Security researchers say artificial intelligence is making an old vulnerability in Georgia’s voting equipment more dangerous, because the system can allow voters to be matched to their ballots after they have been cast.
The flaw does not allow votes to be changed or cast doubt on election results. But it could let someone see how others voted, which matters because ballot secrecy is a fundamental right under the state constitution.
Election security advocates have criticized state officials for not fixing the issue before the November elections. Georgia election officials say they have taken steps to address the potential harm, though some advocates say the state is not going far enough.
The equipment used in Georgia has been under scrutiny for a few years. Georgia voters make their selections on touchscreen machines that print paper ballots, which voters then insert into scanners to tally the votes. Cast-vote records and electronic ballot images are randomized, but researchers said the software flaw allows them to be put back in the order they were cast.
That order can matter. According to the researchers, the information could be combined with other publicly available data to match voters to their ballots. Max Springer, a Princeton University researcher, said he gave a publicly available AI assistant that research and it was able to reverse the shuffling of electronic ballot records from Georgia’s May primary. He said it then identified what other records would be needed to match names to ballots.
Springer later provided the AI assistant with early voting lists and a cast-vote record file that could be obtained through a public records request. In many instances, he wrote, it created 'buckets of ballots and potential voters' and made it possible to match voters to their ballots.
When ambiguity remained, Springer said he used the public audit log for the ballot scanners and precinct check-in records and was able to match most ballots to specific voters.
J. Alex Halderman, a voting technology specialist at the University of Michigan, said the situation is 'a bit of a wake-up call' because AI can do more of the technical work. Springer said AI coding tools are 'essentially supercharging laymen people to exploit vulnerabilities.'
Mark Lindeman, policy and strategy director at Verified Voting, said Georgia is the only place where the system is used statewide, and he called the combination of that setup and the state's open records law a 'perfect storm.' Lindeman also said, 'It’s really embarrassing that this is still a possibility.'
Gabriel Sterling, special projects manager in the secretary of state’s office, pushed back. He said it would be easier to use mail ballots if vote-buying or coercion were the goal and that campaigns would likely be better off increasing outreach to voters who fit a certain profile than trying to identify voters this way.
The issue is not about changing tallies. It is about whether the state has done enough to preserve secrecy in a system that handles taxpayer-funded elections and depends on public confidence. When technology can amplify a known flaw, the cost of delay rises fast.
For Georgia, the lesson is simple: election systems need to be hardened before they are tested by the next crisis, not after. Capital rewards clear rules, and democracy does too.