A new analysis from Princeton University’s Center for Information Technology Policy shows that a capable analyst — or even an ordinary AI model — can reconstruct the order in which most Georgia ballots were scanned and, by combining that order with other ordinary election records, determine how individual voters cast their ballots.
Using publicly available data from the state’s May 2026 primary, researcher Max Springer demonstrated the technique at scale, recovering the scanning order of roughly 1.5 million ballots (98.9 percent of in-person ballots) across 139 counties. In smaller example jurisdictions, the linkage was nearly complete: in Heard County every one of the 650 early in-person voters could be tied to a specific ballot, and in Ball Ground (Cherokee County) all 1,860 early voters were matched. In other words, the supposedly secret ballot is not nearly as secret as the public has been told.
Early voting compounds the vulnerability. Voters at vote centers come from multiple precincts and often use different ballot styles with different candidate choices. Those differences create additional data points that can improve the ability to isolate individuals inside the Cast Vote Records (the electronic files that list every candidate choice marked on each ballot). Match confidence will vary — some linkages can be made with near certainty, others with lower confidence — but a talented programmer or AI user can still perform substantial voter profiling.
In small towns and close-knit communities, the risks of exposure are obvious. Parents could identify teachers’ ballots. Employees could face pressure from employers, or bias from potential employers. Even people who never face overt pressure could still experience quiet discrimination.
Some voters already avoid primaries because they do not want their party preference known. The ability to reverse-engineer candidate choices in a general election would only increase the potential for intimidation and could open the door to a whole new form of doxing.
Many people assume election officials are supposed to be able to know how individuals voted. They are not. Georgia law requires “absolute secrecy” of the ballot. While election officials must handle anonymous ballots, the system also must not allow anyone — including poll officials, election boards, or the state’s vendors — to determine how any particular voter cast his ballot.
The ability to reconstruct individual voting choices — and potentially disclose them — raises serious legal concerns under Georgia law, but also carries substantial commercial and political value. In an era when major campaigns routinely spend hundreds of millions of dollars, the ability to know how specific voters actually cast their ballots could be worth millions.
When that information can be assembled across multiple election cycles, the ability to build detailed, long-term voter profiles only grows stronger. That kind of data is useful to campaigns, advocacy groups, and anyone building sophisticated micro-targeting models. An insider at the state or county level with access to the original internal data files could face a clear temptation. The creation of traceable ballots must stop — while preserving the ability to audit the election.
Those concerns are heightened by the fact that Georgia’s Secretary of State’s office has already experienced multiple serious data exposures and breaches. In 2015, the office distributed voter files containing Social Security numbers, driver’s license numbers, and birth dates for more than 6 million voters (the “PeachBreach”). In 2016-2017, a server at Kennesaw State University that handled statewide election preparation was found exposed to the internet, containing millions of voter records with personal identifying information, election databases, and supervisor passwords.
Additional web portal vulnerabilities in later years have repeatedly risked or briefly exposed personal voter data. Combined with ordinary internet security risks, the traceable ballot-level data that remains inside official systems cannot be treated as securely walled off from potential misuse.
Hellbound and Down 