AI Could Link Georgia Voters To Their Ballots. Officials Are Reviewing A Privacy Flaw Before Early Voting.

Artificial intelligence tools can make it significantly easier to exploit a known privacy weakness in Georgia's voting system and potentially connect individual voters with their secret ballots, according to new research that has prompted state election officials to revisit ballot-secrecy protections ahead of the November midterms.

Max Springer, a postdoctoral research fellow at Princeton University's Center for Information Technology Policy, said he used a commercially available AI coding agent and publicly accessible election records to reconstruct the order in which 1.52 million ballots were cast during Georgia's May 2026 primary. That represented 98.9% of in-person ballots across 114 of the 139 counties he examined, according to Princeton's Center for Information Technology Policy.

Springer said he did not access voting machines, private systems or non-public source code. Instead, he supplied the AI system with cast-vote records and early-voting information, then used a previously disclosed method for reversing the way certain ballot scanners obscure the order in which ballots were cast.

The underlying flaw predates the current AI boom. Researchers from the University of Michigan and Auburn University first disclosed the issue in 2022 and later presented a peer-reviewed paper at the 2024 USENIX Security Symposium. Their DVSorder research found that certain Dominion ImageCast Precinct and ImageCast Evolution scanners generate ballot record IDs in a predictable way, allowing shuffled ballot records to be put back into casting order under some circumstances.

The researchers stressed that the vulnerability is a privacy flaw, not a way to modify votes or change election results. Its significance is that ballot-level records, when combined with information showing when or in what sequence people voted, can sometimes be used to infer which ballot belongs to a particular voter.

Springer's experiment showed how modern AI coding tools can lower the technical barrier to carrying out that process. He said that with only the early-voting lists and cast-vote records, the system could uniquely match about 1% of the early in-person voters he analyzed. Adding public scanner logs and check-in records allowed substantially closer matching in the locations he examined.

In Heard County, Springer said the system matched a majority of roughly 650 early in-person voters to a particular ballot, while the remaining voters could generally be narrowed to two possible ballots. He reported similar results when examining 1,860 early voters at a vote center in Ball Ground, Cherokee County. Those findings are Springer's research results rather than an independent determination that every inferred voter-ballot match was correct.

Georgia officials are now limiting one pathway for exploiting the issue. The Georgia Secretary of State's public cast-vote-record portal says the records it releases have been "redacted and scrambled," with original values in the Record ID field removed and replaced with randomized characters.

Removing those record IDs is one mitigation specifically recommended by the original DVSorder researchers. They said jurisdictions using affected scanners can continue releasing ballot-level information for election transparency as long as vulnerable identifying fields are sanitized before publication.

The issue also reached Georgia's State Election Board this week. The board held a special meeting Thursday whose official agenda included "emergency rulemaking regarding ballot secrecy," according to State Election Board records.

One proposal considered at the meeting would have changed how printed ballots are handled before scanning in an effort to disrupt the sequence that can help connect voters with ballots. Board members did not move forward with the proposal Thursday after concerns were raised about making major procedural changes immediately before the election, according to contemporaneous reporting from Georgia Recorder.

Ballot secrecy is protected across U.S. states because separating voters' identities from their choices helps prevent coercion and vote buying. The Congressional Research Service notes that every state has secret-ballot provisions in its laws or constitution, while also acknowledging that election policy has to balance voter privacy with transparency and fraud prevention.

The original DVSorder researchers said newer Dominion software was designed with an improved random-number algorithm. Democracy Suite 5.17 received federal certification in March 2023, although the researchers said they had not independently tested whether that version fully corrected the vulnerability.

Georgia's current election calendar leaves little time before voting begins. The Secretary of State's office says advance voting for the Nov. 3 general election begins Oct. 13 and runs through Oct. 30. Georgia Secretary of State

Springer's research does not call Georgia's vote totals into question. Instead, it raises a separate issue: whether data released for election transparency can still protect the anonymity of individual voters when inexpensive AI tools make previously technical methods much easier to use.