A NY Legal Challenge to ExpressVote XL's Barcode Use

A NY Legal Challenge to ExpressVote XL's Barcode Use

Speakers: Susan Lerner

Conference: Voting Village

YouTube: https://www.youtube.com/watch?v=edxqLUizSWE

Overview

This talk, presented by Susan Lerner at the Voting Village, delves into a significant legal challenge mounted in New York State against the certification of the ExpressVote XL voting machine manufactured by Election Systems & Software (ES&S). The core of the controversy centers on the machine's use of a barcode for vote tabulation, rather than the human-readable text on the ballot. This practice, Lerner argues, fundamentally undermines the ability of voters to privately and independently verify their selections, a right explicitly protected under New York election law and consistent with the federal Help America Vote Act (HAVA).

Susan Lerner, representing organizations concerned with election integrity and voter confidence, details the arduous process of opposing the machine's certification, the subsequent lawsuit, and the ongoing appellate battle. The presentation highlights a critical tension between the profit motives of voting machine vendors and the imperative for secure, accurate, and transparent elections. It exposes the complexities of election administration, the influence of corporate lobbying on legislative processes, and the practical challenges of litigating against well-resourced industry giants.

The implications of this legal challenge extend far beyond New York, addressing fundamental questions about the design of modern voting systems, the definition of an auditable paper trail, and the crucial importance of voter trust in a highly polarized political landscape. Lerner’s account serves as a stark reminder of the continuous vigilance required to safeguard democratic processes against technological vulnerabilities and commercial pressures that can compromise the integrity of the vote.

Background

▶ Watch: Express Vote XL's software dependency and profit-driven sales (0:00)

The journey to challenge the ExpressVote XL in New York began in 2019 when ES&S initiated its campaign to certify the machine within the state. New York State maintains a rigorous certification process, which includes external testing. Despite this, the ExpressVote XL’s certification in July 2023 was met with significant public outcry from organizations like the one Susan Lerner represents. The primary objection stemmed from a specific provision in New York election law, mirroring language in HAVA, which mandates that a voting machine or system must "provide the voter an opportunity to privately and independently verify votes selected and the ability to privately and independently change such votes or correct any error before the ballot is cast and counted."

The crux of the argument against the ExpressVote XL lies in its operational mechanism: it relies exclusively on a barcode printed on the ballot for vote tabulation. While a human-readable summary of selections is also printed, the machine itself does not read this text for counting purposes. This creates an insurmountable barrier to independent verification. As Lerner emphasizes, if the barcode is the official tally, then "what the hell are you going to audit?" The voter cannot visually inspect the barcode to confirm it accurately reflects their intent, nor can an auditor easily compare the barcode to the human-readable text without specialized equipment or trust in the machine's internal logic.

During the debate at the Board of Elections, staff members took positions that further illuminated the problem. They argued that in an audit, they would only rely on the human-readable text, effectively admitting the barcode's unsuitability for verification while simultaneously failing to explain its necessity. Furthermore, recognizing the machine's slower throughput compared to traditional scanners, they adjusted the acceptable number of voters per unit, inadvertently requiring the purchase of more units per precinct. This made the ExpressVote XL, already the most expensive machine on the market in New York, even more costly for localities. Despite these concerns, the machine was certified on a 3-1 vote, an unusual outcome given the typical unanimity in such decisions. This certification prompted Lerner's organization to file a lawsuit within the four-month window allowed for challenging administrative actions, seeking to declare the certification invalid and have it rescinded. This legal action was further bolstered by real-world events, such as the "Northampton problem," where a mismatch between voter intent and machine output highlighted the very risks the lawsuit aimed to address.

Key Findings

▶ Watch: NY certifies Express Vote XL; lawsuit filed (3:00)

The legal challenge against the ExpressVote XL has brought forth several critical findings, illuminating not only the technical vulnerabilities of certain voting systems but also the systemic pressures within election administration.

