Full Report
It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools. Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses affected scanners) in the recent May 2026 primary. Notably, I never touched a voting machine, exploited a network, examined source code, or accessed anything non-public. After pointing a coding agent to the original vulnerability paper, I supplied it with two data sources highlighted in the paper: the early-voting list for each county, and the “CVR” (cast-vote record) file, containing every ballot and its selections (but not the voters’ names or other identifying information). The CVR file is available upon request, precisely because a public, ballot-level record is what makes election results independently verifiable...
Analysis Summary
# Vulnerability: Ballot De-anonymization via Cast-Vote Record (CVR) Analysis
## CVE Details
- **CVE ID:** Not explicitly assigned in the source text (Original 2022 research related to Dominion Voting Systems ImageCast scanners is often associated with the CISA/J. Alex Halderman findings).
- **CVSS Score:** N/A (Privacy/Anonymity flaw)
- **CWE:** CWE-385: Publishes Sensitive Information (Privacy Leak), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
## Affected Systems
- **Products:** Voting machine scanners (specifically those utilized in Georgia and 20 other U.S. states).
- **Versions:** Systems utilizing ballot-level Cast-Vote Record (CVR) exports that maintain chronological or predictable sequencing.
- **Configurations:** Election jurisdictions that release public CVR files alongside chronological voter check-in lists (e.g., early-voting lists).
## Vulnerability Description
The flaw is an algorithmic failure in how voting machines record and export ballot data. While CVR files are intended to be anonymous records of votes cast, the systems often record these ballots in the exact chronological order they were scanned. When this sequenced file is correlated with public "voter activity" logs (which show the order in which voters checked in at a polling station), the anonymity of the secret ballot is broken. An attacker can map specific voters to their specific ballot selections.
## Exploitation
- **Status:** Exploited in the wild (Demonstrated in the May 2026 Georgia Primary).
- **Complexity:** Low (Modern AI coding agents can now automate the correlation analysis using only the original research paper as a guide).
- **Attack Vector:** Information Disclosure (Data Correlation). No physical access or network intrusion is required; only public records are used.
## Impact
- **Confidentiality:** **High.** Completely compromises the secrecy of the ballot for identified voters.
- **Integrity:** None. The votes themselves are not altered.
- **Availability:** None.
## Remediation
### Patches
- **Software Updates:** Manufacturers must update scanner firmware to cryptographically shuffle or "salt" the order of ballots in the CVR export to ensure chronological sequences cannot be reconstructed.
### Workarounds
- **Data Redaction:** Election officials can manually randomize the order of rows in CVR files before public release.
- **Aggregate Reporting:** Limiting the granularity of CVR data in small precincts to prevent statistical de-anonymization.
## Detection
- **Indicators of Compromise:** As this is a passive data analysis attack using public records, there are no traditional "logs" of an exploit.
- **Detection Methods and Tools:** Forensic audit of CVR files to check if they match the timestamp or sequence of physical ballot box intake.
## References
- **Schneier on Security:** hxxps[://]www[.]schneier[.]com/blog/archives/2026/09/security-vulnerability-in-a-voting-system[.]html
- **CITP Princeton Research:** hxxps[://]blog[.]citp[.]princeton[.]edu/2026/08/03/an-algorithmic-failure-beneath-the-secret-ballot/