The secret ballot has been an article of faith in US elections. That's
being tested in Georgia
[September 14, 2026]
By KATE BRUMBACK
ATLANTA (AP) — Security researchers say rapid advances in artificial
intelligence are making it more critical to address a flaw in Georgia's
voting equipment that can allow voters to be matched to their ballots
after they have been cast.
The system's vulnerability has been drawing increased attention, with
election security advocates criticizing state election officials for
failing to fix it before the November elections. Georgia election
officials say they have taken steps to address the potential harm, but
some advocates say the state is not going far enough.
The vulnerability does not allow votes to be changed or cast doubt on
election results, but it could let someone see how others voted. That is
important because ballot secrecy is a fundamental right under the state
constitution and violations could create an opening for legal
challenges.
While the flaw has been known for a few years, the widespread adoption
of AI tools and the blistering pace of its sophistication have election
security experts raising alarms.
This is "a bit of a wake-up call because it illustrates how much more
easily vulnerabilities can be exploited now that AI can do all of the
technical work for you,” said J. Alex Halderman, a voting technology
specialist at the University of Michigan who was part of the team that
exposed the flaw.
Other jurisdictions across the country use the same voting equipment
made by Dominion Voting Systems, a company that has since been sold and
renamed Liberty Vote. But many have applied a software update to fix the
flaw, and some other states do not allow the public release of records
that are needed to exploit it, said Mark Lindeman, policy and strategy
director at Verified Voting, a nonpartisan group focused on election
technology.
Georgia, a presidential battleground with one of the nation's most
closely watched U.S. Senate races this year, is the only place where the
system is used statewide. Lindeman said that, combined with an open
records law that has allowed access to key documents, creates a “perfect
storm."
"It’s really embarrassing that this is still a possibility,” Lindeman
said.
How does voting work in Georgia?
Georgia voters make their selections on touchscreen voting machines that
print paper ballots voters insert into scanners to tally the votes.
Such cast-vote records detail the votes from each ballot. Those records
and electronic ballot images created by the scanners are randomized. But
the software flaw allows them to be put back in the order they were
cast, according to a report by researchers who discovered it in 2022.
Along with other publicly available data, that information could be used
to match voters to their ballots, the researchers wrote.
Max Springer, a Princeton University researcher who was not involved in
the original research and studies AI, said he gave a publicly available
AI assistant that research. He said it was able to reverse the shuffling
of electronic ballot records from Georgia's May primary and then tell
him what other records it would need to match names to ballots.
He then gave the AI assistant the early voting list for the counties he
examined and the cast-vote record file, which could be obtained through
a public records request. It was able to create “buckets of ballots and
potential voters,” he wrote in a blog post. In many instances, that made
it possible to match voters to their ballots.
In cases where ambiguity remained, he wrote, he got the public audit log
for the ballot scanners and precinct check-in records and was able to
match most ballots to specific voters.
“AI coding tools are essentially supercharging laymen people to exploit
vulnerabilities,” Springer said in an interview.
Why does ballot secrecy matter?
Georgia's Constitution says elections “shall be by secret ballot” and
state law requires voting machines to “permit voting in absolute secrecy
so that no person can see or know any other elector’s votes.”
A lack of ballot secrecy can make it easier to buy or sell votes and
increase the danger of coercion to vote a certain way by family members,
political organizations, employers or government officials. It also is
information that could be invaluable to political campaigns.
[to top of second column]
|
Voting machines fill the floor for early voting at State Farm Arena,
Oct. 12, 2020, in Atlanta. (AP Photo/Brynn Anderson, File)
Gabriel Sterling, special projects manager in the secretary of
state’s office, pushed back on the concerns. He said it would be
easier to use mail ballots if vote-buying or coercion was the goal
and that it likely would be cheaper for campaigns to just increase
outreach to voters who fit a certain profile than try to identify
voters this way.
State Election Board member Salleigh Grubbs proposed a rule during
the board’s August meeting that would have required the secretary of
state’s office to apply the software update recommended by the
manufacturer by Tuesday.
“Each (voter) has one vote, and no one is entitled to know how it
was cast,” Grubbs said. “That privacy protects more than the
individual voter. It protects the integrity of the entire election.”
In a letter to the election board, an agency lawyer argued that the
update has not been certified by the secretary of state, the
implementation would take months and the legislature has not
provided necessary funding. The board rejected Grubbs' proposal.
Some members said they did not believe they had the authority to
order the secretary of state to act and they raised concerns about
the short timeline before the November midterms.
Board member Sara Tindall Ghazal, who voted against the proposal,
said it is “intensely frustrating” that the software update has not
been applied. But she pointed out that it is a felony to reveal how
someone voted, which should serve as a deterrent.
“I hate the fact that it’s even physically possible, but there are
very, very severe penalties if somebody were to actually do this,”
she said.
What’s being done?
The secretary of state's office sent guidance to county election
officials instructing them to refer open records requests for
certain records to the secretary of state's office. It will release
them with the problematic information blacked out and decline to
release other information and documents.
Sterling said the office is working with a vendor to scramble the
original order of ballot images and cast-vote records before they
are made public. Halderman said that precaution would be necessary
to keep someone from reconstructing the order.
While some other jurisdictions have applied the software update that
reportedly fixes the problem, some have done what Georgia is now
trying to do by restricting public access to the records needed to
exploit the flaw.
Marilyn Marks is executive director of the Coalition for Good
Governance, which advocates for election transparency and security
and raised the alarm about the vulnerability. She argued that
withholding documents is not the solution and that steps need to be
taken to ensure ballots cannot be traced to voters in the first
place.
“When Georgia’s election records contain identifiers that can be
used to trace ballots to voters, the only legal and acceptable
answer is to stop recording that information — not restrict public
access to sensitive unlawful information to insiders and commercial
vendors,” she said.
With time growing short before the elections, Marks said a workable
interim solution would be to collect ballots in locked boxes at
precincts and then shuffle and scan them at a central tabulating
center.
All contents © copyright 2026 Associated Press. All rights reserved
 |
