The Charlie Kirk Show - FULL Unedited Arizona Senate Hearing of the Maricopa County Audit

00:00:00.000 Hey everybody, the unedited Senate hearing for the audit results.

00:00:04.000 Hear it yourself.

00:00:05.000 Only thing I'll ask you to do is please consider supporting the Charlie Kirk Show podcast, charliekirk.com/slash support.

00:00:12.000 We just take the audit hearing.

00:00:13.000 I thought it was so important that you hear it, you listen to the details, and listen to our sister episode where we give our commentary on it, charliekirk.com/slash support.

00:00:21.000 That's charliekirk.com/slash support.

00:00:23.000 Thank you to Alan.

00:00:25.000 Thank you to Maria, and thank you to Brian for your very generous support that allows us to do what we do at charliekirk.com/slash support.

00:00:35.000 This is the unedited Senate hearing of the Maricopa County Audit.

00:00:40.000 I think you will all enjoy it.

00:00:42.000 Buckle up. 0.96

00:00:43.000 Here we go.

00:00:44.000 Charlie, what you've done is incredible here.

00:00:46.000 Maybe Charlie Kirk is on the college campuses.

00:00:48.000 I want you to know we are lucky to have Charlie Kirk.

00:00:51.000 Charlie Kirk's running the White House, folks.

00:00:54.000 I want to thank Charlie.

00:00:56.000 He's an incredible guy.

00:00:57.000 His spirit, his love of this country.

00:00:58.000 He's done an amazing job building one of the most powerful youth organizations ever created.

00:01:04.000 Turning point USA.

00:01:05.000 We will not embrace the ideas that have destroyed countries, destroyed lives, and we are going to fight for freedom on campuses across the country.

00:01:14.000 That's why we are here.

00:01:17.000 That is a true statement.

00:01:19.000 They were close.

00:01:20.000 Now, I find it ironic that our Secretary of State and a few others have called this a sham audit, that you can't trust it, you can't believe it.

00:01:28.000 Well, the interesting fact is: truth is truth, numbers are numbers, and we've said that from day one.

00:01:35.000 What you're going to see is exactly what it is: the truth.

00:01:40.000 And those numbers were close within a few hundred.

00:01:45.000 But what you have not seen and not heard yet, which is what you are going to hear right now, what you have not seen and you have not heard is about the statutes that were broken, how the chain of custody was not followed, how we had a number of issues, which is why people question the ballots and the elections.

00:02:06.000 So, I ask that you please keep an open mind.

00:02:09.000 I please ask that you listen to this because the reality of this is what this is all about: making sure your vote counts.

00:02:18.000 Senator Peterson.

00:02:19.000 Thank you, Madam President.

00:02:21.000 I would join you and welcome everybody here who's here in person, listening, or watching this historic event.

00:02:30.000 This is the first time in the history of our country that an audit of this scale and magnitude has ever been conducted.

00:02:39.000 It's unfortunate that it is an incomplete audit due to the lack of cooperation and the obstruction from the county.

00:02:50.000 However, in spite of that, this is still the most complete audit that has ever been done.

00:02:58.000 The goal here, as the president has said, is election integrity.

00:03:05.000 Our citizens have demanded it.

00:03:07.000 The importance of our society having faith in the election process cannot be overstated.

00:03:15.000 The number she gave of people who had concerns was significant, but even if it was much less, it would still merit this type of an audit to bring reassurance to our citizens.

00:03:31.000 This report should help the Senate understand what has been working, what needs improvement, and whether further investigation by law enforcement should occur.

00:03:44.000 So, I look forward to receiving this report with all of you at this time.

00:03:52.000 Thank you, Senator Peterson.

00:03:54.000 With that, we will start with our first presenter.

00:03:58.000 Our first presenter is joining us via Zoom because he lives on the East Coast.

00:04:03.000 His name is Dr. Shiva.

00:04:05.000 He was the one commissioned by the Senate.

00:04:08.000 And that was because we finally got the envelope ballots, or the ballot envelopes, so we could check signatures or lack thereof.

00:04:18.000 And this was his part of the audit.

00:04:20.000 Dr. Shiva, welcome to the Arizona Senate.

00:04:23.000 How are you today?

00:04:24.000 Thank you very much for having me, Honorable President Fann.

00:04:27.000 And also, Senator Peterson.

