Hand-Marked Paper Ballots vs. QR Codes: Implications For Election Security

INTRODUCTION

The integrity of American elections should not depend upon unreadable machine code. Election integrity depends upon a simple principle: the official vote record must be verifiable by voters and auditable by the public. Hand-marked paper ballots remain superior to QR code systems in this respect.

Hand-marked paper ballots allow voters to record their choices directly on paper and allow scanners, auditors, and recount officials to evaluate those same human-readable marks. By contrast, some ballot-marking-device (BMD) systems print a paper ballot that includes a QR code or barcode encoding the voter’s selections. BMDs create an unnecessary, election security compromising gap between voter verification and machine tabulation. These systems also bring increased administrative and maintenance costs, complicate audits, and carry security vulnerabilities.

This brief does not argue against assistive voting technology where ballot-marking devices serve an important accessibility purpose but rather addresses the problem that arises when the operative vote is captured by machine-readable encoding that the voter cannot independently review. States should close that gap by requiring the official vote record to be a human-readable paper ballot.

BACKGROUND

Hand-marked paper ballots and ballot-marking devices both rely on paper and optical scanners, but they do not create the same kind of election record. In a traditional optical-scan system, the voter fills in a bubble or otherwise marks the ballot by hand, and the scanner reads those physical marks. The mark itself is the voter’s act, and the paper ballot provides a direct record of voter intent.

Ballot-marking devices function differently. Voters instead make their selections through a touchscreen or digital interface, which then prints a paper output of the voter’s choices. Some models of BMDs print readable text that voters can review contest by contest, while others print a QR code or barcode that encodes the selections for tabulation. That distinction is critical. When the vote that is ultimately counted is contained in machine-readable encoding rather than a record the voter can actually read, the voter cannot independently verify what the system will officially record as their choice (Appel et al., 2020).

The key question is not whether a system uses paper in some abstract sense, but rather, if the official vote record is a human-readable, voter-verifiable mark that is usable in a meaningful audit or recount.

SECURITY CONCERNS: HAND-MARKED PAPER BALLOTS VS. QR CODES

Election security is not simply a matter of preserving a “paper trail.” The voting record must accurately capture the vote as expressed by the voter. Cybersecurity and election-science researchers Appel, DeMillo, and Stark make the central point well: paper ballots are only useful if they accurately record voter intent and can serve as evidence when computers fail, malfunction, or are compromised (Appel et al., 2020).

QR-code ballot systems fail in this regard. Encoding votes into machine-readable symbols denies voters the ability to independently confirm that the resulting code matches the selections they have made. Such systems force voters to rely upon software at the very moment the official record is being created. Americans can look at a hand-marked ballot and clearly see whether it reflects their choices, but the same cannot be done with a QR code. Given the heightened vulnerability of QR systems to malfunction and tampering, it is reason that Americans would harbor concerns about the integrity of these systems. Consequently, policymakers and officials should regard the deficiencies of QR systems as threats not only to election security, but also to voter confidence.

SOFTWARE INDEPENDENCE, CONTESTABILITY, AND DEFENSIBILITY

A strong voting system should be software-independent, contestable, and defensible (Appel et al., 2020). In plain terms, that means software errors should be detectable and correctable without having to trust the same software that may have failed, and there should be public evidence available to challenge or defend a reported outcome.

Hand-marked paper ballots are strongest on those measures because the ballot itself is independent evidence of the voter’s choice. Auditors and recount officials can inspect the same marks the voter made, and if there is a discrepancy, officials have a record that exists apart from the software.

QR-code systems are weaker because the operative vote may be hidden in data the voter cannot read. That makes it harder to prove whether the machine recorded the voter’s selections correctly, harder to establish public evidence when a result is disputed, and harder to defend a result in a way ordinary citizens can understand and trust. Election legitimacy should rest on public proof, not on the black-box assurances of QR-code systems that are inherently unreliable, as they violate three foundational criteria researchers have deemed necessary for an election to be secure: software independence, contestability, and defensibility (Appel et al., 2020). These researchers claim such principles ensure that election outcomes are “consistent with the expressed votes as intended by the voters” (p. 2). The pillars are as follows:

Software Independence. A voting system must ensure that any error or wrongdoing affecting an election outcome can be promptly corrected without compromising the results. To do so, errors must be traceable and easily distinguishable as either human-made or computer-generated.

