Using artificial intelligence to scan public databases, a Princeton University researcher has exploited a known weakness in Georgia’s voting system to identify, with fair certainty, how more than 2,200 people voted in Cherokee and Heard counties in the May primaries.
Georgia election officials have known about the problem since 2022, but they have not updated the software for Georgia’s voting system since it was first purchased back in 2019.
“Somehow, Georgia has not incorporated that sort of vulnerability patching into the maintenance of its election system,” said Alex Halderman, a computer science professor at the University of Michigan who was one of the security researchers to first flag the issue in 2022.
Georgia’s Constitution guarantees “elections by the people shall be by secret ballot.” But it’s possible to comb through a complex web of publicly available voting data to figure out how some people who cast ballots early and in-person voted with a high degree of confidence.
State election officials have mostly dismissed concerns about the weakness, noting it was too convoluted for people to exploit. But the advances in AI technology allowed Max Springer, a researcher at Princeton University’s Center for Information Technology Policy, to do it.
Security issues that were once relegated to people with programming skills are now within reach to many more people without such expertise because of the capabilities of AI large language models, Springer said.
There is no evidence anyone else has tried to exploit this weakness for nefarious purposes. Still, the secretary of state’s office sent a memo to local election officials last month instructing them to remove some publicly available data Springer used to match voters with ballots.
Gabriel Sterling, director of special projects for the secretary’s office, said there’s still a fair amount of guessing when attempting to pair a voter with a particular ballot. The new instructions sent to counties from the secretary of state’s office should make it impossible, Sterling said.
Springer’s experiment has revived a yearslong debate over Georgia’s voting machines months ahead of the midterms that will decide the governor’s race and could help determine which party controls Congress.
The statewide system, purchased seven years ago from Dominion Voting Systems, has come under fire since President Donald Trump’s loss in the 2020 election. The controversy has continued despite multiple investigations and recounts that have upheld Democrat Joe Biden’s victory.
Dominion has released multiple software updates since 2019, but Georgia has not implemented them statewide. Officials have previously estimated it would cost $15 million for technicians to install upgrades on tens of thousands of voting touchscreens and thousands of scanners.
In 2023, state election officials said it wasn’t practical to update the software before the presidential election as recommended by the federal cybersecurity agency but approved testing updates in several counties. Last year, the secretary of state’s office said the proposed upgrades to remove QR codes from ballots — with an estimated taxpayer cost of $66 million — weren’t necessary. The office also offered a simpler $15 million software patch. Nothing was funded.
The Legislature also didn’t fund upgrades this year, nor did the secretary of state’s office seek money for it.
There is no evidence Georgia’s voting machines have been tampered with or that election results have been manipulated. But amid a flurry of false claims of election rigging and foreign interference in the 2020 election from Trump and his allies, security experts say some machine vulnerabilities have been overlooked and others exaggerated.
A software update would upgrade a system that’s still in use after a serious security breach following the 2020 election. That’s when local election officials permitted computer technicians hired by allies of Trump to copy Georgia’s election software.
The State Election Board will meet this week to consider voting on a measure aimed at forcing the secretary of state to install security updates before the midterms. That would be a move that could again test the board’s rulemaking limits after the Supreme Court of Georgia said the board exceed its authority last year.
“Election integrity is measured not only by counting every lawful vote, but by protecting every lawful voter’s conscience,” Republican board member Salleigh Grubbs, an opponent of Georgia’s voting system who proposed the demand, posted on X.com.
Officials in the secretary of state’s office say the lack of funding and the timeline between now and November make an update impossible to implement by the midterms.
“Ballots are already being built for the General Election, and the election projects will already be completed before the board’s rule could even take effect,” Secretary of State General Counsel Charlene McGowan wrote to the board. “While software updates at this point in time are not an option, multiple audits continue to confirm that the current system is safe and secure for use and produces accurate results.”
About the Author
Keep Reading
The Latest
Featured