00:04:27.000 Thank you very much.

00:04:30.000 Thank you.

00:04:31.000 The floor is yours.

00:04:32.000 Please proceed.

00:04:34.000 Thank you.

00:04:35.000 Before I start, I have a presentation.

00:04:37.000 This is also accompanied by a report.

00:04:39.000 I just want to make one prefaratory remark, and that is, as a follow-up to Senator Peterson, we live in the age of what we call engineering systems, complex systems, taking an airplane, using an iPhone, self-driving cars.

00:04:53.000 These are highly complex systems, but what are known in the modern world as engineering systems?

00:04:59.000 Our election voting systems are also engineering systems.

00:05:03.000 And I want to thank the leadership of the Senate, the stakeholders, because they've taken a historic step here to bring the same level of engineering systems capabilities to election voting systems.

00:05:17.000 And one of those important attributes is that whether an anomaly is small or large or insignificant or monumental, it all must be welcomed because from an engineering standpoint, it can only do one thing.

00:05:28.000 We just enhance the system.

00:05:30.000 So today, as Senator Fan President Fan said, I'm going to be sharing with you a particular area that we looked at, which was looking at the early voting ballot return envelope images.

00:05:46.000 And that's what I'm going to share with you.

00:05:47.000 So let me begin.

00:05:48.000 I'm going to start at the PowerPoint.

00:05:50.000 And I think I need to share the screen here.

00:05:53.000 Let me see if I can share first.

00:05:56.000 There.

00:05:58.000 All right.

00:05:59.000 Let me start here.

00:06:02.000 So the title of this talk is Pattern Recognition Classification of Early Voting Ballot Return.

00:06:11.000 The screen is blank.

00:06:12.000 Oh, it's blank?

00:06:17.000 I'm sharing.

00:06:22.000 Always a technical problem.

00:06:26.000 Okay, let me stop this here and restart it again.

00:06:28.000 Let's try that again.

00:06:31.000 There we go.

00:06:32.000 Thank you.

00:06:33.000 That worked.

00:06:35.000 Okay.

00:06:36.000 And so the title, as I said, is a pattern recognition classification early voting ballots return envelope images for signature presence detection.

00:06:45.000 We're not doing signature detail verification, but we're doing signature presence detection.

00:06:50.000 And we're taking an engineering systems approach.

00:06:53.000 So let me begin.

00:06:54.000 I will go through this agenda.

00:06:56.000 We're going to give a little bit of background.

00:06:58.000 We're going to review the Maricopa results.

00:07:00.000 We're going to go through what our analysis resulted in and then compare them and then report on some of the key findings and anomalies and then also raise questions for Maricopa officials and then propose some recommendations.

00:07:12.000 So the executive summary of this to sort of summarize the whole talk here today or the findings is that the early voting ballot, the return envelope, you really want to think about that's really the protective vehicle by which the EVV, which is the early voting ballot, is transported and processed.

00:07:30.000 And the authentication, the verification of the signature on the EVB return envelope is critical to reliability of the entire process.

00:07:40.000 And our audit reveals anomalies raising questions on the verifiability of the signature verification process.

00:07:48.000 So let's begin.

00:07:50.000 So a little bit of background.

00:07:51.000 You can read more about it, but I was selected.

00:07:54.000 I was honored to be selected because my background for more than 40 years has been in the field of pattern recognition and classification, particularly system science.

00:08:02.000 And it goes back a long period of time.

00:08:05.000 But just very briefly, you know, in this field, you look at reality.

00:08:09.000 In this case, we're looking at the electronic, the election voting, the early voting ballot system, and then you try to model it.

00:08:17.000 That's typically what science and engineers do.

00:08:19.000 For example, for many years, I looked at how babies were processing sleep and trying to understand their system by looking at sleep patterns.

00:08:27.000 Same in the area of deathblind communications.

00:08:29.000 Again, you have the reality, you have signals, same in the area of looking at a bridge, and you get signals from it.

00:08:34.000 Based on the signals, you're trying to predict what's going on in that bridge.

00:08:37.000 And same if you look at an aircraft wing without having to open it up, you look at these signals and you're trying to predict what's going on.

00:08:43.000 And for many years, we did a project on looking at handwritten bank check numerals.

00:08:48.000 And these different areas, including email, looking at what's inside of an email as a system, these are all pattern recognition problems.

