|
August 28, 2026
We sent the following memo to Georgia election officials today.
Georgia County Election Officials,
Below are Answers to FAQs and Recommendations for county election officials and their attorneys.
Thank you, particularly county officials, to those who responded to our recent explainers and Monday’s email with questions and comments about the DVSorder issue and the alternatives we suggested. This explainer references the underlying privacy problem and the practical choices available to counties. We urge your prompt consultation with the county election board’s attorney on this significant legal matter.
Bottom line. A legally cast ballot must remain anonymous after it is scanned—not merely treated as somewhat confidential. The DVSorder software flaw makes the scanner’s supposedly random Record IDs predictable instead of random, allowing ballot images or cast-vote records to be restored to scanning order and connected to the voter. Counties must develop a solution to avoid unlawfully attaching traceable identifiers to ballot records as they are scanned. The SOS cannot invalidate the state constitution’s requirements with an Election Bulletin! The solution is either to update the software or physically shuffle ballots before scanning. We do not recommend the option of hand counting ballots (which also avoids the traceability) because of accuracy and timeliness concerns.
Q: It is true that even people without software skills, but using AI tools, can actually find specific individual voters’ ballots in public electronic election files available to anyone?
A. It is not hypothetical, but quite real, fast, simple, and cheap to do at scale. It can be done with real ballot data because of the Dominion software flaw, which should be corrected immediately with the 5.17 patch. Yes, employers can see how their employees voted. School boards and parents can see how teachers voted. Judges can see how attorneys and defendants voted on the judges’ elections. Of course, having traceable ballots is unquestionably illegal, and officials must act now to stop this insidious unlawful process.
Q: If the 5.17 software patch fixes the problem, why don’t we install the patch on the voting machines just before we load the new election this year on the machines and conduct the Logic & Accuracy Testing?
A: We believe that this is a feasible and realistic solution, and there is certainly adequate time to do so in conjunction with loading the November election. It would be a four-step process (2 added steps) performed on each machine by spending another 20-30 minutes per machine. The counties (and Dominion tech help, if desired) could:
1) install the new software via USB sticks on each touchscreen (just as counties did for the emergency October 2020 update);
2) conduct Acceptance Testing to ensure operability;
3) upload the November election programming, and
4) conduct routine Logic & Accuracy Testing.
Based on informal input from experts, and an official who oversaw the recent 5.17 update in another state, we estimate that the installation of the patch (step 1) and required testing (step 2) would add 20 to 30 minutes additional automated program running time per touchscreen. Many touchscreens could be simultaneously updated. The installation of the patch seems quite feasible when performed in conjunction with routine machine programming and testing.
Given the importance of the needed patch to improve the security of the system and to address the ballot secrecy violation, it seems imperative to undertake this solution immediately. However, we caution that the software fixes advertised by 5.17 should be tested by independent experts to evaluate the effectiveness. This testing and planning should happen immediately.
Q: If the patch is not installed, could voters scan their ballots in the normal manner if election officials shuffle the paper ballots before turning them in at the end of the day?
A: No. The privacy problem arises when the voter inserts the anonymous paper ballot into the scanner. At that moment, the scanner creates a ballot image and cast-vote record and assigns the ballot a unique Record ID. Assigning a unique identifier is proper if the identifier is random and truly prevents reconstruction of cast/scanning order, as required. The problem is that the identifiers generated by Dominion scanners with the flawed software are predictable, so the apparent “randomization” can be reversed and the electronic ballot records restored to the order in which ballots were scanned.[1] That means that when we know the order in which the voters scanned their ballots, the ballot record can be connected to the voter.
Shuffling the paper ballots after scanning therefore comes too late. To prevent the electronic records from preserving voter order, any effective shuffling must occur before the ballots are scanned.
Q: The Secretary of State has instructed counties to redact the Record ID column before releasing records to the public as the “solution” to purportedly safeguard the voters’ privacy. Aren’t counties required to follow all SOS instructions?
A: Counties should obtain advice from their attorneys and should follow lawful state directives. But an SOS administrative instruction cannot waive the Georgia Constitution or a statutory command, or give countering controlling instructions. Redacting a column before public release does not cure the underlying ballot secrecy problem, even for public release. The inaccurate assertion by Gabe Sterling to the AJC that the new instructions “make it impossible” for the ballot secrecy to be broken should not be relied on by the counties. (Experts had already warned that such instructions would not work to conceal the voter sequence.[1])
First, depending on the format and content of the released worksheet, the remaining data may still permit mathematically reconstructing the ordering that should never have been recoverable. (We have tested this ourselves, and indeed, the experts are right, that the SOS redaction “solution” does not work. The order is still recoverable.) Second—and more fundamentally—redaction only conceals (or attempts to conceal) from the public the continued unlawful creation of traceable ballot records. The complete unlawfully created records remain in the hands of election insiders, contractors, and vendors. Ballot anonymity should not depend solely on promises that people who possess traceable records will not use or disclose them, or accidentally allow access.
