Princeton Study Shows How Bad Actors Can Exploit Georgia Elections To Expose How You Voted

A new analysis from Princeton University’s Center for Information Technology Policy shows that a capable analyst — or even an ordinary AI model — can reconstruct the order in which most Georgia ballots were scanned and, by combining that order with other ordinary election records, determine how individual voters cast their ballots.

Using publicly available data from the state’s May 2026 primary, researcher Max Springer demonstrated the technique at scale, recovering the scanning order of roughly 1.5 million ballots (98.9 percent of in-person ballots) across 139 counties. In smaller example jurisdictions, the linkage was nearly complete: in Heard County every one of the 650 early in-person voters could be tied to a specific ballot, and in Ball Ground (Cherokee County) all 1,860 early voters were matched. In other words, the supposedly secret ballot is not nearly as secret as the public has been told.

Early voting compounds the vulnerability. Voters at vote centers come from multiple precincts and often use different ballot styles with different candidate choices. Those differences create additional data points that can improve the ability to isolate individuals inside the Cast Vote Records (the electronic files that list every candidate choice marked on each ballot). Match confidence will vary — some linkages can be made with near certainty, others with lower confidence — but a talented programmer or AI user can still perform substantial voter profiling.

In small towns and close-knit communities, the risks of exposure are obvious. Parents could identify teachers’ ballots. Employees could face pressure from employers, or bias from potential employers. Even people who never face overt pressure could still experience quiet discrimination.

Some voters already avoid primaries because they do not want their party preference known. The ability to reverse-engineer candidate choices in a general election would only increase the potential for intimidation and could open the door to a whole new form of doxing.

Many people assume election officials are supposed to be able to know how individuals voted. They are not. Georgia law requires “absolute secrecy” of the ballot. While election officials must handle anonymous ballots, the system also must not allow anyone — including poll officials, election boards, or the state’s vendors — to determine how any particular voter cast his ballot.

The ability to reconstruct individual voting choices — and potentially disclose them — raises serious legal concerns under Georgia law, but also carries substantial commercial and political value. In an era when major campaigns routinely spend hundreds of millions of dollars, the ability to know how specific voters actually cast their ballots could be worth millions.

When that information can be assembled across multiple election cycles, the ability to build detailed, long-term voter profiles only grows stronger. That kind of data is useful to campaigns, advocacy groups, and anyone building sophisticated micro-targeting models. An insider at the state or county level with access to the original internal data files could face a clear temptation. The creation of traceable ballots must stop — while preserving the ability to audit the election.

Those concerns are heightened by the fact that Georgia’s Secretary of State’s office has already experienced multiple serious data exposures and breaches. In 2015, the office distributed voter files containing Social Security numbers, driver’s license numbers, and birth dates for more than 6 million voters (the “PeachBreach”). In 2016-2017, a server at Kennesaw State University that handled statewide election preparation was found exposed to the internet, containing millions of voter records with personal identifying information, election databases, and supervisor passwords.

Additional web portal vulnerabilities in later years have repeatedly risked or briefly exposed personal voter data. Combined with ordinary internet security risks, the traceable ballot-level data that remains inside official systems cannot be treated as securely walled off from potential misuse.

No Longer a Theoretical Problem

The vulnerability Springer exploited was first documented in 2022 by University of Michigan computer scientist J. Alex Halderman and colleagues. The Record IDs (unique numbers the scanners assign to each ballot as it is scanned) assigned by Dominion’s precinct scanners were generated by a fixed, predictable sequence rather than true randomness. Anyone who understood the flaw and obtained the public files could recover the exact scanning order.

Halderman’s team published a peer-reviewed paper on the vulnerability (named DVSorder) in 2024 and had formally notified Georgia’s state elections director of the problem in October 2022. The researchers also presented their findings at USENIX Security. The formal disclosure letter is part of the public court record.

Within days of the public disclosure, the Coalition for Good Governance formally notified the State Election Board and county officials, warning that the predictable Record IDs created permanent, linkable records in violation of Georgia’s absolute secrecy statutes. On Oct. 19, 2022, the organization submitted proposed emergency rules and amendments aimed at requiring sanitization of public releases and restricting access to the original identifiers.

Georgia’s secretary of state’s office has never publicly acknowledged Halderman’s finding by name. On July 28, 2026, State Elections Director Blake Evans issued an Official Election Bulletin requiring counties to stop releasing ballot images directly and to route every public request through a state repository that strips the original Record IDs. Counties must also redact the Record ID column from any Cast Vote Record released to the public.

By stripping the original Record IDs, the bulletin also severs the public audit trail that would otherwise allow independent verification that ballot images match their corresponding Cast Vote Records. The bulletin addresses what the public can obtain. It does not delete or permanently re-randomize the traceable data that continues to exist inside official systems — data that remains accessible to an untold number of county and state officials, as well as multiple commercial vendors.

Notably, the Secretary of State issued this directive without action by the State Election Board, which currently has a proposed rule on the same subject, advanced by Board Member Salleigh Grubbs.

The Right Way to Solve the Problem

The correct technical solution has been known since Halderman’s original disclosure: adequately randomize the records at creation and never allow them to be identifiable. At the time, the best available remedy was to sanitize the data — both the versions released to the public and the records retained inside official systems — so that the recoverable scanning order is destroyed while the ability to match a specific ballot image to its corresponding Cast Vote Record is preserved for auditing purposes. That approach protects voter privacy without eliminating the auditability that the Election Assistance Commission’s Voluntary Voting System Guidelines and the NIST Cast Vote Records model treat as essential.

Dominion released a patch in 2022 intended to prevent the predictable Record IDs from being generated in the first place. Georgia has yet to install it. If that patch works as claimed, the underlying problem is eliminated rather than merely partially cleaned up after the fact. Either way, simply restricting public access to the records while leaving the original data intact inside official systems is the wrong remedy.

In the November 2024 general election, roughly 95 percent of Georgia ballots were scanned on the precinct-level Dominion scanners that carry the Record ID flaw. Mail ballots fall outside that specific problem. A significant share of the vote is therefore exposed to the underlying vulnerability.

Ballot secrecy is not optional. The Georgia Constitution requires that “Elections by the people shall be by secret ballot and shall be conducted in accordance with procedures provided by law.” Secrecy and meaningful verification are complementary constitutional requirements, not competing ones. An election system that protects secrecy only by limiting the public’s ability to verify results, while leaving the traceable data in official hands, fails to meet both obligations at once.

Data that could reveal how many Georgians voted already exists. Some data from previous election cycles remains exposed in the public realm. The July 28 bulletin may limit what the public can easily obtain going forward in future elections, but it leaves the underlying problem of a non-secret ballot unaddressed inside the systems controlled by election officials and their commercial vendors.

The question is whether the state will implement the fix that protects voters without sacrificing transparency, or continue managing the symptoms while the traceable data remains available to those who hold or can unlawfully access the records.

Mark Davis is President of Data Productions, Inc., has been working with voter data since 1986, and is a member of the Georgia Republican Party’s Election Confidence Task Force. He has served as an analyst and expert witness in court cases involving disputed elections seven times over the last 23 years, and has been invited to offer testimony before subcommittees of the Georgia General Assembly three times since 2020. Follow him @MarkDavisGOP on X.