Georgia is preparing for a significant shift in how its citizens will cast ballots, with state lawmakers moving towards a hand-marked paper ballot system for the 2028 election. This overhaul comes as cybersecurity experts and researchers urge a thorough consideration of security measures to protect the integrity of the voting process from undue influence and evolving threats. The current ballot-marking devices, which use QR codes to tally votes, have drawn repeated criticism from advocates who prefer human-readable text for ballot counts.
State lawmakers have already passed legislation to phase out the use of QR codes on ballots. Now, a special committee is tasked with developing the guidelines for selecting the state's next statewide voting system. Sen. Max Burns, a Sylvania Republican who co-chairs this committee, emphasized the goal of achieving the highest possible level of security while maintaining the convenience that Georgia voters expect. Sen. Burns stated, "100% [security] is a goal." He added that mitigation opportunities and other processes must be built around the system to address potential challenges.
At a recent meeting held at the state Capitol in Atlanta, cybersecurity experts and researchers shared their insights with members of the legislative panel, outlining several critical issues that lawmakers must address. The state's current voting machines, first used statewide in 2020 under a 10-year contract, are still in operation more than half a decade later. Experts present at the meeting highlighted that the lack of consistent software upgrades has left these systems vulnerable.
Looking ahead, any new system adopted by Georgia will likely be in use for at least a decade. However, Geoff Hale, a fellow at the nonpartisan Washington-based Center for Democracy and Technology, cautioned that technology and cybersecurity risks evolve rapidly. He stressed that Georgia is not purchasing a system that will remain permanently secure, emphasizing that "Election security is a process and not a purchase." This means that the state’s voting equipment will require multiple updates throughout its lifespan. Michael Barnes, the deputy director of information technology for voting systems for the secretary of state’s office, advised lawmakers to select a vendor with a clear plan for ongoing support, technology updates, and spare parts for the entire duration the state intends to use the system.
Ensuring voter privacy is another complex issue lawmakers must navigate. Georgia's constitution mandates secret ballots, but advancements in artificial intelligence and other technologies are making this harder to guarantee, particularly in smaller counties. For instance, a Princeton University researcher claimed last month to have used an AI tool to link thousands of voters in Heard and Cherokee counties to specific ballots with relative certainty, based on publicly available data.
The intersection of privacy and accessibility presents an additional challenge. Federal law requires precincts to provide at least one voting machine for voters with disabilities. However, in jurisdictions where most ballots are marked by hand, it could become relatively easy to determine how voters who use accessibility software cast their ballots, thus compromising their anonymity. Mark Lindeman, policy and strategy director for Philadelphia-based Verified Voting, supported minimizing the overall role of ballot-marking devices but argued against restricting who can use them. He noted that many voters, beyond those identifying as disabled, might benefit from machine-marked systems, and a larger pool of users would enhance anonymity for voters with disabilities.
The risk of foreign interference in elections is also a growing concern, fueled by federal cuts to election security systems and a recent increase in cyberattacks. This year alone, several Georgia counties have experienced cyberattacks targeting their water systems. The FBI has reported similar attacks in states like Minnesota, Michigan, and Wisconsin, and the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory in April suggesting a possible link to Iran.
Despite these threats, experts acknowledge that a system completely free from the risk of malicious interference is impossible to implement. Michael Specter, an assistant professor and cybersecurity researcher at Georgia Tech, suggested that the most secure systems anticipate breaches and develop transparent protocols for disclosure and adaptation. Specter stated, "A system is only secure if the adversary knows how the system works and it is still secure." While switching to hand-marked ballots may reduce certain security risks, experts underscored that no technology is impervious to manipulation. Geoff Hale from the Center for Democracy and Technology further clarified that "Ballot on demand [printing] does not remove software from the election entirely," but rather shifts where software is used in the process.
Paulding County Elections Director Deirdre Holden voiced concerns about malicious actors attempting to access voter data. However, she noted that in her experience, state officials have been prompt in responding when counties faced cyberattacks, indicating a robust state system designed to provide rapid alerts and support.