Georgia election officials are under pressure after security researchers demonstrated that artificial intelligence can exploit a software flaw in the state's voting machines, potentially linking voters to the ballots they cast.
What the vulnerability does
The machines, supplied by Dominion Voting Systems, now operating as Liberty Vote, print paper ballots that are later scanned. The scanners create electronic records that are deliberately shuffled to protect voter anonymity. However, a coding error allows the original order of those records to be reconstructed.
In 2022 a team of researchers identified the issue. More recently, Max Springer, a researcher at Princeton University, used a publicly available AI assistant to reverse the shuffling of records from Georgia's May primary. By combining the restored order with publicly released early-voting lists, the AI could generate "buckets of ballots and potential voters" and, in many cases, match a ballot to a specific voter.
"AI coding tools are essentially supercharging laymen people to exploit vulnerabilities," Springer said.
Springer also accessed audit logs and precinct check-in records to resolve remaining ambiguities, showing that the technique can work across multiple counties.
Why ballot secrecy matters
Georgia's Constitution guarantees elections "by secret ballot", and state law requires voting machines to ensure that "no person can see or know any other elector's votes". Breaches of secrecy can facilitate vote-buying, coercion and targeted political campaigning.
Gabriel Sterling, special projects manager in the secretary of state's office, argued that illicit actors would find mail ballots easier to manipulate and that campaigns would likely prefer broader outreach over trying to trace individual votes.
Responses from officials and experts
J. Alex Halderman, a voting-technology specialist at the University of Michigan who helped expose the flaw, called the development "a bit of a wake-up call because it illustrates how much more easily vulnerabilities can be exploited now that AI can do all of the technical work for you."
Mark Lindeman, policy and strategy director at the non-partisan group Verified Voting, described the situation as a "perfect storm" created by the statewide use of the equipment and Georgia's open-records law.
"It's really embarrassing that this is still a possibility," Lindeman said.
State Election Board member Salleigh Grubbs proposed a rule to force the secretary of state to apply the manufacturer's software update before the November midterms. The board rejected the proposal, citing concerns about authority, timing and funding.
"Each voter has one vote, and no one is entitled to know how it was cast," Grubbs said.
Board member Sara Tindall Ghazal expressed frustration at the lack of action but noted that revealing how someone voted is a felony, which should deter misuse.
"I hate the fact that it's even physically possible, but there are very, very severe penalties if somebody were to actually do this," she said.
What happens next
The secretary of state's office has begun directing counties to refer certain records to the central office, where sensitive details will be redacted before release. It is also working with a vendor to scramble the order of ballot images and cast-vote records prior to public disclosure.
Other jurisdictions that use the same equipment have already installed a software patch that eliminates the flaw. In Georgia, officials are weighing whether to restrict public access to the data needed for exploitation or to adopt the patch outright.
Election-security advocates such as Marilyn Marks, executive director of the Coalition for Good Governance, argue that the long-term solution is to stop recording identifiers that can link ballots to voters, rather than limiting transparency.
With the November elections approaching, the debate is likely to intensify, and any decision on the software update or data-access restrictions will shape how securely Georgia's voters can cast their ballots.