ATLANTA, Ga. — Georgia’s State Election Board executive director is asking the U.S. Department of Justice to prohibit QR-code vote counting that voters cannot directly verify, require security fixes before November, and impose a six-month deadline for transitioning to a voter-verifiable voting system.

The September 30 request from Executive Director James Mills also seeks investigations into alleged withholding or alteration of election records and the sharing of voter-registration and motor-vehicle information with outside organizations. His signed letter follows the board’s September 28 adoption of a resolution authorizing him to seek federal assistance.

The board approved that resolution 3–2, with supporters pressing for action on known vulnerabilities and opponents questioning federal involvement and the feasibility of changing software so close to the election. Georgia’s early voting begins October 13, according to Georgia Recorder reporting republished by WABE.

The ballot voters read is not the information scanners count

Georgia’s ballot-marking devices allow voters to select candidates on a touchscreen, then print a paper ballot containing human-readable selections and a QR code. The scanners count the choices encoded in the QR code rather than the printed selections.

That distinction is central to the security research of J. Alex Halderman and Drew Springall. In his published explanation of their findings, Halderman describes how malicious software could change the QR code while leaving the human-readable selections untouched. A voter checking the printed names would therefore have no way to detect that change by looking at the ballot.

Halderman also describes a second attack: changing both the printed selections and the QR code. In that scenario, voters’ review of the printed ballot becomes critical because the paper and electronic records would agree with each other while misrepresenting the voters’ intended choices.

The researchers documented potential attacks, rather than establishing that those attacks changed votes in a previous election. Their findings nevertheless identify why a paper printout alone does not resolve every security concern surrounding ballot-marking devices.

Documented vulnerabilities, available updates

The security concerns have a public record extending back several years.

In June 2022, the U.S. Election Assistance Commission acknowledged that a federal cybersecurity advisory identified nine vulnerabilities affecting Dominion’s ImageCast X component. The EAC endorsed recommended mitigations but said its review had not identified violations of the certification guidelines applicable to the system and that decertification was not being pursued.

The vulnerabilities were also demonstrated in court. The Atlanta Journal-Constitution reported in January 2024 that Halderman showed ways to access or alter a Georgia ballot-marking device using a pen, a programmed voter card, or a USB device. One demonstration changed the encoded vote while leaving the printed candidate selection intact. The report described separate methods, rather than a pen independently changing a statewide election result.

Ballot secrecy presents another concern. Researchers who discovered the DVSorder flaw explain that predictable identifiers can allow ballot images or cast-vote records to be restored to the order in which ballots were cast. Under some circumstances, that information can be combined with other records to identify individual voters’ ballots.

DVSorder does not directly change votes or election results. Its significance is the potential loss of ballot secrecy, including the risk of coercion when another person can discover how someone voted.

Preserve the evidence before updating the equipment

The board’s September 28 resolution states that a certified software update is available and that Dominion has agreed to provide the software update without charge.

It urges Secretary of State Brad Raffensperger to implement recommended updates while first preserving forensic copies of election-management server and scanner hard drives. Those copies would be provided to the board, DOJ, and the Department of Homeland Security for examination.

The resolution also authorizes public hearings and consultation with voting-system experts. It references a September 2 DHS letter concerning QR-code tabulation and potential violations of federal law.

Mills’ subsequent letter requests several specific forms of relief: a prohibition on non-verifiable electronic tabulation; a six-month transition to voter-verifiable, hand-auditable records; software remediation and independent verification before November; safeguards preventing voters from being linked to ballots; preservation and investigation of election records; and investigation of data sharing involving ERIC and the Center for Election Innovation and Research.

Mills presents the alleged records violations and data-sharing concerns as matters requiring federal investigation. The letter requests action; it does not announce a DOJ determination that Georgia’s system is unlawful.

Board members clash over urgency, cost, and federal involvement

Carolyn Roddy, who introduced the resolution, criticized continued “voting on machines that we know have known vulnerabilities.”

Janelle King supported seeking federal assistance to press the secretary of state’s office “to do their job,” according to Georgia Recorder’s account.

Sara Tindall Ghazal challenged the description of the update as a simple patch, arguing that installing an entirely new software system before the midterms was impossible. “It cannot be done,” she said.

Raffensperger spokesperson Robert Sinners pointed to previous funding requests and described the board’s action as “at least $30 million dollars short.” Georgia Recorder reported that Raffensperger requested $15 million during the 2025 legislative session for personnel costs associated with statewide updates, but lawmakers did not approve the funding. The availability of software without charge therefore does not establish that statewide implementation would carry no cost.

Board Chairman John Fervier opposed inviting federal involvement. “I have a fundamental issue with the federal government becoming involved in Georgia elections,” he said, according to Democracy Docket’s reporting on the meeting.

Georgia postponed its own QR-code deadline

The federal request arrives after Georgia extended its state deadline for ending QR-code tabulation.

Gov. Brian Kemp signed Senate Bill 3EX in June, postponing the prohibition from July 1, 2026, until January 1, 2028. The law also placed lawmakers in charge of recommending a replacement voting system, according to Capitol Beat reporting published by The Current.

That extension leaves QR-code counting in place for this November’s election. Mills’ request seeks a substantially faster transition, alongside immediate security remediation and preservation of the existing system’s records.