A $20 AI subscription showed how Georgia's ballots could be linked to voters. The state redacted the data before midterms.

A $20 commercial AI subscription didn't expose Georgia's secret ballot. It found the seam that was already there: every scanned ballot in the state's public-records dump carried a unique identifier, neatly lined up against voter rolls, waiting for a language model to connect the dots.

The researcher who found it is Max Springer, a postdoctoral fellow at Princeton University's Center for Information Technology Policy. Using a public records request under Georgia's Open Records Act, Springer pulled the state's released ballot data and handed it to a consumer LLM. Within a couple of hours, the model returned a working pipeline that identified secret ballots across Georgia and told Springer what additional data it would need to identify real voters. The agent did not refuse. It did not flag the task. It named the next dataset it wanted.

The mechanism is older than the AI. Georgia's ballot scanners, the machines voters feed paper ballots into at precincts and central-count sites, write a unique ballot identifier onto each scanned sheet and store the same identifier on a digital row in a spreadsheet called a cast vote record, or CVR. The CVR is what the state counts, audits, and contests. Under the state's Open Records Act, the post-election CVR file has long been released to researchers, journalists, and the public. Each row carries one vote, one ballot ID, and enough metadata to act as a join key against Georgia's voter file, which is also public.

That join is the seam. Given any CVR file, an attacker only needs the voter roll to start linking ballots to named voters, the way a spreadsheet lookup function links two tables by a common column. The 2024 USENIX Security paper "Busting the Paper Ballot: Privacy and Security in America's Election Infrastructure", led by a team including researchers now at Princeton, documented that the privacy failure was structural: the join existed in plain sight in multiple states. A preprint extending the work to adversarial machine learning predicted exactly the kind of off-the-shelf LLM pipeline Springer would later build.

Springer's blog post, published in August, named Georgia specifically and laid out the LLM step. The state's response arrived Thursday morning, when the Georgia State Elections Board held an emergency meeting on the re-identification risk, hours after statehouse reporting on the same dispute had circulated statewide. Outgoing Secretary of State Brad Raffensperger, who leaves office at the end of the year, ordered the state to redact the unique ballot identifier from post-election public releases going forward. Ben Adida told the board the change "substantially addresses this flaw."

"Substantially" is the operative word. Adida's wording matters because it bounds the fix. Redacting the ballot ID in the released CVR severs the join, but the rest of the CVR, including precinct, method of voting, ballot style, and contest-level vote, still ships. Researchers still get the data they need to audit counts. What they no longer get, in Georgia, is the column that turns an audit dataset into a re-identification pipeline. Other states without a similar redaction authority do not have that protection, and naming the seam in a major publication invites better-funded adversaries to find it there too.

The model that built the pipeline is also a story. A $20 LLM subscription, prompted in plain English, produced a working re-identification workflow against a real US state's election data without raising concerns or refusing. That is a capability gap, not a model upgrade: today's commercial assistants can perform democratic-harm tasks when asked, and they do not yet have the reflex to ask why. The result is a researcher with a public-records request becoming a more capable adversary than the system's designers planned for, on a budget smaller than a dinner.

Early voting in the midterm that decides control of the US Congress starts in less than two weeks. Georgia's redaction order is a stopgap from a lame-duck secretary of state, and it leaves the broader architecture intact: states still count and publish CVRs, and the same join exists on paper in jurisdictions that have not redacted. The next election-privacy fight will not be about whether AI can read a secret ballot. It will be about who is responsible for removing the column that lets it.