← All posts

You can't read the barcode that counts your vote. A federal court noticed.

Your ballot prints human-readable text — but the scanner ignores it and reads a barcode you cannot decode. A federal court put that finding in writing.

It is October 11, 2020, and a federal judge in Atlanta is reading expert testimony that most voters will never see.

Dr. J. Alex Halderman — the same researcher who took over Washington D.C.'s internet-voting pilot in 48 hours and who has spent two decades stress-testing election technology — has explained, under oath, how Georgia's ballot-marking devices actually work. You walk up to a touchscreen, make your selections, and the machine prints a piece of paper. The paper shows your choices in plain English. You carry it to a scanner. The scanner ignores the words.

It reads a QR code.

The QR code is a dense square of black-and-white pixels that encodes your vote in a format no human eye can parse without a separate decoding device. You have no practical way to verify that the barcode says what the printed text says. And the barcode — not the text — is what gets tabulated.

The U.S. District Court for the Northern District of Georgia, in its October 11, 2020 opinion in Curling v. Raffensperger, found exactly this: the system "does not provide a verifiable and auditable ballot record because it relies on the QR code for vote tabulation and that code itself cannot be read and verified by the voter."

That sentence is not from an advocacy group or a partisan brief. It is a finding of fact by a federal court, quoting expert testimony and the National Academies of Sciences, Engineering, and Medicine.

And it points to a gap that goes far deeper than Georgia, far deeper than one election, and far deeper than any single piece of hardware.

The thing being counted must be the thing you can check

Here is the principle that the Curling court's finding exposes.

A ballot is supposed to be your record — a physical artifact that captures your intent and can be independently verified by anyone who examines it. That is the entire point of paper. Paper survives power outages, software crashes, and network attacks. Paper can be counted by a human hand. Paper is what an audit checks against.

But a piece of paper with a QR code on it is not quite the same thing. The paper carries two records: a human-readable one and a machine-readable one. If those two records can diverge — and Halderman testified they can, through a cyberattack that swaps the barcode's content without changing the printed text — then the artifact that is counted is not the artifact the voter verified.

The counted thing must be the checkable thing. If they can split apart, you don't have a paper record. You have a paper alibi.

The court was unambiguous on the underlying risk. It noted expert testimony on "the practical feasibility, through a cyber attack, of swapping or deleting votes and compromising the system, including through access to and alteration of the QR barcode used to tabulate votes." It also quoted the National Academies' 2018 finding that "no technical mechanism currently exists to ensure that a vote-counting application produces accurate results" and that "testing alone cannot ensure that systems have not been compromised."

That is not a fringe position. It is the considered judgment of the country's premier scientific institution, endorsed by a federal court.

What the court did — and didn't do

Here is where the story gets uncomfortable.

After making those findings, the court declined to order any relief. With the November 2020 election weeks away, Judge Totenberg concluded that throwing out Georgia's entire ballot-marking-device system and switching to hand-marked paper ballots was not a practical remedy on an emergency timeline. The risk of chaos was too high. She weighed the constitutional defect against the disruption of the cure and chose to let the election proceed.

That is a reasonable judicial judgment. It is also an illustration of how systems entrench themselves: once a state has deployed tens of thousands of ballot-marking devices, replaced its poll workers' training around them, and printed its ballots to be read by them, the window for reform closes right around the time the problem is being documented.

The court's findings remained on the record. The machines ran the election. The broader case was eventually dismissed in 2024 on standing grounds — not because the underlying findings were wrong, but because the plaintiffs could not establish the legal standing required to continue.

"We found the problem but couldn't fix it in time" is not a reassurance. It is a description of how unverifiable systems become permanent.

A brief history of the barcode problem

Georgia did not invent this gap. It bought it.

The Help America Vote Act of 2002 poured federal money into replacing the punch-card and lever machines that failed in 2000. The intent was reasonable: old, ambiguous technology had produced the hanging-chad crisis. New, digital technology would be cleaner and more accurate. States spent hundreds of millions of dollars upgrading.

But the upgrade path led, in many cases, toward touchscreen direct-recording electronic machines — devices that produced no paper at all — and later, when paper became a political requirement, toward ballot-marking devices that produce barcoded paper. The barcode was a design choice that made tabulation faster and more reliable for the machine. It made verification harder for the human.

The Sarasota County, Florida disaster of 2006 illustrated the no-paper version of this problem: 18,412 ballots in a race decided by 369 votes showed no recorded choice, and because the county used paperless touchscreens, there was nothing independent to recount. The GAO tested the machines and found no definitive malfunction — which means there was also no way to prove the machines had worked correctly. Paper is what settles that question. But "paper" and "verifiable paper" are not the same thing.

The German standard, and why it still matters here

In March 2009, Germany's Federal Constitutional Court in Karlsruhe ruled that electronic voting is only constitutionally legitimate when "the essential steps of the voting and of the determination of the result can be examined by the citizen reliably and without any specialist knowledge of the subject."

Without specialist knowledge. That phrase does the heavy lifting.

A QR code fails this test. Reading it requires either a decoding device or software expertise. You cannot hold a barcode up to the light and confirm it says what the printed text says. The German court's standard — which flows from the country's Basic Law and the principle of public verifiability of elections — would be uncomfortable applied to a barcoded Georgia ballot.

The German ruling led to a ban on voting computers that lack independently verifiable records. The Netherlands reached the same conclusion the same year, returning to paper ballots and manual counting after a government commission determined that any electronic method must produce "a paper vote the voter can check."

