DEF CON 33 - Voting Village - A NY Legal Challenge to ExpressVote XL's Barcode Use - Susan Lerner

DEF CON 33 - Voting Village - A NY Legal Challenge to ExpressVote XL's Barcode Use - Susan Lerner

Source: YouTube · DEFCONConference · published Nov 4, 2025 · 20:57

Cybersecurity
No ratings yet Log in to rate
Transcript Available
Description

Revised Summary

A legal challenge targets New York's 2023 certification of Express Vote XL voting machines, which use barcode systems preventing proper auditing and independent verification by voters. The case centers on violation of New York law requiring voters to privately verify their selections before ballots are cast.

Key Issues:

  • The barcode-based system fundamentally undermines election security, as votes are tallied based on unreadable barcodes while human-readable text isn't used for tabulation
  • ESNS, the vendor, openly prioritized profit over security, specifically targeting New York and Pennsylvania as central to their business plan
  • Despite debate and public outcry, the machines were certified in July 2023 by a 3-1 vote
  • ESNS staff argued they would "not audit the barcode" if problems arose

Lawsuit Status:

  • A lawsuit was filed within the four-month window to challenge the certification
  • ESNS intervened as a defendant, arguing plaintiffs lacked standing while hiding machine sales to Monroe and Erie counties
  • The trial judge dismissed the case on standing grounds, acknowledging legal merit but citing procedural issues
  • The case is now on appeal with a decision pending

Vendor Tactics:

  • ESNS blocked legislation requiring voter-controlled ballots that passed the state senate twice
  • The company's lobbying successfully prevented the bill from passing in the assembly

The case highlights concerning prioritization of vendor profits over election security and voter rights, with New York voters' confidence in elections hanging in the balance pending the appeal's outcome.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

So if you accept the premise that we heard about yesterday that the gold that said it is auditable, you got real problems with this machine, right? Because it is completely dependent on the software and as Martha points out, what the hell are you going to audit? So, in 2019, um, ESNS began its campaign to get the Express Vote XL certified in New York State and, um, they, uh, were asked a question. The salesperson was asked a question by the New York City Board of Elections. Do you have enough of these machines for us if we decided to go ahead and buy them? And the salesperson said with great pride, absolutely no problem. It is central to our business plan that we be able to sell this machine in New York and Pennsylvania. So what you have is in our election administration and the security a…