00:08:55.000 And in fact, if you look at food, trying to figure out will this food cause different kinds of diseases.

00:09:00.000 But the reality in this area is you're looking at the particular real world and you have a model.

00:09:05.000 You can look at the heart, you can look at the cardiovascular system of that.

00:09:08.000 And you can say, hey, I have some states of this system which are normal signals and some states which are abnormal signals.

00:09:15.000 So in this case, what we're looking at is we have the early voting ballot system and we have the early voting ballot return envelope images.

00:09:23.000 These are the signals that we received to try to figure out what's going on inside that system.

00:09:28.000 So you have the reality of what took place and you have the expression of that which is embodied in those images.

00:09:34.000 And this is what one of those images looks like.

00:09:37.000 You have an image, you have upper left the name of the voter, and here you have the signature.

00:09:43.000 And we were asked as a part of the scope of this audit not to look anywhere else, but to look in this signature region and to look to see if there was a normal state, a signature there, or the abnormal states, blanks, split into two, and I'll talk about more in detail: a complete blank or likely blank, or what we call a scribble.

00:10:03.000 A scribble is something trying to get into the direction of, hey, was this signature even valid?

00:10:10.000 Okay.

00:10:11.000 And it's a very, very rudimentary step we took, not full signature verification.

00:10:16.000 All right.

00:10:17.000 So, early voting ballot system, and you have these images.

00:10:21.000 So, before we head into the actual process we did, let's look at the reality of what took place.

00:10:27.000 So, this is on the left side, the actual reality of what was reported by the Maricopa County in their voter education report.

00:10:34.000 In fact, what was called their Canvas report.

00:10:37.000 And what we see here, if you look carefully, here are the numbers that they reported from 2016, but more importantly, we're concerned about 2020.

00:10:45.000 And in 2020, one of the lines in their report is called the early ballots verified and counted, which has 1,915,487.

00:10:57.000 And the rejected early ballots, which are these numbers, are the ones that were not included in the final count.

00:11:03.000 Bad signatures, which means they went through a signature verification process.

00:11:07.000 And out of that, 587 out of the 1,918,463, which is all of them were deemed to be bad signatures.

00:11:17.000 And the way we get this number is you take all of the ones that were verified and counted.

00:11:21.000 The ones that were bad signatures, there were some which were no signatures, which were blanks, and then late returns.

00:11:27.000 So to be clear, according to the report, this was a total number of early voting ballot return envelopes received by Maricopa County.

00:11:37.000 To make it a little more clear, we have 1,918,463 total unique EVV return envelopes, of which 1,455 were found to have no signatures.

00:11:51.000 And at the end, there was the, and an amount of 1,917,008 was ready for signature verification.

00:12:01.000 And as a result of that, 587 were found to have bad signatures.

00:12:05.000 Now, in signature verification, it's a detailed process.

00:12:08.000 You can read the report, but counties vary.

00:12:12.000 And Maricopa is considered along with Florida, apparently have one of the better signature verification processes.

00:12:19.000 But according to that, out of the entire lot of 1,918,463, 587, after this verification process, where someone looks at the signature and they look at the voter registration signatures and they're doing typically what's called a 27-point analysis.

00:12:37.000 So 587 were found to have bad signatures, 934 with late returns for a total amount, which matches with what was reported, of 1,915,487.

00:12:49.000 Okay, so this is Maricopa's reported results to the public.

00:12:54.000 The scope of our audit, just to, I'm going to go through the scope of this audit by also going through the process.

00:13:01.000 So it'll be somewhat educational.

00:13:03.000 When early voting ballots, which some people, which is a subset of those, are called mail-in ballots, are submitted, those ballots are imaged, which means scanned, converted to digital images.

00:13:13.000 So the EVB return envelopes, we're talking about the outside, the covering, that important covering within which is contained the ballot, is scanned before they're even tabulated.

00:13:23.000 So the EVB return envelopes are opened and scanned.

00:13:27.000 Okay?

00:13:28.000 And those create images.

00:13:30.000 In fact, there are six different kinds of EVB return envelope formats.

00:13:35.000 Let me walk you through some of them.

00:13:36.000 And here's sort of a little bit closer, but let me walk you through some of them.

00:13:40.000 So this is a majority of them.

