Here is how it works, as designed: state election officials mail ballots to voters in bulk. Before those ballots leave the building, a postal worker scans a sample of barcodes, as few as 15, as many as 400, depending on the size of the batch, and checks them against a list of approved voters uploaded to a federal portal. If every scan matches, the batch goes out. If even one doesn’t, the rule is not to flag that ballot, or set it aside, or ask the state to double-check it.
The rule is to reject the entire batch.
A batch can hold tens of thousands of ballots. One mismatched barcode, a typo, a voter who moved last month, a scanner that misreads a smudge, and none of them go out. Not the one that failed. All of them.
There is no appeal. If the portal marks a ballot unverified by mistake, there is currently no process by which a state election official, or the voter whose ballot it was, can challenge that determination and get it corrected. The system does not have a wrong-answer button.
This is the system the U.S. Postal Service has spent the summer building, on a deadline it did not meet, to be ready for an election that is not going to wait for it. And it is already colliding with the calendar: North Carolina is scheduled to begin mailing ballots this Friday.
The strangest part of this story is not the barcode. It is what the administration is asking the Postal Service to become.
The Postal Service has always had an important role in American elections, but it is a gloriously unromantic one: carry the mail. Election officials decide who is registered, who is eligible and who receives a ballot. USPS takes the envelope from Point A to Point B. Nobody has traditionally expected the letter carrier to pause at the mailbox and conduct a citizenship audit.
Trump’s executive order would change that relationship. States would be required to provide voter information for comparison against federal citizenship records, and the Postal Service would use a new barcode-and-verification system to determine whether election mail clears that screening process. Under the system described by the whistleblower, a ballot that fails to match does not simply continue through the ordinary machinery while election officials resolve the discrepancy. It can stop the mailing process itself.
That is an extraordinary change in institutional function. USPS would no longer merely be the carrier. It would become a gatekeeper.
Harry Litman put the transformation rather neatly: the Postal Service would suddenly be in the business of giving a “thumbs up, thumbs down” to who gets election mail. Even if the administration never succeeds in putting the full system into operation, he argues, building that machinery this close to an election creates its own category of uncertainty: Who was supposed to receive a ballot? Who didn’t? Which list controlled? Which mismatch mattered?
There is an almost comic mismatch between the institution and the assignment. The United States Postal Service is very good at moving envelopes around the country. That does not make it the nation’s newly deputized Department of Voter Eligibility any more than FedEx should be checking your tax return before delivering it to the IRS.
Yet that is roughly the direction of travel here: election administration, traditionally conducted by states and localities, is being layered with a new federal screening mechanism administered through an agency whose historic job is delivery, not adjudication.
And this would be happening because Donald Trump, who has spent years insisting that mail voting is corrupt while repeatedly using it himself, decided by executive order that the federal government needed a larger role deciding which mail ballots move through the system. The irony is almost too tidy. Having spent years telling Americans not to trust mail voting, his administration is now trying to insert an entirely new federal checkpoint into the mail-voting process and asking everyone to trust that instead.
That might be easier to contemplate if the new system had been built with extraordinary care.
According to the whistleblower, it was not.
We know all of this because someone inside the Postal Service decided the public needed to know it first.
The disclosure came from an anonymous federal official, filed with the assistance of Whistleblower Aid, a nonprofit that represents people trying to expose government wrongdoing, and made public Tuesday by Senator Richard Blumenthal of Connecticut. The organization described the official only as someone with “direct knowledge of potentially catastrophic problems” in the portal’s development, and said the person feared reprisal from administration officials if identified. Given how routinely this administration has treated internal dissent, the fired inspectors general, the purged generals, the officials removed from promotion lists for reasons no one will explain, that fear does not require much imagination to take seriously.
What the whistleblower describes is not simply a rushed system. It is a system built by people who, by the account given to Congress, were often not talking to each other.
