As election officials prepare for upcoming ballots, security researchers and computer scientists continue to sound alarms over specific technological vulnerabilities lingering in voting systems nationwide. Experts stress that while there is no credible evidence showing voting system flaws have ever been exploited to alter a presidential or federal election outcome, distinct vulnerabilities remain in plain sight and threaten ballot secrecy, accurate vote recording, and independent verification.
Security professionals emphasize that voter-marked paper ballots paired with rigorous audits represent the gold standard for trustworthy elections. Researchers frequently challenge unfounded claims that past elections were hacked or stolen, yet they maintain that dismissing real technical vulnerabilities is dangerous. Philip Stark, a retired University of California, Berkeley statistics professor who developed audit protocols for checking paper ballots, explains the nuance clearly. A vulnerability is not an exploit, noting that leaving a key under a doormat does not automatically mean someone will take it and enter the home.
Among the most persistent vulnerabilities identified by election security experts across the United States is the continued reliance on paperless voting. Louisiana stands as the last remaining state to use paperless voting machines statewide on Election Day. Voters press buttons to register their choices, and the equipment records the selections electronically without generating a physical paper ballot. This method leaves no independent paper record to verify whether votes were tallied correctly, prompting other states to retire similar hardware following security research exposing hacking risks and audit failures. J. Alex Halderman, a computer scientist and election security expert at the University of Michigan, describes Louisiana as the dinosaur of American elections. Officials in the Louisiana secretary of state office declined interview requests, though a recent press release indicated the state expects to award a new equipment contract by the end of the year.
Another significant point of vulnerability involves ballot-marking devices, or BMDs. These systems require voters to make selections on a touchscreen before printing out a paper ballot. Security specialists warn that BMDs are susceptible to hacking and errors, and studies show that voters frequently fail to catch mistakes printed on the summaries. During a demonstration at the 2025 Def Con hacktivist conference, researchers displayed how a machine from Georgia, obtained through court-sanctioned access by an Auburn professor, could be manipulated to alter displayed choices, marked selections, or final vote tallies. Blake Evans, executive director for the Georgia secretary of state office, noted that the state’s chief information officer tracks such disclosures and relies on physical security measures implemented by counties to protect stored equipment. According to the nonprofit Verified Voting, roughly 23% of registered U.S. voters live in jurisdictions that rely exclusively on BMDs for in-person voting. While BMDs serve as a vital accessibility tool for individuals who cannot manually mark a paper ballot, security researchers advocate offering them alongside hand-marked paper alternatives.
Software flaws have also introduced privacy risks. Research from Princeton University uncovered a software vulnerability in Georgia’s vote-counting system that could expose how individual citizens cast their ballots. Max Springer, a researcher, utilized public voter records and approximately $20 in artificial intelligence credits to successfully reconstruct the casting order of nearly all in-person ballots in studied Georgia counties. By combining this reconstruction with an additional public record, Springer matched individual voters to their specific ballots across two counties encompassing 2,200 votes, demonstrating that the method could scale to other regions. Researchers initially exposed the bug in 2022, prompting Dominion Voting Systems, now operating as Liberty Vote, to issue a software patch the following year. At the time, roughly 21 states utilized the software, though no centralized database tracks when local jurisdictions implement such updates. The Georgia secretary of state office noted that significant software updates have not occurred since 2019.
In response to the ballot secrecy findings, Georgia election officials shared guidance with counties to mitigate exposure and planned to restrict public access to specific election data ahead of November votes. Liberty Vote declined to comment on the research, though the company states on its website that all its systems are tested, certified, and verified to meet rigorous standards of security and reliability under state and federal requirements. Experts conclude that voters must hold two competing realities in mind: software and cybersecurity standards in certain voting systems remain flawed with multiple avenues for potential failure, yet no direct evidence suggests those weaknesses have been weaponized on a broad scale to alter election outcomes.