00:13:42.000 We've called them the standard image files.

00:13:44.000 This is for our lingua franca.

00:13:45.000 This may not be the standard language, but for the purpose of this presentation.

00:13:50.000 So this is one way that they look.

00:13:53.000 There are also another set called Yukava image files, and there's three different kinds.

00:13:57.000 Here you have the signature here, the date here, the name of the voter here.

00:14:01.000 Another version of that is a little more complicated.

00:14:03.000 It's more of an affidavit.

00:14:04.000 The signature's here, the name of the voters here.

00:14:07.000 And obviously, we redacted stuff for privacy.

00:14:10.000 And a third type of the UCAVA is type C.

00:14:12.000 So you have UIFA, B, and C. All right.

00:14:17.000 Then finally, we have large print image files, LIFs, and these are for people who have trouble seeing.

00:14:25.000 So the instructions, everything are larger.

00:14:28.000 And then finally, you have the Braille format.

00:14:30.000 So again, six different image formats that we had to process.

00:14:34.000 Let me walk you through the counts that we got.

00:14:36.000 We got a drive with all of these images on them.

00:14:42.000 The SIFs, which was the first one I showed you, there's 1,919,598, which is about 99.5%.

00:14:51.000 The UIFAs, 8,849, 0.459%.

00:14:56.000 The UIFBs, 277, 0.014%.

00:15:00.000 And if we go to the UIFCs, which are the affidavits, which a small set, which are 0.001%.

00:15:07.000 And then finally, we have the large formats, which are 475, 0.024%, and the Braille, about 29 of them, 0.002%.

00:15:14.000 And that added up to all of them.

00:15:16.000 So for the audit, we were provided by the Arizona State Senate 1,929,240.

00:15:25.000 And these were apparently all the EVB return envelopes that Maricopa County got.

00:15:33.000 What we noticed when we looked at this, which was fascinating, our first interesting, I guess wasn't an anomaly, but something we were a little bit surprised because we thought the duplicates would have been removed, but there were duplicates in here.

00:15:33.000 Okay.

00:15:46.000 So we had to remove duplicates.

00:15:48.000 So out of those set, there were duplicates.

00:15:52.000 So these were the duplicates.

00:15:53.000 We found about 16,934 voters who had submitted 16,934 two copy duplicates, which means each of those voters submitted two ballots.

00:16:07.000 Okay, two return early voting ballot return envelopes.

00:16:12.000 Interesting enough, we also found another 188 voters, unique voters, who had submitted 376 duplicates.

00:16:20.000 So the total image count was 564 once you removed the duplicates, right?

00:16:24.000 Because you want to take one of them.

00:16:25.000 And then finally, we found also four individuals who submitted 12 duplicates, total images being 16.

00:16:34.000 So the total duplicates was 34,448 total images, of which 17,332 or 322 were duplicates from 17,126 voters.

00:16:49.000 This was, by the way, we'll get to it, was not reported in the report.

00:16:53.000 So when you look at the first level of analysis on our the data that we got, 1,929,240 EVB return envelopes received, we subtract out the duplicates, and then we have 1,911,918,000.

00:17:10.000 Okay.

00:17:10.000 So then the process that we were really commissioned for was to do a very, you know, basic analysis to see is there a signature there or not?

00:17:21.000 Signature presence detection.

00:17:24.000 So in that process, again, the goal is, is there a signature there in the signature region?

00:17:30.000 Interestingly enough, some people don't follow instructions.

00:17:32.000 They write all over, but it wasn't our job to go scan everywhere.

00:17:36.000 Our job was to look in that signature region.

00:17:39.000 So again, specifically, we looked in that signature region.

00:17:42.000 One category of the signature region has a signature, another category is blank, likely blank, and scribble.

00:17:47.000 And just to keep it real simple, it was a very simple classification.

00:17:51.000 If it's 0% non-white pixel density, which means nothing in that area, it's a blank.

00:17:57.000 If it has a little bit, 0% or greater, but no more than 0.1%, like this example here, we put it into another category just for early classification purposes.

00:18:08.000 We called it a likely blank.

00:18:09.000 And then if it was greater than 1% density, greater than 1%, or that was denoted a scribble.

00:18:20.000 And what's interesting in anything over greater than 1%, by the way, this is actually, this should be 0.1% to 1%.