Firstly, the most significant finding is the inherent conflict between the ExpressVote XL's barcode-based tabulation and fundamental principles of voter verification and auditability. The machine's exclusive reliance on a barcode for casting and tabulating votes renders the human-readable text a mere summary, not the official record. This directly violates New York election law and the spirit of HAVA, which aim to ensure voters can independently confirm their selections before their ballot is counted. The inability to audit the actual tabulated data (the barcode) against voter intent creates a profound trust deficit and compromises election integrity.

Secondly, the litigation exposed deceptive practices by ES&S regarding the sale of these machines. Initially, ES&S and the state argued that the plaintiffs lacked "standing" because no actual sales had occurred, making the challenge "premature." However, court records later revealed that ES&S had, in fact, entered into contracts with Monroe County (Rochester) and Erie County (Buffalo) during that very period. Monroe County, recognizing the legal risk, even demanded an indemnification clause, allowing them to recoup funds or receive new machines if the certification was rescinded. This demonstrates a deliberate attempt by the vendor to mislead the court and obstruct the legal process, highlighting the lengths to which commercial entities will go to protect their market interests.

Thirdly, the talk revealed the pervasive influence of vendor lobbying on the legislative process. Lerner disclosed that a bill drafted to mandate voter-controlled ballots—either hand-marked or produced by a ballot marking device (BMD) that remains under voter control—passed the New York State Senate twice but was consistently blocked at the Assembly level. This obstruction was directly attributed to ES&S's lobbying efforts, including hiring politically connected lobbyists and leveraging prominent organizations to advocate for their technology. This illustrates how vendor interests can override legislative efforts to enhance election security and voter confidence.

Fourthly, the discussion underscored the significant operational and logistical challenges posed by hybrid machines like the ExpressVote XL. These all-in-one units are expensive to purchase, store, and transport. Critically, their integrated design creates single points of failure: if any component, such as the printer or scanner, malfunctions, the entire voting process halts. This contrasts sharply with modular systems, where independent components allow for quicker replacement and greater resilience. Furthermore, the ExpressVote XL's substantial power demands are a concern in polling places with limited electrical infrastructure, particularly in older buildings common in urban areas.

Finally, Lerner highlighted a strategic business decision by ES&S to avoid upgrading its older Ballot Marking Devices (BMDs), such as the Automark, in New York. While the concept of the Automark (marking a ballot that the voter directly sees) is praised by experts like computer scientist Doug Jones, ES&S has not certified a more modern version in New York City. This, Lerner suggests, is a deliberate tactic to force Boards of Elections into purchasing the more expensive hybrid machines, thereby maximizing vendor profit through both initial sales and subsequent, costly maintenance contracts. This "razor blade paradigm on steroids" leaves local election boards dependent on vendors for technical support, further entrenching their market dominance.

Technical Deep Dive

▶ Watch: Northampton problem, standing challenge, ESNS sales deception (3:50)

The technical core of the ExpressVote XL controversy revolves around its barcode-based tabulation system, a design choice that fundamentally clashes with established principles of secure and verifiable elections. Unlike traditional hand-marked paper ballots or even older Ballot Marking Devices (BMDs) that produce a voter-verified paper record where the human-readable text is the authoritative count, the ExpressVote XL operates differently.

The ExpressVote XL is characterized as a "universal hybrid" voting machine. This means it combines multiple functionalities—ballot marking, printing, and scanning/tabulation—into a single, integrated unit. When a voter uses the machine, they make their selections on a touchscreen. The machine then prints a ballot that includes both a human-readable summary of the voter's choices and a 2D barcode (often a QR code or similar symbology) that encodes the same selections. The critical technical detail is that for the purpose of casting and tabulating the vote, the machine only reads the barcode. The human-readable text, while present, is not processed or counted by the machine; it serves merely as a visual representation, which a voter cannot independently verify against the barcode.

This design introduces a critical vulnerability: the opacity of the barcode. A voter cannot visually inspect a barcode to confirm that it accurately represents their selections. They are forced to trust that the machine correctly translated their touchscreen input into the barcode, and that the barcode correctly reflects the human-readable text. This breaks the chain of independent verification, which is a cornerstone of modern election security. The New York election law provision, consistent with HAVA, requiring voters to "privately and independently verify votes selected" is directly violated because the verifiable component (the human-readable text) is not the counted component (the barcode).

