A significant security issue was discovered in a new online voter registration cancellation system managed by Georgia’s Secretary of State’s Office. This flaw would have permitted anyone to cancel a voter’s registration by providing just their name, birthdate, and county of residence—information easily accessible online.
The problem came to light over the weekend, thanks to cybersecurity expert Jason Parker, who alerted ProPublica and Atlanta News First. Parker, who uses they/them pronouns, had attempted to notify the Secretary of State’s Office about the vulnerability, but the office claimed no record of their outreach.
Parker criticized the oversight, calling it a “serious vulnerability” that required immediate rectification. Zach Edwards, a senior threat researcher with Silent Push, assessed the flaw and described it as “incredibly sloppy coding” and as severe as any voter cancellation bug could be. Edwards remarked that such issues should have been identified by a basic security review before the site’s launch.
Following ProPublica and Atlanta News First’s joint intervention, the Secretary of State’s Office revised the system to include an error message for incomplete submissions.
Previously, other reports by The Associated Press and The Current had uncovered separate issues with the portal, including exposure of sensitive personal information such as partial Social Security numbers and full driver’s license numbers. The Secretary of State’s Office claimed these issues were quickly addressed. Critics, however, raised concerns about potential misuse of the system, particularly since a 2021 state law had expanded the scope for challenging voter registrations.
Parker’s discovered flaw allowed users to bypass the requirement for a driver’s license number when submitting a cancellation request. Edwards emphasized the need for a comprehensive review process and suggested that Georgia’s Secretary of State should engage multiple security firms to prevent future vulnerabilities. He warned that the system could be exploited to automate mass cancellation requests.
In a demonstration video provided to ProPublica, Parker showed how they bypassed the driver’s license number requirement within a minute by manipulating the website’s HTML code. Despite this, the Secretary of State’s Office stated that incomplete applications, such as Parker’s hypothetical request without a driver’s license number, would not be processed. They did not address questions about the portal’s prior testing, security measures, or Parker’s request.
Marisa Pyle from All Voting is Local criticized the state’s approach, calling for improved security practices and transparency in the rollout of such systems. Jake Braun, a cybersecurity expert, noted the recurring issues with election-related websites and advocated for higher standards in online election infrastructure.
Edwards concluded that Georgia should legislate mandatory external reviews for public-facing government websites to ensure they meet adequate security standards.