00:18:27.000 Slight mistake here.

00:18:28.000 So this is greater than 1%.

00:18:30.000 So let me repeat, this should be greater than 0.1%, less than 1%.

00:18:35.000 Please correct that.

00:18:36.000 And this is greater than 1%.

00:18:37.000 All right.

00:18:39.000 Then what we did was we did a distribution curve.

00:18:43.000 We looked at all of the ballots and we did a distribution of pixel densities, just to give you an idea of how liberal we were in accepting something as a signature.

00:18:53.000 So if you look at this, it was only this little area here, which is between 0.1 to 1%.

00:19:00.000 That's the definite non-white pixel density.

00:19:02.000 That's a scribble.

00:19:04.000 Everything else, we were quite liberal and accepted those as signatures, even in our analysis.

00:19:08.000 So again, we were not hired to do signature verification.

00:19:13.000 All right.

00:19:14.000 Now, after this, typically signature verification would take place, which is what the county did.

00:19:19.000 And then they would also open up then the ballots and then open up the envelopes and tabulate them.

00:19:24.000 So let's go to our signature presence detection.

00:19:27.000 So we took a ballot, or it could be any ballot.

00:19:31.000 First of all, we classified it into one of these six categories.

00:19:34.000 That's what the system did.

00:19:36.000 And then for each one of the, four of those, we removed the duplicates, as I've shared.

00:19:40.000 And then we looked at the ballots.

00:19:43.000 Once we knew which one it was, we identified what kind of region we extracted the region if possible, though this was not part of the scope.

00:19:52.000 We also tried to extract the name, and we were able to do that for close to, I think, 99% of them.

00:19:57.000 So we also used different types of classifiers, which is in pattern recognition lingo, for each one of these different kinds of ballots to ultimately put them into one of these four buckets.

00:20:08.000 So let's look at the results.

00:20:10.000 So we're first going to look at the non-duplicates, which means all those early voting ballot EVB to be simple return envelopes, which were non-duplicates.

00:20:22.000 And here we see predominantly 99.77% we denoted a signature.

00:20:27.000 Again, anything greater than 1% pixel density.

00:20:30.000 These scribbles we found were 0.13%, okay?

00:20:34.000 2,420.

00:20:36.000 And the blanks fell into two groups: the definitive blanks of 1,771 and the likely blanks at 101.

00:20:42.000 This adds up to 0.1%.

00:20:45.000 Okay, then we also looked at the counts.

00:20:51.000 So of these, you had, just to be clear, we had 2,420 scribbles and we have 1,872 blanks.

00:20:57.000 We put both of these together in our sum total.

00:21:00.000 Similarly, we now went and looked, this was a little more complicated, at the two-copy duplicates because we had to deal with those.

00:21:06.000 There was a substantial amount, 34,000 of them, 34,000 and more.

00:21:12.000 So the duplicate recognition split it into three, in fact, three groups, but we had subgroups.

00:21:18.000 So there could be, you know, you have the, if you think about it, the mother and the son, or the mother and the daughter, okay, or the parent and the child relationship.

00:21:26.000 So one of the two, one could have been a signature, and one could have had a signature.

00:21:31.000 One could have had a signature, the other could have had a blank, one could have had a signature, that could have been a likely blank, one could have had a signature, and C denotes scribble.

00:21:39.000 If any one of them had a signature, we said, okay, we call it a signature.

00:21:43.000 Alternatively, in the scribble area, one could have had a scribble, the other could have been a blank, one could have been a scribble, other could have been likely, one could have been a scribble in a scribble.

00:21:52.000 These were denoted as scribbles in the duplicate case.

00:21:55.000 And then finally, you had ones that are blank, blank, blank, and likely blank, and likely and likely blank.

00:22:00.000 Those were denoted as blanks.

00:22:02.000 So let me, just to give you some feeling of what these look like.

00:22:02.000 All right.

00:22:06.000 So here is one from the same person.

00:22:08.000 Again, for the purpose, we're not allowed to share the names of voters, et cetera.

00:22:13.000 But you can see here that here's one.

00:22:15.000 There is a signature here and there's a signature here.

00:22:17.000 Okay, that but they are both the same.

00:22:21.000 So these are both signed.

00:22:22.000 So two ballots, both signed.

00:22:25.000 Another example is one is signed and the other is a blank, a complete blank here.