The disclosure describes siloed work streams, separate teams assigned to separate pieces of the portal, with little or no coordination between them, even when they were working on the same underlying task. There were, according to the whistleblower, no clear written requirements for the portal’s information technology or infrastructure, no fixed blueprint anyone was building toward, just teams improvising against a moving deadline and orders from above that shifted the target as they went. “When elements were brought together,” the disclosure says, “the teams were unaware of various developments” which meant discovering, late and by accident, that pieces built in isolation didn’t fit together, and redoing work that should never have needed to be done twice.
Layer the zero-percent failure rule on top of that description, and the picture changes. This is an unforgiving system that appears never to have been properly integrated and tested as a whole.
Before going any further, one distinction matters enormously: a database mismatch is not evidence that somebody is trying to vote illegally.
Voter rolls are living records. People move, marry, and change names. They register shortly before an election and may correct addresses. A state database may be updated on Tuesday while the federal database against which it is being compared still reflects Monday. The Washington Post reported that ordinary changes to voter records could leave the federal information stale enough to produce exactly these kinds of mismatches.
The proposed system treats disagreement between those databases as though it were a condition requiring the mail to stop.
A mismatch says two records do not agree. It does not tell you why they disagree, and it certainly does not prove that the voter on the envelope is an imposter, a noncitizen or part of the vast ballot conspiracy Donald Trump has been promising to discover for most of the last decade.
Under the zero-percent-failure design described by the whistleblower, however, the distinction can become almost academic. One questionable record can stop an entire batch containing thousands of perfectly ordinary voters while election officials figure out what went wrong. According to the whistleblower material Harry Litman reviewed, there was not even a clearly established process by which a voter or state election official could challenge a ballot the portal had wrongly marked unverified.
A system supposedly devoted to accuracy generally assumes that errors will happen and build mechanisms for containing and correcting them. This one appears to assume perfection at the front end and respond to imperfection by expanding its consequences.
The legal history makes this considerably worse, although I promise not to make you earn a minor in civil procedure before breakfast.
Trump’s executive order immediately produced litigation. In an earlier case, the Supreme Court declined to block portions of the administration’s election plans because the challenged Postal Service rule had not yet gone into effect. The injury, in the Court’s view, was premature. Once USPS actually published the rule, however, Judge Indira Talwani blocked major portions of it, concluding that the agency had exceeded its authority and risked creating election chaos.
Then came the whistleblower.
According to the disclosure, work on the ballot portal continued during periods when court orders restricted what USPS could do. Litman believes the allegations may raise the question of contempt because the administration appears to have interpreted the orders as allowing it to keep building internally so long as the machinery was not yet fully switched on. He also points to the institutional problem underneath all of this: courts operate on litigation time. Elections do not.
A judge can issue an injunction. The government can appeal it. Lawyers can file emergency motions. Another court can clarify what the first court meant. Someone can ask for reconsideration. Everyone can spend several exhilarating weeks arguing about standing while billable hours achieve escape velocity.
North Carolina still has to mail ballots Friday.
That is the asymmetry running beneath the entire story. The administration can issue an order, direct an agency to build something and force state officials to prepare for the possibility that the rules will change. The judiciary can eventually determine whether any of that was lawful.
The point Litman makes that I think is easiest to miss if we treat the controversy as just another lawsuit against the Trump administration. Most governmental mistakes can, at least theoretically, be repaired later, but elections are different.
“Things happen and you cannot repair the process,” Litman said, drawing on his own election-law experience. By the time lawyers establish exactly what went wrong, the election may already have occurred.
That is why the whistleblower’s account is so much more serious than an ordinary story about shoddy government software.
Suppose a batch of ballots is delayed because one voter record does not match. Suppose officials discover the problem two days later, and they spend another day identifying the discrepancy and clearing the batch. Perhaps everything eventually works.
Now suppose the same thing happens on October 31.
The legal correctness of the government’s conduct begins to matter considerably less to the voter standing on November 4 holding a ballot that should have arrived the previous week.
A federal judge can rule in December that the government acted unlawfully in October. She cannot send a ballot backward through time.