From an auditing perspective, this presents a significant challenge. Traditional audits, such as risk-limiting audits (RLAs), rely on comparing human-readable paper ballots to machine tallies. If the machine's tally is derived solely from the barcode, then an audit comparing the human-readable text to the machine's count is effectively meaningless. Auditors would be forced to either trust the barcode, or attempt to decode it with specialized equipment, which is not a standard or easily verifiable process for the public. As Lerner pointed out, the Board of Elections staff's assertion that they would audit the text, not the barcode, highlights the logical inconsistency of the system.

The "hybrid" nature of the ExpressVote XL also has significant operational implications. By integrating all functions into one large unit, it creates a single point of failure. If the internal printer malfunctions, or the scanner becomes problematic, the entire machine becomes inoperable. This contrasts with a modular system, where separate components (e.g., a standalone ballot marking device, a separate printer for ballot-on-demand, and an independent scanner for tabulation) offer greater resilience. In a modular setup, a failing printer can be swapped out without affecting other voting processes. In the ExpressVote XL, "everything stops," leading to potential voter disenfranchisement and significant delays.

Furthermore, the talk briefly touched upon the Automark, an older generation of Ballot Marking Device (BMD) also produced by ES&S and used in New York City. While ES&S has not certified an upgraded version of the Automark in NY, the concept of such a device—where the machine marks the same ballot the voter sees—is highly regarded by election security experts like Doug Jones. This highlights a technical path forward that adheres to voter verification principles, contrasting with the problematic barcode approach of the ExpressVote XL. The business decision by ES&S to withhold modern BMDs in favor of pushing the more expensive and problematic hybrid system points to a vendor strategy that prioritizes profit over optimal election security design.

Demo / Proof of Concept

▶ Watch: Lawsuit's broader HAVA implications and vendor resistance (6:50)

While Susan Lerner's talk primarily focused on the legal and administrative challenges surrounding the ExpressVote XL, it did not include a live demonstration or a technical proof of concept in the traditional sense of a security conference. The presentation itself was a detailed account of litigation and advocacy efforts.

However, the talk referenced a critical real-world instance that served as a "proof of concept" for the dangers of barcode-based tabulation: the Northampton problem. This incident, which occurred in Northampton County, Pennsylvania, involved a known mismatch between voter intent and the tabulated results from ExpressVote XL machines. Although not a controlled lab demo, the Northampton problem provided tangible, real-life evidence of the machine's failure to accurately reflect voter selections, thereby validating the concerns raised in the New York lawsuit about the reliability and auditability of the ExpressVote XL's barcode system. This real-world example underscored the potential for widespread discrepancies when the official vote record is not directly verifiable by the voter or easily auditable.

Defensive Implications

▶ Watch: NY legislature bill blocked by ESNS lobbying (7:50)

The detailed account of the legal challenge against the ExpressVote XL offers crucial defensive implications for various stakeholders in the election ecosystem. Understanding these points is vital for safeguarding election integrity and voter confidence.

For Election Officials and Boards of Elections:

• Scrutinize Vendor Claims Rigorously: Election officials must adopt a highly skeptical approach to vendor marketing and technical claims. The case of ES&S misleading the court about sales underscores the need for independent verification of all information provided by vendors, especially regarding compliance with state laws and auditability features. Boards should demand clear, unambiguous evidence that voting systems allow for independent voter verification of the counted ballot.
• Prioritize Voter-Verifiable Paper Records: The fundamental takeaway is that the official, auditable record must be the human-readable text, not an opaque barcode. Election officials should prioritize systems where the voter can directly inspect and verify their selections on the actual ballot that will be tabulated. Any system that relies on a machine-readable code for tabulation, while providing a human-readable summary, introduces an unacceptable trust gap.
• Assess Operational Resilience: The "hybrid" design of machines like the ExpressVote XL presents significant operational risks due to single points of failure. Officials should critically evaluate the system architecture: are components modular and easily replaceable, or is the entire system vulnerable if one part fails? Modular systems with independent scanners, printers, and Ballot Marking Devices (BMDs) offer greater redundancy and easier maintenance, leading to more resilient election day operations.
• Evaluate Total Cost of Ownership: Beyond the initial purchase price, election officials must consider the long-term costs associated with voting machines. This includes maintenance contracts (which can be exorbitant, creating vendor dependency), storage requirements, transportation logistics, and power demands. The ExpressVote XL's high expense, storage/transport costs, and increased power needs highlight the need for a comprehensive financial and logistical assessment.
• Resist Vendor Capture: The influence of lobbying on legislative processes and Board of Elections decisions is a serious concern. Officials must maintain independence from vendor influence, prioritizing public interest and election security over commercial pressures. This may involve seeking out diverse vendor options, supporting legislation that promotes open standards, and strengthening ethical guidelines for interactions with industry.

For Voters and Election Integrity Advocates:

• Engage in Certification Processes: Voters and advocates should actively monitor and participate in their state's voting machine certification processes. Public outcry, as demonstrated in New York, can force transparency and debate. Understanding the technical specifications of proposed machines and comparing them against state election laws is crucial.
• Demand Transparency and Auditability: Advocates must continue to push for voting systems that provide clear, auditable paper trails where the voter-verified text is the official record. Supporting legislation that mandates such requirements, like the bill proposed in New York, is essential.
• Understand Legal Avenues: The New York lawsuit illustrates the power of legal challenges to hold administrative bodies and vendors accountable. Understanding concepts like "standing" and the procedural aspects of litigation can empower advocates to effectively challenge problematic certifications.
• Promote Education: Educating the public about how voting machines work, the difference between human-readable and machine-readable records, and the importance of verification is vital for building and maintaining voter confidence.
• Support Modular, Resilient Systems: Advocates should champion voting technologies that are modular, transparent, and resilient. This includes supporting the development and certification of modern Ballot Marking Devices (BMDs) that produce truly voter-verified paper ballots, and advocating for a diversified vendor landscape.

Ultimately, the ExpressVote XL case serves as a powerful reminder that election security is not merely a technical problem but a complex interplay of technology, law, politics, and human trust. Defenders must remain vigilant on all these fronts to ensure the integrity of democratic elections.

Key Takeaways

• The ExpressVote XL's barcode-based tabulation system fundamentally undermines voter verification and auditability, violating New York election law and the principles of the Help America Vote Act (HAVA).
• Vendor influence, particularly from ES&S, significantly impacts both election administration decisions (e.g., Board of Elections certifications) and legislative processes through extensive lobbying efforts, often at the expense of election security enhancements.
• The ongoing legal challenge highlights the complexities of litigation against powerful vendors, including issues of "standing" and the challenges of obtaining full disclosure of information.
• Hybrid voting machines like the ExpressVote XL pose significant operational risks due to their integrated "all-in-one" design, creating single points of failure, high costs (purchase, storage, transport, maintenance), and increased logistical demands (e.g., power consumption).
• Election integrity requires systems where the voter directly controls and verifies the ballot that is actually counted, meaning the human-readable text must be the authoritative record, not an opaque barcode.
• The strategic decision by ES&S to not certify upgraded Ballot Marking Devices (BMDs) in New York appears to be a business choice aimed at pushing the more expensive hybrid machines, further entrenching vendor dependence for maintenance and support.

About the Speaker(s)

Susan Lerner is a dedicated legal advocate and activist deeply involved in the crucial domain of election integrity. Her work focuses on challenging problematic voting machine certifications and promoting robust, transparent, and voter-centric election processes. As demonstrated in her talk, she represents organizations actively engaged in litigation and legislative advocacy in New York State, including serving as a co-plaintiff with "the black institute." Lerner's efforts are geared towards ensuring that voting technology upholds principles of voter confidence, reliability, and auditability, advocating for systems where voters can independently verify their ballots and where election administration is free from undue vendor influence.