00:22:30.000 In fact, in the signature regions, we're concerned with.

00:22:32.000 Another is signed and the other one is a likely blank.

00:22:36.000 It's got some stuff here.

00:22:37.000 So Echo Mel categorized it as a likely blank.

00:22:40.000 Here's an example where you have a signed one, but you have a scribble over here.

00:22:44.000 Okay.

00:22:45.000 And then here we have the here you have a scribble, but here you have a blank, but it has been verified and approved.

00:22:54.000 And we'll talk about this later.

00:22:55.000 We'll come back to this.

00:22:57.000 Here you have one that's a scribble, a little bit, some stuff here, and a likely blank, and the one with the scribble was approved.

00:23:05.000 Here you have two scribbles, and one of them was approved the exact same ones.

00:23:10.000 And here you have one with a blank and a blank, and this blank has been approved.

00:23:16.000 And here we have one which is a blank and a likely blank, and a likely blank with a little dot over here has been approved.

00:23:22.000 And similarly over here, we have a signature and a likely blank, and again, a likely blank is being approved.

00:23:27.000 And here's an example of a three-copy one.

00:23:29.000 We have three copy duplicates, all are blank.

00:23:33.000 And we'll come back to showing how they were approved or not.

00:23:36.000 And here's an example of three-copy scribbles.

00:23:39.000 All right.

00:23:40.000 So that gives you an understanding of the flavor of these analysis we had to do of the two copy duplicates.

00:23:48.000 And so on those two copies, we categorize these ones in green as signatures, the ones in red as scribbles, and the ones in blank as sorry, black as blank, ones in red as scribbles.

00:24:00.000 So again, you have for two copies, 16,934.

00:24:04.000 And these are the counts on that.

00:24:06.000 So you have 155 scribbles from the two copy, 45 blanks from the two copy.

00:24:11.000 Interesting enough, we also had three copy and four copy analysis we get to do.

00:24:14.000 I'm not going to go into all the details of this, but there were also three copy and four copy duplicates.

00:24:21.000 There were two sets of three copy which were blank.

00:24:24.000 I'm sorry, two sets which were scribble, five which were blank.

00:24:30.000 So now we do the totals calculations.

00:24:32.000 So if you add the non-duplicate blanks, 1,872, two-copy duplicate blanks, 45, and then two three-copy duplicate blanks, you get two.

00:24:40.000 So 1,919.

00:24:43.000 Similar, if we do the scribbles, 2420 for the non-duplicates, 155 for the two copy, 5 for the three copy, we get 2,580.

00:24:51.000 So our net results state that we received 1,929,240.

00:24:58.000 The 17,322 were removed to get this many unique return envelopes.

00:25:05.000 And then we subtracted the non-signature and what we call scribbles to come up with a total of 1,907,419.

00:25:14.000 So this is what we would have sent to, in this analysis, should have gone to signature verification.

00:25:20.000 Now let's do the comparative analysis, which is looking side by side what Echomail uncovered from the audit and what Maricopa had.

00:25:29.000 So how many EVB return envelopes were received?

00:25:32.000 Well, in the disk drive that we received, this is a number, but we don't know.

00:25:37.000 In fact, it's not reported in the Maricopa report how many actual return envelopes they receive.

00:25:43.000 The duplicates, we have 17,322, which we subtracted.

00:25:47.000 This is unreported.

00:25:48.000 So when you compare the unique EVB return envelopes, what you find is that Maricopa has 6,545 more than we have in the possession of those image files after you remove duplicates.

00:26:02.000 Now we go to the signature presence detection.

00:26:05.000 We discovered 1,1919 no signatures.

00:26:08.000 They reported 1,455.

00:26:11.000 So in this case, we have 464 more blanks.

00:26:14.000 In the scribbles, they don't have a scribbles category, and we'll discuss that.

00:26:17.000 If we start thinking about these scribbles as potential bad signatures, we'll get some insight.

00:26:22.000 But at the end of the day, what went to signature verification at Maricopa was 1,917,008, which is 9,589,589 more than we would have sent pursuant to this analysis.

00:26:36.000 They also had bad signatures and late returns that we talked about.

00:26:40.000 Now, I want to go to the key findings and anomalies.

00:26:43.000 You've seen the process.

00:26:45.000 You've understood the methodology.

