The Ballot Tracking Debate Is Really an Engineering Problem

Last week the Supreme Court put mail-in ballot tracking back in the news. In a 6–3 decision, the Court lifted an injunction blocking parts of the administration's executive order on mail-in voting across 23 states and Washington, D.C. I'm not weighing in on the politics of that ruling, and this article isn't about them. It's about one engineering detail in the middle of the debate: unique USPS Intelligent Mail barcodes on ballot envelopes.

A barcode is a sensible first step. It's also the smallest possible version of the idea. My friends Stacy Griggs, Chris Porter and I spent four years on exactly this problem, and I'm one of the co-inventors with them on the four issued patents that came out of it — US11216773B1, US11416807B1, US11775920B1, and US11790310B1. He wrote it up well in his recent article: a barcode identifies an object, but it doesn't prove what happened to it. The engineering question underneath: how do you build a chain of custody for a physical ballot that is secure, confidential, and independently auditable without ever revealing how anyone voted?

Here's how the architecture works.

The problem: tracking a thing, not a person

Start with the design constraint that makes everything else hard: the secret ballot. Package tracking ties every scan to a person — the buyer, the sender, the recipient. A ballot tracking system can't, because the moment a record connects a ballot to a voter's choices, the system becomes a surveillance tool, not a trust tool.

So the architecture separates two identities most systems never bother to separate: the voter, a person with an address and a registration record, and the ballot, a physical object with a unique identifier assigned when the election authority creates it. The identifier travels with the ballot. The voter's identity never attaches to it.

The system tracks the ballot, never the vote. It can tell a voter "your ballot was counted." It can never tell anyone "this is how you voted." That separation isn't a policy choice bolted on afterwards. It's the load-bearing wall of the whole design.

How the identifier binds to the physical ballot

The first engineering problem is the binding: how does a digital record attach to a physical piece of paper?

The approach is a unique parcel identifier, a UPI, derived from the ballot itself — generated from the envelope's features: the Intelligent Mail barcode, the address block, postage marks, optical data from the surface. The key detail: the identifier is derived from the artifact, not assigned and stuck on. The digital record is anchored to the physical object's actual characteristics. A substitute, a photocopy, a look-alike produces a different identifier, and the mismatch is visible.

The patents describe the same techniques for ordinary mail: generate the identifier from scans of the item, store the record on a permissioned ledger, and let the identifier be the lookup key for its history. For a ballot, the pattern is identical. The barcode is the seed. The envelope's features are the anchor. The record is the history.

What the permissioned ledger actually adds

This is where the "blockchain" word gets used carefully, because it's usually where the overclaiming starts. Nobody should claim a ledger makes a system unhackable. What a distributed, permissioned ledger does is narrower and more useful: it makes the history hard to rewrite silently.

A conventional database stores events as rows one organization controls. If USPS records a ballot arriving at 10:42 a.m. on October 22, that row lives in USPS's database, and anyone with write access can change it, with no independent record of the change. A permissioned ledger spreads the history across multiple authorized participants — the election authority, the postal service, independent auditors — so an event isn't a row owned by one party; it's part of a shared record participants can see but not silently alter.

That's the property that matters for elections: not magical invulnerability, but tamper-evidence. Rewriting what happened to a batch of ballots means rewriting every participant's copy, and the attempt leaves traces. The ledger doesn't replace audits; it makes them possible at a granularity that doesn't exist today.

The postal fingerprint

One of the patents adds a concept worth more attention: a postal fingerprint for tamper detection. Capture a baseline signature of the envelope at a known-good point: surface features, seal, physical state. At validation, measure again. If the signatures diverge beyond tolerance — seal opened and resealed, envelope steamed and reglued, ballot swapped — it's flagged for human review.

This is the same logic as a checksum on a file or a seal on a container. It doesn't stop a determined adversary; it makes tampering detectable, and detectability is the entire game. You don't need a ballot that's impossible to tamper with. You need tampering visible enough that it's never worth attempting, because the attempt becomes evidence.

How auditors verify without seeing the vote

The last engineering problem sounds impossible until you see the trick: how do independent auditors verify the chain without any party seeing how anyone voted?

The ballot and the vote separate exactly where they should. The chain-of-custody record follows the physical ballot through creation, mailing, delivery, return, receipt, validation, and acceptance, where the identifying information is separated from the ballot before it enters tabulation. The ledger records what happened up to the separation; the counting itself is outside the tracking system.

So an auditor can verify every handoff — created by the authority, accepted by USPS, delivered, returned, validated, counted — each backed by an event on the shared record. What the auditor cannot see, from any angle, is which way the ballot was marked. The information simply isn't in the system. You can't leak data you never possessed.

Why this is good for America

We already accept this standard for a product we order online — I can watch a box travel from the seller's warehouse to my porch, scan by scan. Yet when a citizen mails their vote, end-to-end visibility is a fraction of what commerce gets.

That's not a partisan observation. It's an engineering gap, and we have the technology to close it. Every ballot should reach the authority. Every valid ballot should be counted. Every voter should be able to verify, confidentially, that their ballot made it through. No system should ever reveal how anyone voted. None of those goals is owned by a party. They're the requirements of a trustworthy process, written as an engineering spec.

Stacy's article ends with the right challenge, and it's the only honest position: don't tell us it works. Prove it. Pilot it in a small number of states, subject it to independent cybersecurity and privacy review, let outside researchers try to break it, test it alongside the existing process. Let the results decide.

The barcode is a beginning. The architecture around it — an identifier bound to the physical ballot, a ledger that makes history tamper-evident, a fingerprint that makes tampering visible, a separation of ballot from voter that preserves the secret ballot — is the larger opportunity. It's engineering, it's testable, and it's good for America. Track the ballot, never the vote.

Think this argument fits your event? Tell me about the room — the calendar is selective.