Georgia Ballot Secrecy Flaw Meets AI, Exposing a Privacy Risk Before the Midterms

Georgia left a known ballot privacy weakness unpatched for nearly four years, and an AI coding agent has now made it far easier to exploit. The Georgia ballot secrecy flaw does not alter votes or undermine the reported results. It threatens something different: the constitutional promise that nobody can determine how an individual voted.

Princeton researcher Max Springer used public records and a publicly available AI assistant to reconstruct the order of ballots from Georgia’s May 2026 primary. His analysis recovered the cast order for about 1.52 million ballots, representing 98.9% of the in-person ballots in the counties he examined. The Associated Press independently reported Springer’s findings and interviewed election officials and security experts about the unresolved vulnerability.

The uncomfortable reversal is clear. Georgia releases ballot-level data so the public can scrutinize election results, yet its outdated scanner software can make that transparency work against voter privacy. AI did not discover the flaw. It reduced the expertise and time needed to turn an old technical paper into a working analysis.

That distinction matters before November’s midterm elections. The demonstration concerns ballot secrecy, not vote manipulation, and there is no evidence that anyone has used the method maliciously. However, waiting for proven abuse would leave the state defending a privacy promise after the underlying technical barrier has already collapsed.

The Georgia Ballot Secrecy Flaw Was Already Documented

The immediate change is not a newly discovered software bug. It is proof that an existing weakness has become accessible to far more people.

Georgia voters make their choices on touchscreen ballot-marking devices. Each device prints a paper ballot containing human-readable selections and a QR code. The voter places that ballot into an optical scanner, which records the selections and creates an electronic cast-vote record.

A cast-vote record, commonly shortened to CVR, contains the selections recorded from one ballot without attaching a voter’s name. Election administrators and outside analysts can use these records to examine results at the ballot level.

The scanners also create digital ballot images. To protect anonymity, the corresponding electronic records appear in a shuffled order rather than the order in which voters deposited their ballots.

Researchers disclosed a problem with that process in October 2022. The scanners assigned identifiers using a deterministic algorithm, meaning a fixed procedure produced results that looked random but could be reversed. Their technical disclosure explained how an analyst could recover the original scanning sequence.

Sequence alone does not identify a voter. It becomes sensitive when someone combines it with separate records showing who voted, where they voted, and approximately when they checked in.

Springer tested that combination against Georgia’s May 2026 primary. According to his ballot privacy analysis, he gave a coding agent the original research and asked whether the weakness remained usable in Georgia.

A coding agent is a large language model that can write, execute, inspect, and revise computer code in pursuit of a stated goal. Instead of only suggesting code, it can work through errors and assemble a functioning analysis pipeline.

Springer said the agent reversed the ballot-record shuffling and identified which additional public files were needed. Those files included early-voting lists, scanner audit logs, and location-specific check-in records.

The experiment did not require access to a voting machine, private network, proprietary source code, or restricted database. It used records that exist for legitimate election administration and public oversight.

That combination is why the story cannot be reduced to a familiar warning about hypothetical election hacking. The analysis targeted data released after voting, not machines while ballots were being cast. Its output concerned voter identity and ballot choices, not changes to the count.

The vulnerability also predates current generative AI systems. The original researchers had already explained the recovery method. AI changed the amount of specialist labor needed to apply it across real election data.

In security terms, that is a major shift in exploitability. A flaw that once demanded a programmer familiar with election formats can become approachable through plain-language instructions and iterative code generation.

Georgia has not been accused of publishing a direct voter-to-ballot list. Each public file looks less dangerous in isolation. The privacy failure emerges when predictable scanner identifiers allow separate datasets to be joined.

That is the article’s central tension. Public election evidence is supposed to make aggregate results more trustworthy without exposing individual political choices. Georgia’s current configuration struggles to deliver both protections at once.

AI Ballot Matching Turns Public Records Into Identifiers

AI lowered the practical barrier between reading about the vulnerability and applying it to more than a million real ballots.

Springer analyzed data from 139 Georgia counties. He reported recovering the in-person cast order in 114 of them, covering approximately 1.52 million ballots.

The first stage placed ballots and voters into matching groups. Suppose three voters from the same party and precinct checked in during the same early-voting period. The records might narrow their choices to three corresponding ballots without proving which person cast each one.

Smaller groups create greater certainty. If only one voter from a particular party, precinct, ballot style, and date fits one recovered record, the public data can produce a forced match.

Springer estimated that roughly 1% of the early in-person voters he analyzed could be uniquely identified from the early-voter list and cast-vote records alone. That percentage is narrower than the 98.9% cast-order recovery figure, and the two numbers should not be confused.

Recovering order means determining the sequence of electronic ballot records. Identifying a ballot means linking one of those records to a named person. The second task requires additional timing, location, or ordering evidence.