00:26:46.000 We've gone through some detail.

00:26:47.000 Let's go to the highlights here.

00:26:49.000 So these are the key findings, and I'm going to go through each one of them.

00:26:53.000 One of the key findings is it's unknown how many EVB return envelopes were originally received by Maricopa.

00:27:00.000 We had 34,488 duplicates from 17,126 unique voters.

00:27:09.000 It's actually duplicate images.

00:27:11.000 Maricopa reported no duplicates in the Canvas report.

00:27:15.000 We have 464 more no signatures, which means blanks, than that were identified by us versus Maricopa.

00:27:24.000 Maricopa has 6,545 more unique EVB return envelopes.

00:27:33.000 This is what's interesting.

00:27:34.000 If you consider our scribbles, again, a very, very low tolerance in pattern recognition, having done this for over 40 years, you know, we could have used like 36 features.

00:27:43.000 We used one single feature, pixel density.

00:27:45.000 We would love to use more features, but just using that one feature at a very low threshold, threshold is key here, we've identified 2,580 scribbles, which would have assumed they're all bad signatures.

00:27:57.000 Maricopa identified 0.031%, which is what that 587 represents.

00:28:03.000 This actually represents four times that.

00:28:05.000 We'll come back to that.

00:28:06.000 Finally, Maricopa has 9,589 more net EVB envelopes that was submitted to signature verification versus what we have.

00:28:16.000 And what we're also going to see shortly is that we're going to see that we also saw through further analysis of 25% surge of duplicates in the last six days between November 4th to the 9th.

00:28:30.000 We also saw some very interesting other anomalies where blanks of duplicates were being stamped, verified, and approved.

00:28:38.000 We also saw stamps of verified and approved in blank signature regions, and I'll share with you those.

00:28:44.000 What's more interesting, I would consider this potentially a critical anomaly, is that we saw the verified and approved stamps appearing behind the envelopes.

00:28:54.000 And I'll show you this.

00:28:55.000 It's almost as though it was imaged on there, or I don't want to say, you know, Photoshop, but put on there.

00:29:00.000 But it's quite fascinating.

00:29:01.000 I'm sure there's some explanation for this.

00:29:04.000 And then finally, we have cases where we have two different voter IDs having the same address, same phone, same name with matching signatures.

00:29:12.000 So let's go look at some of these anomalies a little more graphically.

00:29:16.000 Anomaly one, Maricopa reported only 587 bad signatures.

00:29:20.000 To give you some idea, that's 0.031%.

00:29:23.000 And for people who didn't really like math, I thought I'd make it a little more pictorial.

00:29:28.000 So this would be one bad signature for every 3,268 early voting ballot envelopes.

00:29:35.000 So if you think about 1,918,463 early voting ballots, the unique ones that Maricopa said they got, and for each paper, by the way, the size of the paper is 0.1 millimeter, and you were to put them up, you would get 630 feet.

00:29:49.000 That's the size, believe it or not, of the St. Louis Arch.

00:29:54.000 That height, when compared to the bad signatures, would be only about 2.31 inches.

00:30:00.000 So just to give you a pictorial understanding, a very, very low percentage was considered that.

00:30:05.000 So again, that would be, to be specific, 0.0306% of all EVV return envelopes were deemed as bad signature.

00:30:13.000 Okay.

00:30:14.000 In our case, the anomalies, we discovered 2,580 bad signatures, scribbles.

00:30:20.000 Again, very low tolerance, which is 0.135%.

00:30:24.000 And to give you an idea, just to state it again, we were not commissioned to identify, we were commissioned to identify the present blank scribbles and signatures, not to perform signature verification.

00:30:34.000 So scribbles alone were considered bad signatures.

00:30:37.000 And EchoMail itself identified 335% more bad signatures than Maricopa did from its entire signature verification process.

00:30:46.000 Okay, very important point here.

00:30:48.000 And by the way, if we go look back at the state of Arizona 2016 general election, out of the 2 million ballots that came in, they had a signature mismatch rate of 0.13%, close to what we would have had if we just included those scribbles.

00:31:05.000 All right.

00:31:06.000 Again, just to restate, the scribbles are a very, very low threshold.

00:31:10.000 We were not asked to do signature verification.

00:31:13.000 Again, anything between 0.1 to 1% pixel density.