• Hand-marked paper ballots satisfy this requirement because their marks are made independently of software, serving as physical proof of voter intent. This allows auditors to trace the vote count back to the original paper ballot and ensure the scanner correctly read the marked choices. QR codes cannot offer this same verifiability because the voter’s choices are represented digitally, not physically, where, if the machine generates a QR code inconsistent with what the voter chose, it becomes virtually impossible to distinguish between a system error or a voter mistake. It is imperative that there be human-readable “proof” that links each recorded vote to the overall vote count. Software independence helps ensure that even if the machine fails to correctly record votes, physical paper ballots remain as backup evidence (Appel et al., 2020).

Contestability. A voting system is contestable if an undetected error that impacts an election outcome can show public evidence that the outcome is untrustworthy.

• Hand-marked paper ballots satisfy this requirement because physical marks prove a voter is tangibly linked to a vote, serving as public evidence to legitimize the count if a dispute occurs. On the other hand, QR codes offer no clear way to prove generated codes actually belong to a real voter, or if a discrepancy was caused by machine error rather than the voter themselves. In such circumstances, the voter cannot truly contest “ownership” over their ballot because the official vote is hidden in a digital code they cannot read. As a result, officials are unable to substantiate election results because they cannot provide the independent proof required to contest election results. Contestability helps ensure that even if an election outcome is incorrect, there is public evidence to prove it (Appel et al., 2020).

Defensibility. A voting system is defensible if it can show public evidence proving that the reported winners really won.

• Hand-marked paper ballots satisfy this requirement because they create a permanent paper trail that is the gold standard for auditing. This allows election officials to back up claims about the vote count with human-readable evidence that anyone can see with their own eyes, whereas QR codes cannot be verified in the same respect. Confirming the reported vote count is only possible if it is substantiated by a human-readable record to dispel public doubt, making election results defensible (Appel et al., 2020). Defensibility ensures that when a win is legitimate, there is public evidence to prove it.

A PHYSICAL RECORD IS NECESSARY FOR MEANINGFUL AUDITS

Post-election audits can be one of the most important tools available to confirm that tabulation matches votes actually cast. But an audit is only as good as the record being audited. If the record is human-readable and tied directly to the voter’s act, auditors can compare the paper ballots to the reported outcome and confirm whether the scanners counted correctly.

That logic breaks down when the system depends on unreadable QR codes or barcodes. Auditors may be able to confirm that a scanner read the code consistently, but that is not the same as confirming that the code accurately reflected the voter’s intent in the first place. In other words, an audit can confirm that a machine counted what the machine created. It cannot, by itself, however, prove that the machine-created encoding matched what the voter selected.

That is why hand-marked paper ballots are the gold standard for auditing; they are systematically more secure because the vote originates from the voter’s hand and not machine software (Appel et al., 2020).

THE RAPID EXPANSION OF BMDs

Ballot-marking devices have expanded well beyond their original purpose as an assistive tool for voters with disabilities into a ubiquitous method of voting for all voters. But convenience and usability do not eliminate the need for voter-verifiable records.

In 2022, the Cybersecurity and Infrastructure Security Agency (CISA) identified vulnerabilities affecting Dominion’s ImageCast X and recommended mitigations, including a strict chain of custody, physical protection, rigorous pre- and post-election testing, voter verification of the human-readable printout, and rigorous post-election audits of the human-readable portions of ballots (CISA, 2022, "Mitigations" section). CISA noted that these steps are especially important to detect attacks in which a barcode is tabulated inconsistently with the human-readable portion of the paper ballot.

These devices also do not produce more accurate outcomes, as evidenced by a University of Michigan study, which found that touchscreen interfaces often reduce scrutiny, with voters missing over 93% of errors deliberately introduced on printed ballots from BMDs (Bernhard et al., 2020, pp. 1-2). Divorcing the physicality of marking a paper ballot often leads voters to gloss over their mistakes, especially if they, for instance, accidentally select another option while scrolling, or largely treat their printed ballot as a receipt and not as a permanent record that needs a final inspection to ensure their choices were recorded, as suggested by CISA.

