AI Tools Expose Georgia Voting System Flaw That Links Voters to Ballots

A known vulnerability in Georgia's statewide voting equipment has become significantly more dangerous as artificial intelligence tools advance, according to security researchers who warn the flaw could undermine ballot secrecy protections guaranteed by the state constitution.

The vulnerability exists in voting equipment manufactured by Dominion Voting Systems (now renamed Liberty Vote) and used across Georgia. While the flaw cannot change votes or alter election results, it creates a pathway for matching individual voters to their cast ballots—a capability that researchers say AI has made dramatically easier to exploit.

How the vulnerability works

Georgia voters use touchscreen machines that print paper ballots, which are then scanned to tally votes. The scanning process creates cast-vote records and electronic ballot images that are supposed to be randomized. However, a software flaw discovered in 2022 allows these records to be reconstructed in the order they were cast.

When combined with publicly available information—including early voting lists and precinct check-in records accessible through Georgia's open records law—this ordering can enable someone to determine how specific individuals voted.

J. Alex Halderman, a voting technology specialist at the University of Michigan who helped expose the flaw, described the situation as "a bit of a wake-up call because it illustrates how much more easily vulnerabilities can be exploited now that AI can do all of the technical work for you."

Max Springer, a Princeton University researcher studying AI, demonstrated the threat by feeding publicly available research to an AI assistant. The tool successfully reversed the shuffling of electronic ballot records from Georgia's May primary and identified what additional records it would need to match names to ballots. After receiving those documents—obtainable through public records requests—the AI created connections between voters and their ballots in many instances.

State response falls short of fix

While a software update exists to address the vulnerability, Georgia has not implemented it statewide. Other jurisdictions using the same equipment have applied the patch, and some states restrict public access to the records needed to exploit the flaw.

The State Election Board rejected a proposal in August that would have required implementing the manufacturer's recommended software update before the November elections. Board members cited concerns about certification status, implementation timelines, and funding.

Instead, the secretary of state's office has instructed counties to route certain open records requests through the state office, which will redact problematic information. The office is also working with a vendor to scramble ballot images and cast-vote records before public release.

Gabriel Sterling, special projects manager in the secretary of state's office, downplayed concerns, arguing that mail ballots would be easier targets for vote-buying or coercion.

Why it matters

Ballot secrecy is not merely a procedural nicety—it's a constitutional requirement in Georgia and a fundamental protection against vote-buying, coercion by employers or family members, and political manipulation. The state constitution explicitly mandates that elections "shall be by secret ballot," and state law requires voting machines to preserve "absolute secrecy."

As a presidential battleground state with closely watched Senate races, Georgia's election infrastructure faces intense scrutiny. The combination of statewide use of vulnerable equipment, broad open records access, and the rapid advancement of AI tools creates what Mark Lindeman of Verified Voting called a "perfect storm."

Election security advocates argue that restricting document access is insufficient. Marilyn Marks, executive director of the Coalition for Good Governance, said the only acceptable solution is "to stop recording that information" that enables ballot tracing in the first place.

These details were first reported by Fortune.