The Dutch commission's phrase is precise. Not just paper. A paper vote the voter can check. A barcoded ballot is paper. It is not necessarily paper the voter can check.

What a recount actually audits

Here is the sleight of hand that is easy to miss.

When Georgia conducted its statewide hand count of roughly five million presidential ballots after November 2020 — the largest hand recount in American history — auditors were counting barcoded ballots. The hand count confirmed the machine-tabulated result to within about a tenth of one percent.

That is a meaningful cross-check. It tells you that the scanners read the barcodes consistently. It does not tell you whether the barcodes said what the printed text said. A hand recount of barcoded ballots is an audit of the barcode's consistency, not an audit of voter intent.

To audit voter intent on a barcoded ballot, you would need to decode every barcode and compare it to the corresponding printed text. No state does this as a matter of routine.

The Windham, New Hampshire forensic audit of 2021 offers a useful comparison. There, AccuVote scanners had been misreading fold lines on absentee ballots as marked ovals — a purely mechanical error that produced hundreds of miscounted votes with no fraud and no malware. The error was only recoverable because the paper ballots existed and humans could examine them to determine actual voter intent. That is what paper is for: recovering intent when the machine got it wrong.

On a barcoded ballot, if the machine encoded the wrong choice in the barcode, the paper carries no independent record of the voter's intent that a human can recover. The paper is a receipt for the barcode, not for the vote.

The Coffee County problem, compressed

In January 2021, a computer-forensics firm was admitted into the Coffee County, Georgia elections office and left with copies of everything: the Election Management System, the ballot-marking devices, the scanner, and Georgia's statewide Dominion voting software. This was documented in depositions in Curling v. Raffensperger itself — the same case that had just found the QR code unverifiable.

The episode demonstrates something specific. Georgia's system was defended, in part, on the basis that the proprietary software was secure because it was secret. Coffee County shows what that defense is worth: one insider with an unlocked door and a forensics firm with a laptop can copy the entire system in an afternoon.

Once software is out, the assumption that its attack surface is unknown collapses. The security argument for closed, proprietary ballot-marking-device code was always thin; after Coffee County, it was gone.

This is why the question of the unreadable QR code is not just a usability complaint. It is a systems architecture question. A system whose verifiability depends on the secrecy of its code is one adversarial contact away from having neither.

What "verifiable" would actually require

The Curling court's finding implies a concrete standard: the artifact that is counted must be independently checkable by the voter, using no specialist knowledge.

There are approaches that get closer to this than barcoded ballots do.

Hand-marked paper ballots, read by optical scanners, put the voter's own marks at the center of the record. The scanner interprets the marks; a human auditor can re-examine the same marks independently and reach the same conclusion — or not. When they don't match, as in Windham, the paper wins. The voter's intent survives the machine's error.

Ballot-marking devices with human-readable-only output — printing selections as text, without an encoding barcode that diverges from the text — close the gap partially, though they still depend on the voter actually reviewing the printout before submitting it.

Cryptographically verifiable voting systems, where each cast ballot can be checked against a publicly published, anonymized record using open, auditable mathematics, go further — but as the Swiss Post case of 2019 demonstrated, even published source code and published cryptographic proofs can contain trapdoors that only adversarial outside review can find. Openness is necessary; it is not sufficient. Independent, ongoing scrutiny is what makes openness real.

The one answer that does not work is the answer Georgia gave in 2020: a paper record that the official process treats as verifiable but that the voter cannot actually decode.

The official reassurance, and what it rests on

After the 2020 election, CISA and its election-infrastructure partners issued a joint statement declaring it "the most secure in American history." The statement specifically cited paper records as the reason: they enabled recounts and audits.

But the CISA statement's own logic depends on paper records meaning something. If the paper record being audited is a barcode no voter can read, and if the audit procedure checks only that the barcodes were scanned consistently rather than that they encoded the voter's intent, then the reassurance is circular. It says: we confirmed the machines read the barcodes correctly. It does not say: we confirmed the barcodes contained what voters chose.

That is not a conspiracy theory. It is a structural gap that a federal court put in writing.

The Curling finding is not evidence that Georgia's 2020 result was wrong. It is evidence that the system is not designed to let you find out independently — and that is the problem, regardless of any particular outcome.

What is still not verifiable — and what would fix it

Here is what remains open, as a matter of documented fact:

No routine process in Georgia — or in most states that use barcoded ballot-marking devices — decodes every QR code and compares it to the printed text. The audit checks the machine's consistency, not the voter's intent.

The National Academies' finding, quoted by the Curling court, stands: no technical mechanism currently exists to guarantee that a vote-counting application produces accurate results. Testing catches many errors. It cannot guarantee the absence of all errors or all compromises.

What would make this checkable by anyone:

First, replace barcoded ballot records with human-readable-only records, or require routine decoding and comparison of barcodes against printed text as a mandatory audit step.

Second, publish precinct-level, machine-readable results the moment each precinct is final — so any observer can download, reconcile, and cross-check without waiting for an official summary.

Third, require open, independently auditable software in voting systems, so outside researchers can examine the code that generates the QR code, not just the paper it prints on.

Fourth, treat "a court found no evidence of manipulation" and "officials confirmed the result" as the beginning of the verification conversation, not the end of it.

The Curling court found the problem. The machines ran anyway. The gap is still there.

The fix is not a different official saying it's fine. The fix is a system anyone can check — including you.

See how common the unreadable-ballot-record gap is across the world | Read the two-minute version | Explore the full case map

Sources

See all postsExplore the gaps