Election security researchers have identified vulnerabilities in US voting systems, including paperless machines in Louisiana and a software flaw in Georgia's vote-counting system, while stressing there is no evidence any have been exploited to change an election result.
The findings, reported by Axios, form part of a picture in which researchers have challenged unfounded claims that elections were stolen through hacking while also warning against dismissing real vulnerabilities.
"A vulnerability is not an exploit," said Philip Stark, a retired University of California, Berkeley statistics professor who developed an audit protocol for checking paper ballots. "You can leave a key under your doormat, and that doesn't mean someone takes the key and opens your door."
Louisiana is the last state to use paperless voting machines statewide on Election Day, leaving no independent paper record against which to check counts. J. Alex Halderman, a computer scientist at the University of Michigan, called Louisiana "the dinosaur of American elections." The Louisiana secretary of state's office declined an interview request, but said in a press release that the state is expected to award a new election equipment contract at the end of the year.
Roughly 23% of US registered voters live in jurisdictions that exclusively use ballot-marking devices for in-person voting, according to the nonprofit Verified Voting. Researchers warn that the devices are vulnerable to hacking and errors, and a demonstration at the Def Con conference in 2025 showed how a machine obtained from Georgia could be manipulated. Blake Evans, executive director for Georgia's secretary of state office, said the state tracks such vulnerabilities and relies on physical security for equipment stored in counties.
A software flaw in Georgia's vote-counting system could expose how individual voters cast their ballots, according to research from Princeton University. Researcher Max Springer used public voter records and about $20 in AI credits to reconstruct the order in which nearly all in-person ballots were cast in the counties he studied, then matched voters to their ballots in two counties and 2,200 votes. The bug was first exposed in 2022, and Dominion Voting Systems, now Liberty Vote, released a patch the following year. The Georgia secretary of state's office said "there haven't been any significant software updates since 2019," but it has shared guidance with counties and plans to limit public exposure of election data in November. Liberty Vote declined to comment, but says on its website that every "Liberty Vote system is tested, certified, and verified to meet the highest standards of election security and reliability in accordance with all applicable state and federal requirements."
Stark said voters should be aware of two things that can be simultaneously true: "The systems are garbage from a software and cybersecurity point of view. There's lots of ways that they can fail." At the same time, he said, there is no direct evidence that anything has happened on a large scale that changed the outcome of a presidential or federal election.
Analysis
Why This Matters
- The vulnerabilities threaten three pillars of trustworthy elections: ballot secrecy, accurate vote recording and independent verification of results.
- Researchers stress that a vulnerability is not an exploit, and no evidence exists of hacking changing outcomes, but the flaws remain in systems used across the country.
- State decisions on equipment contracts, software updates and data publication will shape the security landscape for the 2026 midterm elections.
Background
Election security experts regard voter-marked paper ballots and rigorous audits as the gold standard for trustworthy elections. Most states retired paperless voting machines after researchers exposed their vulnerabilities and the difficulty of independently auditing results. Louisiana is the last state still using them statewide. There is no centralized database tracking when voting software updates are implemented around the country, according to the Axios report.
Key Perspectives
- Philip Stark: A vulnerability is not an exploit, and while the systems are "garbage from a software and cybersecurity point of view," there is no direct evidence that anything changed the outcome of a presidential or federal election on a large scale.
- Louisiana secretary of state's office: The state is expected to award a new election equipment contract at the end of the year; it declined an interview request.
- Georgia secretary of state's office: Says there haven't been any significant software updates since 2019, has shared guidance with counties on ballot secrecy, and plans to limit public exposure of election data in November.
- Blake Evans: Says the state tracks vulnerabilities and relies on physical security for equipment stored in counties.
- Liberty Vote: Says every system is tested, certified and verified to meet the highest standards of election security and reliability; it declined to comment.
What to Watch
- Whether Louisiana's expected election equipment contract at the end of the year retires the state's paperless machines.
- How Georgia's November decision to limit public exposure of election data affects the research method demonstrated by Max Springer.
- Whether jurisdictions identified as using the flawed vote-counting software apply the patch released by Liberty Vote, with no centralized database tracking such updates.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedResearchers flagged voting-system vulnerabilities in Louisiana and Georgia.Axios: “Election security experts interviewed by Axios found these vulnerabilities in parts of the U.S.:”
- Partly supportedThere is no evidence that hacks altered election results.Axios: “There’s no credible evidence that voting-system vulnerabilities have been exploited to change election results.”
- SupportedThe flaws threaten ballot secrecy and verification.Axios: “researchers have found isolated flaws that threaten ballot secrecy, accurate vote recording and independent verification of results.”
- SupportedPhilip Stark said, “A vulnerability is not an exploit,” and compared leaving a key under a doormat with someone taking it to open a door.Axios: ““A vulnerability is not an exploit,” Philip Stark, a retired UC Berkeley statistics professor who developed an audit protocol for checking paper ballots, said at a recent conference. “You can leave a key under your doormat, and that doesn’t mean someone takes the key and opens your door.””
- SupportedJ. Alex Halderman called Louisiana “the dinosaur of American elections.”Axios: “Election security expert and computer scientist J. Alex Halderman, of the University of Michigan, called Louisiana “the dinosaur of American elections.””
- SupportedThe Georgia secretary of state's office said, “there haven't been any significant software updates since 2019.”Axios: “The Georgia secretary of state’s office said “there haven’t been any significant software updates since 2019.””
- SupportedLiberty Vote's website says every system is tested, certified and verified to meet the highest standards of election security and reliability under applicable requirements.Axios: “the company says every “Liberty Vote system is tested, certified, and verified to meet the highest standards of election security and reliability in accordance with all applicable state and federal requirements.””
- SupportedStark said, “The systems are garbage from a software and cybersecurity point of view. There's lots of ways that they can fail.”Axios: ““The systems are garbage from a software and cybersecurity point of view. There’s lots of ways that they can fail.””
- SupportedLouisiana is the last state to use paperless voting machines statewide on Election Day.Axios: “Louisiana is the last remaining state to use paperless voting machines statewide on Election Day.”
- SupportedRoughly 23% of US registered voters live in jurisdictions that exclusively use ballot-marking devices for in-person voting.Axios: “Roughly 23% of U.S. registered voters live in jurisdictions that exclusively use BMDs for in-person voting, according to the nonprofit Verified Voting .”
- SupportedA software flaw in Georgia's vote-counting system could expose how individual voters cast their ballots.Axios: “A software flaw in Georgia’s vote-counting system could be used to expose how individual voters cast their ballots, according to research from Princeton University.”
- SupportedSpringer demonstrated matching voters to their ballots in two counties and 2,200 votes.Axios: “With an additional public record, Springer was able to match individual voters to their ballots, as he demonstrated with two counties and 2,200 votes in his study.”