Loading today’s stories
Security1 distinct publisher2 min readPublished
A USPS whistleblower says one failed barcode scan bounces 10,000 ballots back to the state
The complaint Sen. Richard Blumenthal released describes three ballot mail IT systems built in weeks and promoted through test environments unfinished, with state election officials left to reconcile every discrepancy before mail moves.
The Watch · Security desk
What happened
- Sen. Richard Blumenthal released a Whistleblower Aid complaint from a federal employee alleging catastrophic problems in how USPS is handling mail-in ballots for the 2026 midterm elections.
- Three systems are named: a Federal Ballot Mail Portal holding voter names and new ballot barcodes, a verification system matching batch manifests against the portal, and a barcode sampling standard.
- As designed, one barcode failing to scan in a bulk mailing of 10,000 ballots rejects the entire batch and sends it back to the state, halting those ballots before they reach voters.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The party with no control over the code carries the outage: state offices must staff reconciliation and resubmission during the mailing window, or ballots sit.
- constraint Zero-tolerance batching forecloses the normal engineering answer to misreads, which is absorbing a small error rate and handling exceptions; reliability has to come from the scanner or from smaller batches.
- decision States must decide ahead of the midterm mailing window whether to trust the federal batch flow as specified or shrink mailing units to cap what a single bad read can stop.
- precedent With no patch to wait for, remediation runs through courts; Becker expects new lawsuits, which would make discovery the code review this software never received.
Batch rejection is an availability control. Its failure math is fixed by the batch size. If a 10,000-ballot bulk mailing is returned to the state when any single barcode fails to scan [5], the batch clears only when all 10,000 reads succeed. Solve for the per-scan reliability that buys a 90 percent chance of a clean batch: 0.9^(1/10000) = 0.99998946, a misread rate under 1.05 per 100,000 scans, roughly one in 95,000 [1]. Assume instead, for arithmetic only, a more ordinary one misread per 10,000 reads, and the same batch clears 36.8 percent of the time [2]. The whistleblower says small scan errors are likely in any barcode process, and that the placement of barcodes on federal ballots makes operating problems near certain [6]. The third system in the complaint is specified at a zero percent failure rate [4].
That risk sits inside normal operation, not an intrusion. The complaint puts the onus on state election officials in all three systems [7], and describes USPS refusing a ballot batch until the state resolves the errors and resubmits the manifest, on manifests that can cover tens of thousands of ballots [8]. The failure mode is change control: development siloed across teams, systems escalated into later test environments before they were finished, and no time to test components on their own or the whole [9]. The complaint says the rush forced USPS to skip much of the pre-release testing that would confirm the systems interoperate safely with other federal systems [13], and characterizes the work as a slapdash software development process compressed into weeks [14].
What is public is one document. The account comes from an anonymous federal employee, written up by attorneys at Whistleblower Aid and released by Blumenthal [1]. It lacks test results, code, and a schedule. The most checkable detail is the promotion sequencing [9], because unfinished builds moving between environments leaves artifacts that a build log will settle either way. The legal context is separate and already on the record: the underlying rule changes have drawn multiple court injunctions, and the whistleblower alleges work continued regardless, with the IT effort believed to have started in June 2026 [10][11].
For a state office the operational variable is batch granularity. Submit 10,000 ballots as one unit and one bad read stops all of them; the blast radius of a misread is whatever the state chose as its mailing unit [5].
What to watch
- A USPS or inspector general response confirming or disputing the June 2026 start date and the all-or-nothing batch rejection rule.
- Whether existing litigation over the enjoined rule changes is expanded to reach the three IT systems themselves.
- Whether states get the batch mechanics and resubmission procedures in writing early enough to change their mailing units.
Loading claim ledger
Loading source directory links
Loading share composer
Loading topic controls
Loading related stories