Security researchers and election transparency advocates are pressing Georgia to fix a known flaw in its voting machines that could let someone match a cast ballot back to the specific voter who cast it, warning that advances in artificial intelligence have made the flaw far easier to exploit than when it was first identified. The state’s response so far has been to restrict public access to the records that could be used to exploit it, rather than eliminate the underlying identifying information.
Gabriel Sterling, a deputy in the Georgia secretary of state’s office, said the office is working with a vendor to scramble the order of ballot images and cast-vote records before releasing them publicly, and has instructed counties to route related records requests to the state office for redaction.
Background
Georgia uses Dominion ImageCast X touchscreen ballot marking devices, which print a paper ballot showing a voter’s selections in both readable text and a QR code that is what actually gets scanned and tabulated. The specific vulnerability now drawing attention involves the sequence in which ballots are recorded and imaged, which researchers say can, under certain conditions, be used to reconstruct which ballot belongs to which voter. This is a separate concern from an earlier, more widely reported set of vulnerabilities in the same ballot marking devices, identified by University of Michigan computer scientist J. Alex Halderman in a 2023 report unsealed as part of the long-running case Curling v. Raffensperger, which focused on the risk of votes being altered rather than voter identity being exposed.
Officials say this particular flaw cannot be used to change votes or cast doubt on results. It matters because ballot secrecy is a right under Georgia’s state constitution, and advocates say a violation could open the door to legal challenges even without any effect on the outcome of an election.
What Different Sides Are Saying
Election transparency advocates, led by Marilyn Marks of the Coalition for Good Governance, argue the state is treating the symptom rather than the disease. Marks said “the only legal and acceptable answer is to stop recording that information,” rather than continuing to generate identifying data and simply restricting who can see it. She has proposed an interim fix: collecting ballots in locked boxes at each precinct, then shuffling and scanning them together at a central location so no link between voter check-in order and ballot order survives.
Georgia election officials maintain they have taken meaningful steps to limit potential harm, pointing to the planned record-scrambling process and tighter routing of public records requests through the secretary of state’s office. Fact-check: that approach addresses how records are released publicly, not how the underlying sequence data is generated or stored in the first place, which is the specific gap Marks and other advocates say remains unaddressed.
Computer scientist J. Alex Halderman, who has studied Georgia’s voting systems for years, said the flaw itself is not new, but that rapid advances in AI are what have turned it into an urgent problem, since tasks that once required specialized technical skill to exploit can now be done far more easily. Fact-check: this is a claim about changing technical capability rather than a new discovery, consistent with how the reporting frames the story: the underlying flaw is described as having existed for a few years, with the AI development changing the risk calculus rather than the vulnerability itself.
Note on Scope
This article covers the ballot secrecy vulnerability specifically. It is distinct from, though related in subject matter to, the separate and earlier-reported concerns about potential vote manipulation in the same ballot marking devices, which remain the subject of separate, ongoing litigation this article does not address.
Related Links
- The secret ballot has been an article of faith in US elections. That’s being tested in Georgia – ABC News
- The secret ballot has been an article of faith in U.S. elections. That’s being tested in Georgia – Washington Times
- The secret ballot has been an article of faith in U.S. elections. That’s being tested in Georgia – Christian Science Monitor
- Security Analysis of the Dominion ImageCast X – Freedom to Tinker (Princeton CITP)
- Expert report fuels election doubts in Georgia as state waits on voting software update – NBC News
Discussion Questions
- Did you know your ballot could, in theory, be traced back to you in some voting systems?
- Do you find restricting access to records or eliminating identifying data a better fix for this kind of flaw?
- Why do you think a years-old vulnerability is only now becoming urgent?
- Should states be required to disclose known security flaws in voting equipment publicly, even before a fix exists?
- How should officials balance transparency and security when both are at stake in the same records?
- What would it take to restore your confidence in a voting system after learning about a flaw like this?
- Should ballot secrecy violations matter even if no vote was ever changed or miscounted?
- How much should the pace of AI development factor into how quickly election systems get updated?
- Do you think this kind of technical problem is better solved by state election officials or independent security researchers?
- Imagine you are a county election official responsible for both transparency and ballot secrecy. How would you balance the two?