The legal mandate is an anonymous ballot, not merely restricted access to traceable ballots. Georgia law requires county superintendents to conduct elections in a manner that guarantees ballot secrecy, and optical-scanning systems in use by counties must only permit voting in absolute secrecy.[2][3]
Q: Why not collect and shuffle ballots every few hours, then have bipartisan election officials scan them at the polling place?
A: We once thought this might be workable, but after we undertook detailed analysis, we believe that polling place shuffling during early voting generally does not appear workable. Most early voting locations serve voters from many precincts and ballot styles. To break the relationship between voter order, ballot style, and scanning order, a very large pool—sometimes roughly 2,000 ballots—may be needed for an adequate shuffle. The required number depends on the mix of ballot styles, traffic patterns, and other observable information; the mathematics and operating procedures must be tested before relying on any threshold.
For early voting, central counting therefore appears to be the more workable option: ballots would be cast in old fashioned secured ballot boxes without scanning at the voting location, transported under documented bipartisan chain of custody, thoroughly shuffled, and scanned at the central tabulating center. O.C.G.A. §§ 21-2-483(c) and 21-2-485 authorize central-count processing and delivery after the polls close.[4]
Election Day requires additional localized study. Because a precinct generally has fewer ballot styles than an advance-voting center, and more “same alike” ballots, adequately controlled shuffling and later scanning may be more feasible to break the traceability. But no county should assume that periodic shuffling in the polling place is sufficient without testing the relevant ballot-style distribution, traffic, observation risks, reconciliation controls, and statutory timing requirements.
Q: The State Election Board declined to address the ballot secrecy issue. Doesn’t that show the Secretary’s process is acceptable—and that counties should just follow that instruction?
No. The failure of state officials to provide an effective remedy does not eliminate the legal duties of the county. The DVSorder vulnerability has been disclosed since 2022, and the SEB and SOS have repeatedly been warned about it. CGG filed its first complaint with the SEB in October 2022 concerning DVS order. AI has escalated the risk exponentially since 2022, so we raised this with the Board again, but without success. The absence of corrective statewide action leaves counties in the difficult position of having to conduct elections using procedures that still satisfy controlling federal and state law without uniform guidance from the SEB.
The State Election Board also has duties of its own, including promoting legality and uniformity of elections and enforcing the Election Code.[6] The SEB’s failure to undertake their duties does not excuse the county superintendents from fulfilling their duties to comply with secret ballot laws under § 21-2-70(13).
The counties are now aware that the SOS “solutions” in the July 28 memo are not effective and do not create compliance with law, and as a result, must find alternative solutions. The reality of the readily available power of AI must be factored into the officials’ evaluation of the risk of exploitation, which has changed substantially.
Q. Gabe Sterling told the Atlanta Journal-Constitution that connecting a voter to a ballot still requires a “fair amount” of guesswork. If so, why is any change needed?
A: Mr. Sterling’s statement is not accurate. When someone has a record of scanning order, reversing the DVSorder sequence identifies exactly which electronic ballot record corresponds to each observed voter. There is no “guesswork” in that case.[1]
Exact order can be established in several ways—for example, through a reliable observer’s voter order list, strategically recorded scanner public-counter readings, or security video showing voters’ order at the scanners. Each observed voter can then serve as a direct anchor to the corresponding ballot record.
If there is no accurate record of exact voter scanning order, some inference may be necessary when check-in order and poll-pad timestamps are used as a proxy for scanning order. But that does not make the risk speculative, or generally require “a good bit of guessing.” During low-traffic periods, and particularly when ballot style or party sharply narrows the possibilities, which is quite often in early voting, the available public records can connect to large percentages of many voters to ballots with high confidence. Protection of a constitutional right should not depend on whether a particular voter happened to cast a ballot during a crowded interval that made tracing harder. Our research proves that the claim of requiring guesswork is simply not true. The SOS’s inaccurate statement should not be relied on by officials.
Q: If every voter cannot be traced with certainty, why should counties change their procedures?
A: The legal mandate is not that every ballot must be traceable before systemic violation matters. Elections must use a secret ballot (for every single voter), and county superintendents must guarantee ballot secrecy.[3][5] If a systemic process or software flaw makes any voter’s ballots traceable, the process should be corrected for everyone.
Counties cannot leave voters hoping that they fall within a subset whose ballots happen to be difficult to trace because of the time, place, crowd size, or ballot-style mix. County officials must protect every voter’s right to an anonymous ballot throughout the election.
Q: Some county’s voters have not complained much about large touchscreen displays of their votes or DVSorder traceability. Isn’t this a concern over something that does not matter to voters?
A: Our experience is the opposite: voters value knowing that no one can learn how they voted and that no one can later demand that they explain or justify their vote. Ballot secrecy protects not only voters who complain to officials, but also those least able to complain, and are under the most pressure from authority figures.
