Marilyn Marks, executive director of the Coalition for Good Governance, which advocates for election transparency and security and raised the alarm about the vulnerability, said withholding documents is not the solution. “When Georgia’s election records contain identifiers that can be used to trace ballots to voters, the only legal and acceptable answer is to stop recording that information — not restrict public access to sensitive unlawful information to insiders and commercial vendors,” she said.
With time growing short before the elections, Marks said a workable interim solution would be to collect ballots in locked boxes at precincts and then shuffle and scan them at a central tabulating center. That’s the closest thing in this story to a practical answer from below: keep the ballots away from the machinery that can trace them, and stop pretending secrecy can be preserved by blacking out records after the fact.