Springer then obtained scanner audit logs and check-in records for individual voting locations. Those records provided more precise timing and order information, allowing him to separate voters who had initially appeared in the same group.

In Heard County, he reported matching most of 650 early in-person voters to a specific ballot. The remaining voters could generally be narrowed to a single swap between two possible ballots.

He reported a similar result across 1,860 early voters at the Ball Ground vote center in Cherokee County. That busy location matters because it challenges the assumption that matching only works at an unusually quiet rural precinct.

The method still contains uncertainty. A voter who checks in first does not necessarily scan a ballot first. People take different amounts of time to vote, review their printouts, or request assistance. Check-in order therefore cannot automatically be treated as ballot order.

Springer’s stronger matches relied on more than a simple line-by-line comparison. They combined the reversible scanner sequence with ballot styles, party participation, dates, voting locations, and more detailed audit records.

Even then, the published work is a researcher’s demonstration rather than a statewide adjudication of every match. Independent replication would help measure false matches across crowded locations and unusual voting patterns.

Georgia election official Gabriel Sterling emphasized that uncertainty. He argued that connecting a voter with one ballot can still involve a meaningful amount of guessing, particularly when multiple people fit the same time window.

That criticism narrows the claim but does not erase the weakness. A privacy system should not depend on enough voters moving through a location in a sufficiently confusing order. It should prevent reliable linkage by design.

The Georgia ballot secrecy flaw becomes especially serious when outside observations supplement official records. A poll watcher, camera, employer, campaign operative, or acquaintance might know when a particular person entered or deposited a ballot.

Small communities can create another source of information. When residents know one another and only a few people request a particular party ballot, an apparently anonymous record can become personally revealing.

AI ballot matching also scales differently from manual investigation. An analyst can ask an agent to normalize inconsistent county files, write parsers, test assumptions, and repeat the process across many jurisdictions.

The model is not exercising political judgment. It is automating data work that once consumed substantial programming time. This makes an already published attack method easier to reproduce, modify, and distribute.

That is the broader AI security lesson. Defenders cannot assume a technical paper remains impractical because exploiting it requires unfamiliar formats or tedious coding. Agents can increasingly translate public documentation into functioning software.

Transparency and Secret Ballots Are Now in Direct Conflict

Georgia must preserve evidence that supports public verification without publishing records that can be recombined into a voter’s political identity.

Ballot-level records serve a legitimate democratic purpose. Researchers, campaigns, journalists, and citizens can use them to verify tabulation, study anomalies, and compare electronic results with paper ballots.

Georgia has actively promoted that transparency. Following the May 19 primary, the secretary of state’s office analyzed 2,081,900 ballot cards in a comprehensive image audit.

The state reported 159 discrepancies, with 99.9924% of the cards showing no discrepancy. It said the audit confirmed the outcomes of all 1,785 contests reviewed, according to the state’s primary audit results.

Those figures address counting accuracy. They do not answer whether someone can associate an accurate ballot record with an individual voter.

The difference is essential. Election integrity includes recording each selection correctly, preserving reliable evidence, counting that evidence accurately, and protecting the voter’s identity.

A system can perform well on the first three measures while failing the fourth. Evidence of accurate tabulation therefore does not rebut a demonstrated privacy weakness.

Likewise, a ballot privacy flaw is not evidence that machines switched votes, deleted ballots, or produced the wrong winner. Georgia’s 2020 results survived recounts and investigations, while false claims about widespread machine fraud repeatedly failed to produce supporting evidence.

Conflating the two issues would weaken the case for a repair. Election officials can acknowledge a genuine confidentiality problem without validating unrelated claims about manipulated outcomes.

As the Associated Press noted in its review of the relevant law, the Georgia Constitution requires elections by secret ballot, while state law requires voting equipment to permit voting in “absolute secrecy” so that no one can know another voter’s choices.

Secret voting protects more than personal comfort. It limits vote buying because a buyer cannot easily verify compliance. It also protects people from pressure by employers, relatives, political groups, government officials, and abusive partners.

A technically recoverable ballot creates a receipt-like risk. Even if few people attempt the reconstruction, the possibility can affect voters who reasonably fear retaliation or coercion.

Political campaigns could also value individualized choices. Modern campaign databases already predict preferences using demographics, voter history, consumer information, and contact records. Reconstructed ballots would offer direct evidence rather than an inferred probability.

Sterling argued that campaigns would probably find ordinary voter profiling and outreach cheaper than exploiting this vulnerability. He also noted that anyone seeking coercion might find mail voting an easier target.

That response addresses attacker incentives, not the state’s privacy obligation. A secret-ballot guarantee is not conditional on whether violating it is the most economical campaign strategy.

The central opponent in this story is therefore not AI versus election workers. It is transparency through granular public data versus secrecy weakened by deterministic identifiers and correlated logs.