That makes elections uniquely vulnerable to the kind of rushed improvisation described by the whistleblower. The most dangerous characteristic of the portal may be that, as Election Day approaches, the consequences of failure become increasingly irreversible.
Litman described the prospect as reaching a point where nobody can put Humpty Dumpty back together again.
Put more succinctly, you cannot win back Election Day.
Up to this point, we do not need to establish a secret partisan instruction hidden somewhere in the source code that causes Democratic ballots to fail while Republican ballots sail merrily through.
Donald Trump has spent years telling Americans that mail voting is corrupt, fraudulent, and inherently suspicious. He has made clear repeatedly that election results become considerably less trustworthy in his telling when Republicans lose them. Now his administration is trying to insert an untested federal verification layer into a voting system used by roughly a third of the electorate, immediately before an election in which control of Congress is at stake.
Veteran Washington correspondent Simon Marks offered the useful distinction: “This is not an attempt to rig the vote. It is an attempt to prepare the ground [for] claims that the vote was rigged.”
Imagine November arriving after weeks of portal problems. Election officials in several states report delayed batches. Some voters say ballots never appeared. One state used the system one way, another interpreted the latest court order differently, and lawyers are still fighting over which rules were operative on which date. Several House races are separated by a few thousand votes.
Trump does not need to know in advance which side benefited from every missing envelope. He needs only enough visible disorder: rejected batches, conflicting numbers, affidavits, emergency motions, and voters appearing on television to say their ballots never arrived.
Then comes the declaration: Nobody knows what happened. The mail ballots are a disaster. How can these results possibly be certified?
Litman sees a familiar political logic in that possibility. He compared it to January 6: shake the system hard enough, create enough uncertainty, and trust political allies to fight over whatever lands afterward.
The whistleblower’s disclosure does not establish partisan intent, but it reveals the asymmetry that makes chaos potentially valuable. A system does not have to reliably change the winner to undermine an election.
The feedback loop is particularly poisonous. Trump says mail voting cannot be trusted. His administration inserts a new federal mechanism capable of producing confusion into mail voting. If confusion follows, Trump can point to it as proof that mail voting could not be trusted.
Manufacture instability, then present the instability as evidence that intervention was necessary.
At that point, the argument is no longer really about whether one barcode matched, but whether enough Americans can still agree on what happened when the votes were counted.
The Postal Service, asked directly about the whistleblower’s account, offered a statement pledging that the portal would provide “a simple, secure, and efficient way” for states to submit voter lists. Nothing was said about the zero-percent failure rule, the missing appeals process, or about the siloed teams or the absent written requirements. Asked about an allegation that a single scanning error could strand tens of thousands of ballots, the Postal Service answered a question nobody had asked.
The White House’s response was similarly beside the point. A spokeswoman described the software effort as “neither complex nor unique,” noting that USPS already handles bulk mail and barcodes for large commercial customers. That may be true, and it is also not a rebuttal. Sorting bulk mail for a catalog retailer carries no equivalent to disenfranchising a voter if the algorithm gets it wrong. The complexity was never in the barcode. It was in what happens next when the barcode fails, and neither statement addressed that at all.
As of this week, the portal remained behind its own internal schedule. Officials had planned to have it operating by Tuesday, but state election officials reportedly had not yet been granted access late that day.
Senator Blumenthal and his colleagues therefore have something lawmakers rarely receive in election controversies: a warning before the election rather than an autopsy afterward. The disclosure is public. The questions are known. The ballots have not yet all been mailed. Nobody will be able to say in November that the alarm arrived too late.
Which brings us back to the calendar. Friday is coming regardless of what the Postal Service says in a press statement, regardless of what the White House calls “neither complex nor unique,” and regardless of how many injunctions Judge Talwani has to write between now and November. Somewhere in North Carolina this week, ballots are supposed to go into the mail.
The story underneath the story is that the government is experimenting with an election process whose errors become harder to repair with every day that passes.
The software can miss its deadline. The election cannot.