
DEF CON 33 - Voting Village - A NY Legal Challenge to ExpressVote XL's Barcode Use - Susan Lerner
Source: YouTube · DEFCONConference · published Nov 4, 2025 · 20:57
Revised Summary
A legal challenge targets New York's 2023 certification of Express Vote XL voting machines, which use barcode systems preventing proper auditing and independent verification by voters. The case centers on violation of New York law requiring voters to privately verify their selections before ballots are cast.
Key Issues:
- The barcode-based system fundamentally undermines election security, as votes are tallied based on unreadable barcodes while human-readable text isn't used for tabulation
- ESNS, the vendor, openly prioritized profit over security, specifically targeting New York and Pennsylvania as central to their business plan
- Despite debate and public outcry, the machines were certified in July 2023 by a 3-1 vote
- ESNS staff argued they would "not audit the barcode" if problems arose
Lawsuit Status:
- A lawsuit was filed within the four-month window to challenge the certification
- ESNS intervened as a defendant, arguing plaintiffs lacked standing while hiding machine sales to Monroe and Erie counties
- The trial judge dismissed the case on standing grounds, acknowledging legal merit but citing procedural issues
- The case is now on appeal with a decision pending
Vendor Tactics:
- ESNS blocked legislation requiring voter-controlled ballots that passed the state senate twice
- The company's lobbying successfully prevented the bill from passing in the assembly
The case highlights concerning prioritization of vendor profits over election security and voter rights, with New York voters' confidence in elections hanging in the balance pending the appeal's outcome.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
So if you accept the premise that we heard about yesterday that the gold that said it is auditable, you got real problems with this machine, right? Because it is completely dependent on the software and as Martha points out, what the hell are you going to audit? So, in 2019, um, ESNS began its campaign to get the Express Vote XL certified in New York State and, um, they, uh, were asked a question. The salesperson was asked a question by the New York City Board of Elections. Do you have enough of these machines for us if we decided to go ahead and buy them? And the salesperson said with great pride, absolutely no problem. It is central to our business plan that we be able to sell this machine in New York and Pennsylvania. So what you have is in our election administration and the security a…