Eliminating all public ballot data would resolve that conflict in the wrong direction. Independent verification depends on access to meaningful records. The better solution is to break the technical links that reveal cast order while preserving auditability.

Other jurisdictions reportedly use affected scanners, but their exposure differs. Some installed the manufacturer’s software update. Others restrict access to records that an attacker would need for voter matching.

Georgia presents an unusually sensitive combination. The equipment operates statewide, the relevant records can be requested publicly, and the state had not deployed the update before the 2026 election cycle.

That combination led Mark Lindeman, policy and strategy director at the nonpartisan election-technology organization Verified Voting, to describe Georgia’s situation to the Associated Press as a “perfect storm.” His criticism that the continuing possibility was embarrassing captures the institutional failure more directly than another abstract warning about AI.

Georgia’s Voting Equipment Fix Arrived Too Late for an Easy Deployment

The obvious software response collided with certification, funding, authority, and the operational danger of changing statewide election systems shortly before November.

Dominion Voting Systems, whose election business was later sold and renamed Liberty Vote, developed an update addressing the reversible record ordering. Liberty Vote’s official company materials confirm that the company was formed through the acquisition of Dominion. Many other users of the affected scanners reportedly installed the update.

Georgia did not deploy the relevant statewide updates after purchasing its system in 2019. By 2026, the state was approaching another high-profile election with the same privacy weakness documented in 2022.

State Election Board member Salleigh Grubbs proposed requiring the secretary of state’s office to apply the manufacturer’s update before the midterms. She argued that ballot privacy protects both individual voters and the integrity of the election.

An agency lawyer responded that Georgia had not certified the update, implementation would require months, and lawmakers had not supplied the necessary funding. The board rejected Grubbs’ proposal.

Some members also questioned whether the board possessed authority to order the secretary of state to conduct the upgrade. That concern followed earlier disputes over the legal limits of the board’s rulemaking power.

Board member Sara Tindall Ghazal voted against the proposal despite describing the absence of the update as intensely frustrating. She pointed to Georgia’s criminal penalties for revealing another person’s vote as a deterrent.

Criminal penalties matter after misconduct. They cannot make a technically linkable ballot anonymous, prevent quiet profiling, or guarantee that leaked results can be retrieved.

A rushed update also carries real risks. Election software requires certification, installation, equipment testing, poll-worker preparation, contingency planning, and consistent deployment across counties.

Changing a statewide voting environment shortly before a major election can introduce configuration errors or uneven procedures. Voting-rights advocates have previously warned that late changes can confuse workers and voters.

This is the operational tradeoff, not an excuse for years of delay. Officials face a risky schedule in 2026 because the known vulnerability remained unresolved through earlier, safer implementation windows.

The state has tried an administrative response. According to the reported state response, the secretary of state’s office instructed local officials to remove some of the publicly available data used in Springer’s matching process.

Restricting sensitive timing or ordering records can reduce immediate exposure. It may also be faster than installing new scanner software statewide.

However, record suppression requires careful design. Removing too much information can make election oversight harder, while inconsistent county compliance can leave exploitable data available in some places.

The approach also needs to account for records obtained through formal public requests, not only files posted online. Deleting a web download does not necessarily change what state law requires an agency to release.

A durable remedy must identify the minimum data needed for meaningful public audits. It must then remove or transform fields that allow records to be joined with named voter activity.

Possible safeguards include cryptographically secure random identifiers, delayed disclosure, aggregation of sensitive timestamps, and strict separation between poll-book and scanner records. Any option requires independent testing against realistic linkage attacks.

Georgia should also assume that future AI tools will be more capable than the agent Springer used. A policy that remains safe only because today’s matching process is inconvenient will age badly.

The voting equipment flaw illustrates a wider maintenance problem. Public institutions often evaluate patches according to whether a vulnerability has already caused documented harm. AI changes that calculation by making older weaknesses cheaper to operationalize.

Patch priority should reflect the current ease of exploitation, not only the date of disclosure. A four-year-old weakness can become more urgent when automation eliminates the expertise that previously constrained it.

The Privacy Risk Is Serious, but the Strongest Claims Need Testing

The evidence supports an urgent privacy response without supporting claims that Georgia’s vote totals were compromised or every voter was identified with certainty.

Springer’s experiment establishes several important facts. The published scanner shuffle can be reversed. AI can help implement that reversal. Georgia’s public data allows substantial cast-order recovery, and additional records can produce highly specific voter-to-ballot matches.

The experiment does not establish that a malicious party already created a statewide voter-choice database. Springer said there is no evidence that someone has used the weakness for nefarious purposes.

It also does not show that the AI accessed voting systems. The model worked on election records after they were produced. Calling the demonstration an AI attack on voting machines would misstate the mechanism.

