ATLANTA – Security researchers have raised alarms about a significant vulnerability in Georgia’s voting equipment, particularly as advancements in artificial intelligence (AI) highlight the urgency of addressing this issue. The flaw allows votes to be potentially matched with individual voters after ballots have been cast, undermining the essential principle of ballot secrecy.
Election security advocates have criticized state officials for not rectifying this issue ahead of the upcoming November elections. Although Georgia election officials assert that measures have been taken to mitigate potential risks, many experts argue these steps are insufficient.
While this vulnerability does not directly enable vote manipulation or compromise election outcomes, it raises serious concerns regarding the confidentiality of voters’ choices. In Georgia, ballot secrecy is a constitutional right, and any breach could open the door for legal challenges.
This issue has gained heightened attention as AI technology rapidly evolves, enabling easier exploitation of vulnerabilities. J. Alex Halderman, a voting technology specialist at the University of Michigan involved in uncovering the flaw, described the situation as a “wake-up call” that underscores how AI can facilitate the exploitation of technical weaknesses.
Georgia is unique in that it employs this voting system statewide, making it a critical battleground state, particularly with closely watched elections, including this year’s U.S. Senate race. Mark Lindeman, policy and strategy director at Verified Voting—a nonpartisan organization focused on election technology—pointed out that Georgia’s open records law allows easy access to essential documents, creating a “perfect storm” for potential exploitation.
Understanding the Vulnerability
In Georgia, voters utilize touchscreen machines to cast their votes, which are then printed as paper ballots and scanned for tallying. The voting system generates cast-vote records that outline the votes from each ballot, which are intended to be randomized. However, the software flaw permits these records to be reordered, as detailed by researchers who identified the issue in 2022.
Using readily available AI tools, Princeton University researcher Max Springer demonstrated that he could reverse the shuffling of electronic ballot records from Georgia’s May primary, identifying the additional data required to link voters to their ballots. This capability illustrates a worrying trend: AI tools are empowering individuals to exploit vulnerabilities that were once difficult to manipulate.
The Importance of Ballot Secrecy
Ballot secrecy is enshrined in Georgia’s Constitution, which mandates that elections be conducted by secret ballot to protect voters from coercion and vote-buying. Violations of this principle could not only undermine public trust in the electoral system but also facilitate electoral fraud.
Gabriel Sterling, a special projects manager in the Secretary of State’s office, contends that using mail ballots would be a more straightforward method for vote-buying if that were a concern. However, the potential for coercion remains, highlighting the need for robust safeguards.
Salleigh Grubbs, a member of the State Election Board, proposed a rule during an August meeting that would require the Secretary of State’s office to implement the necessary software updates by a specified deadline. She emphasized that each voter has a right to privacy regarding their vote, stating, “That privacy protects more than the individual voter. It protects the integrity of the entire election.”
Current Measures and Future Solutions
In response to the vulnerability, the Secretary of State’s office has instructed county election officials to limit access to certain records, redacting sensitive information to mitigate risks. They are also collaborating with a vendor to scramble the order of ballot images and cast-vote records prior to public release. However, critics argue that simply restricting access to information is not a valid long-term solution.
Marilyn Marks, executive director of the Coalition for Good Governance, advocates for a more fundamental approach: eliminating the recording of identifiable information that could link ballots to voters. She asserts, “When Georgia’s election records contain identifiers that can be used to trace ballots to voters, the only legal and acceptable answer is to stop recording that information.”
With the clock ticking down to the elections, Marks suggests an interim solution of collecting ballots in secure boxes at precincts and then shuffling and scanning them at a central location to further protect voter anonymity.
