Security experts are urging immediate action to remediate a significant vulnerability in Georgia's voting system, which could potentially allow for the identification of voters and their corresponding ballots after they have been cast. This concern has garnered increased scrutiny, particularly with impending elections, as advocates for election security criticize state officials for not addressing the flaw prior to the upcoming November polls.
Georgia election officials assert that measures have been taken to mitigate risks associated with this vulnerability; however, critics argue that these efforts are insufficient. While the flaw does not enable tampering with votes or undermine election outcomes, it poses a threat to the confidentiality of voters' choices, an essential right protected by the state constitution. Any breach in ballot secrecy could open the door to legal challenges.
Although awareness of this issue has existed for several years, the rapid progression of artificial intelligence technology has prompted experts to voice heightened concerns regarding its exploitation. J. Alex Halderman, a voting technology expert at the University of Michigan and one of the researchers who identified the flaw, remarked that advancements in AI represent a new level of risk, making it easier to exploit such vulnerabilities.
Interestingly, while various jurisdictions utilize the same voting machines produced by Dominion Voting Systems—now rebranded as Liberty Vote—many have already implemented software patches to resolve this issue. In contrast, Georgia remains the sole state using this system statewide, where open records laws grant access to critical documents, creating what Mark Lindeman from Verified Voting describes as a "perfect storm."
In Georgia, voters utilize touchscreen machines that generate paper ballots, which are then scanned for vote tallying. Although cast-vote records are randomized to protect voter anonymity, the existing flaw permits these records to be rearranged to their original order, as concluded by researchers in a report last year. This situation enables the possibility of correlating voters with their ballots through publicly accessible data.
Max Springer, a researcher at Princeton University, tested this vulnerability using an open-source AI tool. He successfully reversed the order of electronic ballot records from a recent primary and formulated a framework to match voters with their ballots by accessing early voting lists and cast-vote record files, which can be requested through public records. In many cases, he was able to establish direct matches between voters and their votes.
The importance of maintaining ballot secrecy cannot be overstated. Georgia law mandates that elections occur by secret ballot, with voting machines designed to ensure no one can see or ascertain how individuals vote. A scenario lacking this secrecy might facilitate vote trading or coercion by various parties, potentially compromising the electoral process.
In response to these concerns, Gabriel Sterling from the Secretary of State's office suggested that if vote coercion were a risk, other methods, such as mail-in ballots, would be more effective, implying that identifying individual voters through this flaw would be inefficient for campaigns. At an August meeting, Board member Salleigh Grubbs proposed a measure requiring the Secretary of State’s office to implement the recommended software update promptly, emphasizing the protection of voter privacy as critical to the integrity of elections. However, the proposal was ultimately rejected due to concerns over funding and the time constraints before the midterms.
In parallel, the Secretary of State's office has been instructing county election officials to handle open records requests selectively—releasing certain documents with sensitive information redacted while withholding others. Officials are also collaborating with vendors to mix up the order of ballot images and records prior to their public release, a step deemed necessary to prevent the reverse-engineering of voter data by outside parties.
Marilyn Marks, the Executive Director of the Coalition for Good Governance, has been vocal in advocating for election transparency and criticizes efforts that limit public access to essential records as inadequate. She argues that the focus should be on eliminating identifiers in voting records that link ballots back to voters, rather than merely restricting access to those documents. To address the urgency of the situation before the election, she suggests a practical interim measure: collecting ballots in secure containers at precincts and processing them in a central location to further safeguard voter anonymity.
