AI Tools Can Now Match Georgia Voters to Their Ballots Through Equipment Flaw

AI Transforms Known Vulnerability Into Accessible Threat

A flaw in Georgia's voting equipment that has existed for years is now significantly more dangerous due to rapid advances in AI, according to security researchers and election security advocates. The vulnerability, first discovered in 2022, allows electronic ballot records to be de-randomized and matched to individual voters1

1

. While the flaw does not enable vote tampering or cast doubt on election results, it threatens the secret ballot, a fundamental right protected by Georgia's state constitution2

2

.

J. Alex Halderman, a voting technology specialist at the University of Michigan who helped expose the flaw, describes the situation as "a bit of a wake-up call because it illustrates how much more easily vulnerabilities can be exploited now that AI can do all of the technical work for you"1

1

. The widespread adoption of AI tools and their accelerating sophistication have transformed what was once a technical challenge requiring specialized expertise into something accessible to laypeople.

How AI Cracks Ballot Anonymity

Max Springer, a Princeton University researcher studying AI, demonstrated the ease with which AI could exploit a flaw in the system. He provided a publicly available AI assistant with research about the vulnerability and data from Georgia's May primary. The AI successfully reversed the shuffling of electronic ballot records and identified what additional records would be needed to match voters to their ballots3

3

.

Springer then fed the AI assistant publicly accessible documents: early voting lists and cast-vote record files obtainable through public records requests. The AI created "buckets of ballots and potential voters" and, in many instances, successfully matched voters to their ballots2

2

. Where ambiguity remained, Springer added public audit logs for ballot scanners and precinct check-in records, enabling the AI to match most ballots to specific voters. "AI coding tools are essentially supercharging laymen people to exploit vulnerabilities," Springer explained1

1

.

Georgia's Perfect Storm of Vulnerability

Georgia stands alone as the only state using the affected Dominion Voting Systems equipment—now sold and renamed Liberty Vote—on a statewide basis2

2

. Other jurisdictions have applied software updates to fix the flaw, and some states restrict public access to the records needed to exploit the vulnerability. Georgia's combination of statewide deployment and open records laws that provide access to key documents creates what Mark Lindeman, policy and strategy director at Verified Voting, calls a "perfect storm"1

1

.

The state's voting system uses touchscreen machines that print paper ballots, which voters then insert into scanners. These scanners create cast-vote records and electronic ballot images that are supposed to be randomized. However, the software flaw allows them to be reordered to their original casting sequence3

3

. Combined with other publicly available data, this information enables the violation of ballot secrecy.

Why Ballot Secrecy Matters for Election Integrity

Georgia's Constitution mandates that elections "shall be by secret ballot," and state law requires voting machines to "permit voting in absolute secrecy so that no person can see or know any other elector's votes"2

2

. The erosion of voter anonymity creates multiple risks: it facilitates vote-buying, enables coercion by family members, political organizations, employers, or government officials, and provides invaluable intelligence to political campaigns1

1

.

State Election Board member Salleigh Grubbs proposed a rule in August requiring the secretary of state's office to apply the manufacturer's recommended software update. "Each voter has one vote, and no one is entitled to know how it was cast," Grubbs stated. "That privacy protects more than the individual voter. It protects the integrity of the entire election"3

3

.

Gabriel Sterling, special projects manager in the secretary of state's office, downplayed the concerns, arguing that mail ballots would be easier for vote-buying or coercion purposes and that campaigns would find it cheaper to increase outreach to voters fitting certain profiles rather than attempt to identify voters through this method2

2

.

What's at Stake

Election security advocates have criticized state officials for failing to address the election security flaw before November elections. While Georgia officials claim they have taken steps to mitigate potential harm, advocates argue the measures don't go far enough1

1

. The vulnerability could create openings for legal challenges based on constitutional violations of ballot secrecy. As Georgia faces closely watched races, including a high-profile U.S. Senate contest, the intersection of AI capabilities, open records laws, and unpatched voting equipment creates an urgent challenge to democratic principles. Lindeman's assessment captures the gravity: "It's really embarrassing that this is still a possibility"2

2

.