A Princeton postdoctoral researcher named Max Springer just demonstrated that Georgia's secret ballot is not secret. Using a $20 AI subscription and publicly available election records obtained through an Open Records Act request, Springer built a pipeline in a couple of hours that could recover the voting order for 1.52 million ballots — 98.9% of in-person ballots across 114 of 139 counties he examined. In small counties like Heard, the AI matched the majority of 650 early voters to their specific ballots. The AI agent never refused to comply or flagged the request as problematic. The vulnerability is structural, not exotic. Georgia's touchscreen voting system prints paper ballots, which voters feed into tabulators. Each scanned ballot gets a unique identifier — a cast vote record, or CVR. The identifying numbers are not sufficiently random. When paired with the early-voting sign-in list, which records the order voters checked in, AI can reconstruct which ballot belongs to which voter. In places with low traffic, even Flock camera imagery showing when someone entered a building could close the gap. This flaw was first discovered roughly four years ago. The secretary of state's office says it has been requesting legislative funding for a full software overhaul ever since. Spokesperson Robert Sinners produced emails and phone records documenting repeated appropriation requests — all denied. The governmental affairs committee secretary who received many of those requests, Tim Fleming, is now the Republican nominee for secretary of state. He did not respond to comment. Sinners summarized the legislative response: "A big fat goose egg." The political dynamics are poisonous. Brad Raffensperger, Georgia's outgoing secretary of state, remains a top Trump target after refusing to overturn the 2020 presidential result. Conservative legislators aligned with election skeptics have blocked funding that would fix a real election security vulnerability — apparently because fixing it would require cooperating with Raffensperger. Every other state using Dominion software has either patched this issue or withholds the vulnerable data from public inspection. Georgia has done neither. Georgia law is at war with itself. The state constitution explicitly requires a secret ballot, and Georgia's ballot secrecy statute is among the strongest in the country. But post-2020 transparency laws demand open access to election records, including the very cast vote records that make de-anonymization possible. Raffensperger ordered the CVR identifier numbers redacted before public release, which cryptographer Ben Adida of VotingWorks called a substantial fix. Board member Salleigh Grubbs proposed having poll workers shuffle printed ballots before scanning to defeat ordering attacks, but county officials and fellow board members — including conservative Republican Janelle King — rejected that as creating more problems than it solves. The Georgia State Elections Board held an emergency meeting Thursday, less than two weeks before early voting begins for the midterms that will determine control of Congress. No solution is ready. Retraining every poll worker on new procedures at this stage is operationally unrealistic. The $30 million software overhaul that could have prevented this never happened. The state is heading into a high-stakes election with a ballot secrecy system that a graduate student broke in an afternoon with consumer-grade tools. The core failure is not technological — it is institutional. A known vulnerability sat unpatched for years because political grudges overrode security funding. AI did not create the flaw; it made exploiting it trivially cheap. The question now is whether Georgia voters can trust that their choices remain private, and whether anyone with $20 and motive — an employer, a political operative, an abusive spouse — could find out how they voted.
