Security researchers are raising alarms about a vulnerability in Georgia's voting equipment, stating that rapid advancements in artificial intelligence could increase the risk of voters being matched to their ballots after they have been cast. This flaw, known for several years, is drawing renewed attention as AI tools become more sophisticated, potentially making it easier to exploit the system's weaknesses.
While the vulnerability does not allow for votes to be changed or cast doubt on election results, it could potentially reveal how individuals voted. Ballot secrecy is a fundamental right in Georgia, and any violation could lead to legal challenges.
J. Alex Halderman, a voting technology specialist at the University of Michigan who was part of the team that first exposed the flaw, described the situation as "a bit of a wake-up call" that illustrates how much more easily vulnerabilities can be exploited with AI assistance.
Georgia is the only state that uses the specific Dominion Voting Systems equipment statewide. While other jurisdictions using the same equipment have applied a software update to fix the flaw, or do not release the necessary public records, Georgia's situation is compounded by its statewide use of the system and an open records law that allows access to key documents, according to Mark Lindeman, policy and strategy director at Verified Voting.
"It’s really embarrassing that this is still a possibility,” Lindeman said.
The system involves touchscreen voting machines that print paper ballots, which are then inserted into scanners. The flaw allows cast-vote records and electronic ballot images, which are meant to be randomized, to be reordered, potentially enabling the matching of ballots to voters when combined with other publicly available data.
Max Springer, a Princeton University researcher, demonstrated how a publicly available AI assistant could reverse the shuffling of electronic ballot records from Georgia's May primary. By combining this with early voting lists and cast-vote records obtained through public records requests, the AI could create groupings of ballots and potential voters, making it possible in many instances to match specific voters to their ballots.
Georgia's Constitution mandates elections be by secret ballot, and state law requires voting machines to ensure absolute secrecy. A lack of ballot secrecy can facilitate vote buying and coercion, and provide valuable information to political campaigns.
Gabriel Sterling, special projects manager in the secretary of state’s office, has pushed back against the concerns, suggesting that mail-in ballots would be a simpler tool for vote buying and that campaigns would likely find it cheaper to increase voter outreach than to try to identify voters through this method.
During an August meeting, State Election Board member Salleigh Grubbs proposed a rule to mandate the application of a manufacturer-recommended software update. However, the board rejected the proposal, with some members citing concerns about the secretary of state's authority, the time required for implementation, and the lack of legislative funding.
Board member Sara Tindall Ghazal, who voted against the proposal, expressed frustration but noted that state law makes it a felony to reveal how someone voted, serving as a deterrent.
In response to record requests, the secretary of state's office has instructed county officials to refer certain requests to the state office, which intends to release some information with problematic data blacked out and decline other requests. Sterling stated the office is working with a vendor to scramble the original order of ballot images and cast-vote records before public release.
Marilyn Marks, executive director of the Coalition for Good Governance, argued that withholding documents is not a sufficient solution and that the primary issue is the recording of information that allows ballots to be traced to voters in the first place. She advocates for stopping the recording of such identifying information rather than restricting public access to it.