LA County is Tabulating Votes with QR Codes. Security Experts Think It's a Bad Idea

By Tami Abdollah,
October 22, 2020


After $300-million and 11 years, the nation's largest county rolled out the first publicly-owned voting system earlier this year, promising "transparency, accessibility, usability, and security."

Los Angeles County's new voting system — dubbed "Voting Solutions for All People," or VSAP — has raised concerns from election security experts. Dozens of advocacy groups have warned California's top election official that the electronic touchscreen system used for in-person voting relies on QR codes to tabulate votes. QR codes are vulnerable to hackers and system malfunctions and cannot be easily verified by most voters, U.S. government and outside experts have found.

A coalition of 36 election-security experts and advocacy groups wrote in a letter last month to Secretary of State Alex Padilla that they were "gravely concerned that [L.A. County's recently certified system] uses QR codes for tabulation" and urged him to stop relying on QR codes to tally votes at least by the 2022 primary election.

After voters make their ballot selections on their screens, the machine spits out a printed-out ballot-like receipt to review, along with a QR code. 

"Although voters can easily verify the selections that the [voting system] prints on their ballot in their own language, they cannot easily verify the QR codes that [it] will actually use to tally votes," the letter said. (full story)

- - - - - - - - - - 

The first line represents the selections a voter made, with each letter and number combination corresponding to a particular candidate or measure. For example, a vote for the Joe Biden ticket is coded as 3G8 while Donald Trump is 3G9. It is up to voters to decode and match each of alphanumeric values to the actual plain-language choices they made on their ballots.

Michael Sanchez, a spokesman for the registrar's office, said that voters can go online to find a document for decoding their ballot. Sanchez later supplied the crucial direct link via email, which is otherwise difficult to find online.

For voters who are older, disabled, simply not tech-savvy, or just unwilling to take the time, verifying your ballot selections in L.A. County is an incredibly "burdensome process," said Susan Greenhalgh, senior advisor on election security for Free Speech For People, a nonpartisan public interest group. "The person can't look at it and know what it says, they have to jump through all these hoops."

Kim Alexander, president of the nonprofit, nonpartisan California Voter Foundation noted that the difficulty with verifying the older punch-card ballot system is why post-election audits were done in the first place.

"We were using these ballots where people couldn't verify their choices," Alexander said. "Now we've come full circle. We have these QR codes that some tiny population of L.A. County has the wherewithal and ability and smarts to decode and verify (their) ballot. Even if you're able to do that, you're not done decoding the code. You have to then do another round of decoding."