The 98.9% figure needs equally careful treatment. It describes ballots whose cast order Springer recovered in the counties analyzed. It does not mean that he conclusively named the voter behind 98.9% of ballots.

His more detailed county examples produced far stronger linkage. Yet checking the accuracy of each match remains difficult because the true voter-to-ballot mapping is intentionally unavailable.

This verification gap is inherent to privacy research. A secret system cannot conveniently provide ground truth without violating the secret it is supposed to protect.

Researchers can still evaluate the method through controlled elections, synthetic records, known test voters, statistical error bounds, and independent replication. Those tests should examine delays between check-in and scanning, ballot abandonment, assistance, machine changes, and voters leaving the expected order.

Officials should publish enough methodology for outside experts to evaluate their mitigation as well. Saying that matching involves “guessing” is not a measurable security standard.

The appropriate question is how much uncertainty remains for an attacker targeting a particular voter. A technique does not need to identify everyone to threaten politicians, judges, public employees, activists, or residents of small communities.

A targeted attacker may already possess observations unavailable in the public dataset. Workplace schedules, location footage, campaign volunteers, social posts, or direct surveillance can narrow a match.

The legal deterrent also deserves testing against realistic adversaries. Foreign actors, anonymous data brokers, and people willing to leak a dataset may not respond to state criminal penalties as local officials expect.

At the same time, public discussion must avoid feeding election conspiracy narratives. The vulnerability affects privacy, while Georgia’s audits concern whether paper evidence and reported totals agree.

The state said its May audit found only 16 discrepancies among 2,038,067 ballots created by ballot-marking devices. Whatever the limitations of that audit, those numbers concern tabulation accuracy rather than identity protection.

Treating every election-security problem as evidence of a stolen election makes practical repairs harder. It invites officials to dismiss legitimate research as another political attack and encourages partisans to exaggerate a bounded flaw.

The responsible conclusion is narrower and stronger. Georgia has a documented mechanism that can expose individual ballot choices under certain data conditions. AI has lowered the effort needed to use it at scale.

That finding is sufficient to demand mitigation. It does not require claims about changed votes, hacked tabulators, or an incorrect election outcome.

What Georgia Must Prove Before November

The next test is whether Georgia can disable the matching chain while preserving enough public evidence to verify election results.

The first signal is the treatment of scanner audit logs, check-in records, and cast-vote files. Counties need consistent instructions defining which fields remain public, which become aggregated, and which receive stronger privacy protection.

If independent researchers cannot recreate precise voter ordering after those changes, the immediate privacy judgment becomes less severe. If county records remain inconsistent or easily correlated, the state’s administrative response will look incomplete.

The second signal is independent technical validation. Georgia should invite qualified election-security researchers to test the updated disclosure process using realistic November procedures.

That validation must measure linkage accuracy, not merely confirm that one file disappeared from a website. It should also explain how the state preserves the evidence needed for audits and public challenges.

A transparent, repeatable test would strengthen confidence that the mitigation addresses the mechanism. Refusal to permit meaningful testing would leave officials asking voters to accept an unsupported assurance.

The third signal is a funded, certified plan for the manufacturer’s software update or its replacement. The U.S. Election Assistance Commission’s official certification record shows that Democracy Suite 5.17 received federal certification on March 16, 2023, although federal certification does not replace Georgia’s own approval and deployment process.

A long-term plan needs dates, state certification milestones, county deployment procedures, and post-installation testing. If those milestones slip again, the state will remain dependent on controlling every auxiliary record that might reveal voter order.

Georgia also faces a wider equipment transition. Lawmakers postponed the deadline for removing QR-code tabulation until 2028 after failing to settle on a replacement before the 2026 midterms. The QR-code delay reflects the same tension between technical reform and operational readiness.

QR-code tabulation and reversible CVR ordering are distinct issues. Replacing one component does not automatically solve the other. Any future system must be evaluated for both accurate counting and resistance to record linkage.

AI ballot matching should change how election administrators model risk. Public files that once seemed harmless can become sensitive when agents discover relationships across formats, jurisdictions, and timestamps.

The principle extends beyond elections. Hospitals, courts, schools, and employers often release supposedly anonymous records while retaining dates, locations, categories, or deterministic identifiers. AI can make those combinations easier to exploit.

For Georgia voters, however, the immediate question is concrete. Can the state show that a person’s name, check-in activity, and recovered ballot order no longer converge on one political choice?

Watch the county disclosure rules first, independent privacy testing second, and a certified software timeline third. Those signals will reveal whether Georgia has broken the matching chain or merely made it slightly less convenient.

The Georgia ballot secrecy flaw does not prove that November’s count will be wrong. It shows that accurate election records and voter anonymity require separate defenses. Before the next ballots are cast, Georgia should demonstrate both.