U.S. election security remains a layered defense rather than a clean bill of health: paper records and procedural controls make nationwide vote manipulation difficult, but researchers continue to find weaknesses in voting equipment, ballot privacy and the information environment surrounding elections. The most recent concerns center on unpatched Dominion scanners, barcode-based ballot systems and artificial intelligence that can scale deceptive influence campaigns.
In a 2022 advisory, the Cybersecurity and Infrastructure Security Agency identified nine vulnerabilities in Dominion Voting Systems’ Democracy Suite ImageCast X ballot-marking devices. The agency said exploitation would require physical access to individual machines, access to an election-management system or the ability to alter files before they were loaded onto a device. CISA reported no evidence that the flaws had been exploited in an election, but warned that they should be mitigated promptly.
The ImageCast X issue also illustrates the risk of summary ballots that encode selections in a barcode or QR code. A voter may be able to read a printed candidate list, while the scanner relies on machine-readable data that the voter cannot independently inspect. CISA recommended using full-face paper ballots where possible, alongside physical security, pre- and post-election testing and audits. The agency’s current election-security guidance also tells jurisdictions to update systems and prioritize known exploited vulnerabilities, although the voting flaws discussed here have not been reported as exploited in the wild. CISA election-security guidance [5][6]
A separate ballot-privacy problem, known as DVSorder, affects Dominion ImageCast Precinct and ImageCast Evolution scanners used in parts of 21 states. Researchers found that identifiers intended to obscure ballot order could be reversed, potentially allowing publicly available records and other information to be used to associate ballots with voters. Princeton researchers say Dominion developed a correction in Democracy Suite version 5.17, certified in March 2023, but reported evidence from 2026 suggesting that some jurisdictions still had not deployed the fix. The flaw threatens ballot secrecy rather than the accuracy of vote totals, and there is no verified evidence that it has been used to alter election results. Princeton’s analysis [15][22]
AI adds a different kind of election risk. Researchers and election experts say cloned voices, fabricated video, synthetic images and automated messaging can cheaply flood social platforms with false claims about candidates, polling conditions or election results. That campaign can undermine confidence even when voting and tabulation systems remain uncompromised; experts noted that most voting equipment is isolated from the public internet and that physical or privileged access would still be needed for a direct machine attack. More than 98% of U.S. jurisdictions used equipment producing a paper ballot or auditable paper record in 2024, according to the Election Assistance Commission, giving officials a basis for recounts and risk-limiting audits. Penn State analysis [11]
Election officials should therefore treat patch deployment, chain-of-custody controls and independent audits as complementary safeguards, not substitutes for one another. Jurisdictions using affected Dominion equipment should verify the certified software version with the vendor and election authorities, protect election-management networks and machine access, and favor voter-verifiable paper records that are manually auditable. Voters and journalists should also verify sensational AI-generated claims against election officials and established news organizations before amplifying them.
References
- Cybersecurity Toolkit and Resources to Protect Elections | CISA
- Cyber agency: Voting software vulnerable in some states
- Could hackers use AI to influence US elections?
- An Algorithmic Failure Beneath the Secret Ballot – CITP Blog
- Next Steps for Mercer County Following Voting-Machine Failure