THE NATIONAL DIRECTION SUPPORTS PAPER-BASED, AUDITABLE SYSTEMS

At a national level, the majority of voters are already accustomed to hand-marked paper ballots, with nearly 70% of U.S. voters living in jurisdictions that rely on this method (Verified Voting, n.d.). Although roughly 27% of voters use BMDs, this figure includes all models, meaning BMDs that print QR codes represent only a small segment of this voting method in practice (Verified Voting, n.d.). Even so, the few major jurisdictions using them are already seeking to eliminate them.

States like Georgia that previously mandated that every in-person voter use a touchscreen are undergoing a significant shift away from digital voting methods like QR codes. This pivot is driven by urgent concerns over election security and the high costs of maintaining these digital systems. State-level data from cities like Philadelphia has shown that touchscreen BMDs cost roughly twice as much to implement and maintain as hand-marked paper ballot systems (Bajak, 2020), amounting to an even greater cost if they need to produce human-readable text, as is now required in Georgia—a staggering $66 million (Homan, 2026). Colorado led this trend as the first state to eliminate QR code systems in 2019 for these very reasons (Colorado Secretary of State, 2019). More recently, jurisdictions in Texas are following suit in response to President Trump’s Executive Order No. 14248, issued in 2025, aiming to eliminate voting equipment that uses barcodes or QR codes. Counties including Collin, Williamson, and Bastrop are phasing out touchscreens entirely and returning to hand-marked paper ballots for in-person voting (Contreras, 2025).

POLICY RECOMMENDATIONS

To ensure every American’s unique choices are accurately reflected in their official vote record, states should require that this record be a physical ballot with human-readable text, so voters and auditors alike can see and verify exactly what the machine is tabulating. No QR code, barcode, or other machine-readable encoding should serve as the official vote record if it cannot be independently verified by the voter.

This goal would best be achieved by amending state statutes that define what counts as the official vote record. Specifically, this would require that, for in-person voting, only human-readable paper ballots can be used as the official record, prohibiting the use of barcodes, QR codes, or any other format that does not meet this standard. For voters facing accessibility issues, ballot-marking devices may still be used, but should be limited only to those who need them and must produce human-readable text on the printed ballot that is ultimately used for tabulation. The point is not to phase out BMDs entirely, but rather to mitigate the risks associated with QR codes, which depend on these devices. Moreover, states should direct counties to uphold hand-marked paper ballots with optical scanners as the primary voting method at each polling place, while allocating an appropriate number of BMDs for voters who need them.

As a practical example, in Georgia, this would mean amending O.C.G.A. § 21-2-300(a)(2), which governs how voting machines like ballot-marking devices must function. While the statute requires that the state produce paper ballots voters can read themselves it does not specify that this human-readable portion is what is tabulated by the machine, or that it serves as the official vote record. Machine-readable codes are allowed under the current law because O.C.G.A. § 21-2-2(18) provides that an “official ballot” may be paper, mechanical, or electronic. The proposed amendment would fill this gap by explicitly defining an official ballot as a human-readable paper ballot, which would serve as the official vote record, ultimately creating a stronger safeguard against the fraudulent manufacturing of votes, which QR codes fail to protect against.

CONCLUSION

Americans can read a ballot, but they cannot read a QR code. Hand-marked paper ballots with optical scanners best address security, functionality, and cost concerns. They are the simplest, most secure, and cost-effective voting system available. Their low barrier to entry allows jurisdictions across urban and rural settings to administer elections without the substantial financial and technical burdens inherent to QR code systems. The notion that modern voting systems require a digital “upgrade” to include QR codes is simply mistaken. These systems attempt to address a problem that does not exist and to complicate a process that should be simplified to facilitate audits that mitigate risks of fraud and manipulation.

QR code systems are fundamentally insecure; they fail to meet rigorous cybersecurity standards and lack a human-readable, physical format necessary for auditing. They are antithetical to how a secure voting system should operate because they cannot guarantee a voter’s expressed intent is accurately recorded. Ultimately, voters can trust their own eyes to read a ballot, but they cannot and should not trust a machine to do it for them.