Potential pressure can affect employees and job applicants, controlling spouses, teachers whose students’ parents may object to their politics, and school-system or hospital employees whose work is subject to review by elected officials. Most people who experience pressure or coercion will never report it. Their silence is not evidence that secrecy does not matter; it is one reason the law provides structural protection rather than requiring each voter to object.
Counties should therefore use legally compliant practices that protect anonymity for every voter without requiring anyone to disclose that he or she feels vulnerable.
Q. Didn’t the 2026 special-session legislation grandfather the existing hardware and software and approve their continued use?
A. No. The scope of Senate Bill 3EX has been vastly overstated. The legislation did not grandfather the existing hardware and software or approve the software or every feature of the current system. It delayed until January 1, 2028, the requirement that a new voting system that reads machine printed text be installed. It should not be read as legislative approval of QR-code tabulation given the ongoing clear existing legal requirements.[7]
SB 3EX did not repeal or suspend the requirement for a human-readable vote on the face of the ballot. Nor did it waive the Georgia Constitution’s secret-ballot command, O.C.G.A. § 21-2-365(6)’s absolute-secrecy requirement, or the superintendent’s duty under O.C.G.A. § 21-2-70(13) to guarantee ballot secrecy.[2][3][5] An ordinary statute like 3X also could not amend the Georgia Constitution. And there is no indication that Georgia lawmakers would support repealing a principle as fundamental as the secret ballot. The conditions for use of the voting system remain in place, including mandated ballot secrecy.
HAVA also requires each voting system used in a federal election to provide protections for voter privacy and ballot secrecy. Counties should promptly ask counsel to evaluate all applicable state and federal requirements in light of the SOS’s instructions which do not comply with law.[8]
Election officials should not treat SB 3EX as a blanket validation of the existing system or as a waiver of continuing legal violations. Unhappy voters or candidates could seek to challenge an election based on those violations.
Recommended Actions by Counties
🛠️ Request that the Secretary of State immediately test and install 5.17 or newer version in advance of the November election, using Dominion techs and state funding.
⚖️ Consult county counsel promptly about the constitutional and statutory ballot secrecy duties and the legal sufficiency of the Secretary of State guidance, as well as its erroneous claims made of making it impossible to order the ballots.
🔍 Do not assume that deleting IDs from public releases prevents the underlying traceable records from being unlawfully created or retained or released.
🔐 If no patch is installed, evaluate a controlled central-count process, including secure ballot casting, bipartisan chain of custody, reconciliation, adequate shuffling before scanning, observation, and documentation.
🧮 If no patch is installed, evaluate any proposed Election Day shuffling method mathematically and operationally before relying on it, accounting for ballot styles, voter traffic, observable anchors, and the statutory requirement to begin post-poll tabulation promptly.
🕶️ Preserve public transparency by producing ballot-level records that are genuinely anonymous rather than traceable records that must be improperly withheld from the public.
🔄 Ask the SEB to reconvene to provide guidance.
📜 Seek legal counsel on how the county can comply with O.C.G.A. 21-2-72 and Open Records laws for election records, including ballot images, given the SOS questionable instructions for withholding records that appear to be in conflict with such transparency laws.
Sign up here to recieve our future explainers.
Sources
[1] J. Alex Halderman et al., The DVSorder Vulnerability, including the August 23, 2022 disclosure letter: https://dvsorder.org/
[2] O.C.G.A. § 21-2-365(6), requirements for optical-scanning voting systems: https://law.justia.com/codes/georgia/title-21/chapter-2/article-9/part-4/section-21-2-365/
[3] O.C.G.A. § 21-2-70(13), superintendent’s duty to guarantee ballot secrecy: https://law.justia.com/codes/georgia/title-21/chapter-2/article-2/part-3/section-21-2-70/
[4] O.C.G.A. §§ 21-2-483(c), 21-2-485, central-count and precinct-count procedures: https://law.justia.com/codes/georgia/title-21/chapter-2/article-11/part-5/
[5] Georgia Constitution, Art. II, Sec. I, Para. I, secret ballot: https://law.justia.com/constitution/georgia/conart2.html
[6] O.C.G.A. § 21-2-31(1), (7), State Election Board duties: https://law.justia.com/codes/georgia/title-21/chapter-2/article-2/part-1/subpart-1/section-21-2-31/ ; https://law.justia.com/codes/georgia/title-21/chapter-2/article-2/part-1/subpart-1/section-21-2-33-1/
[7] Georgia Senate Bill 3EX (2026 Special Session), as passed: https://www.legis.ga.gov/api/legislation/document/2026EX/249745
[8] Help America Vote Act, 52 U.S.C. § 21081: https://uscode.house.gov/view.xhtml?path=/prelim@title52/subtitle2/chapter209/subchapter3/partA
| 