00:31:17.000 The third anomaly is, this is again, focusing on signatures.

00:31:21.000 We did a randomized analysis of just a supervised review, which is human review, just randomly looking at signatures, their legibility.

00:31:30.000 Again, this is a wonderful analysis that can be done in handwriting.

00:31:33.000 Four weeks before the election and four days after.

00:31:36.000 We can't share with you this, obviously, but we found out four weeks before 95% were legible signatures and only 5% were illegible.

00:31:45.000 But four days after, 5% were legible, 95% were illegible.

00:31:50.000 If I were to do a heat map, again, this is a representation, it would look like this: where the red represents illegitimate and the green represents legibility.

00:31:59.000 It would look like this if you wanted to visually do this.

00:32:01.000 And if we had more, if we were commissioned to do this, we could do this.

00:32:04.000 But you can see a market difference between legibility.

00:32:07.000 There could again be an explanation for this.

00:32:11.000 Fourth anomaly: as the EVBs, which means the electronic voting ballot, I couldn't put the word envelopes, but I think you get the idea, increased by 53% in the general election from 2016 to 2020 in Maricopa, bad signatures decreased.

00:32:25.000 Let me explain what I mean by that.

00:32:27.000 So in 2016, which is, you know, in the previous election to 2020, 1,257,179 return envelopes were submitted.

00:32:37.000 1,456 were considered to have a mismatch with a rejection rate of 0.116.

00:32:44.000 In 2020, we have nearly 56%, sorry, 52% more return envelopes, but the signature mismatch rate goes down by nearly 56%.

00:32:55.000 So it's gone down by a significant number here, okay, nearly four times.

00:33:01.000 So this went up, the other two came down.

00:33:04.000 A very interesting inverse relationship, which would be, again, one of the questions we have for Maricopa officials.

00:33:10.000 Anomaly number five is: there's no mention of duplicates in Maricopa Canvas report.

00:33:16.000 Again, if you look here, here's a Canvas report, there's no mention of duplicates here.

00:33:21.000 We, in our case, we found 17,126 voters sent in two or more ballots as duplicates, as you've seen before.

00:33:31.000 Anomaly six is 25% plus or more of the duplicates came in during November 4th to the 9th, essentially on election day and after.

00:33:41.000 So how did we find this?

00:33:43.000 Well, here's a plot.

00:33:45.000 Again, let me walk you through this on the y-axis is a number of early voting ballot return envelopes, and we're plotting it by date.

00:33:53.000 And again, this is based on the drive we got, which were time stamped by particular days.

00:33:58.000 So it almost looks like an interesting heartbeat here.

00:34:01.000 So on this day, 10, 14, nearly, you know, 200,000 envelopes came in.

00:34:06.000 On this day, nothing came in.

00:34:07.000 So you get this interesting heartbeat signal.

00:34:10.000 Then what we did was we said, why don't we, on top of this, layer in the blanks, scribbles, and duplicates.

00:34:17.000 Again, since the axis for the EVBs is higher, that's on the right axis.

00:34:22.000 On the left axis, I've done the totals for the scribbles, blanks, and duplicates.

00:34:26.000 What's fascinating is you notice in the early part, things are following the heartbeat, okay?

00:34:31.000 But somewhere along here, particularly on October 26th, this heartbeat starts sort of separating, particularly the saffron line is the duplicates.

00:34:40.000 So you have the duplicates stop matching in many ways this heartbeat.

00:34:44.000 So here everything stops.

00:34:46.000 So what we did was we did further analysis on the blanks, I'm sorry, the duplicates and the EVBRE.

00:34:53.000 And this is what's interesting.

00:34:54.000 So what we're plotting here is the duplicates as a function of the daily percentage of EVBs.

00:35:02.000 So here's a signal, but what you see is you see suddenly this, what you may call a significant growth in percentage.

00:35:08.000 In fact, in several of these days, there's 96% of the ballots that came in on two of these days are duplicates.

00:35:17.000 So there was a serious number of duplicates.

00:35:19.000 In fact, the area under this curve is close to 30%, 25%, 30% of the duplicates came in between November 4th to November 9th.

00:35:29.000 And that motivated us to also on the same plot drop the blanks and the scribbles.

00:35:34.000 And you see the same phenomenon there.

00:35:37.000 Anomaly seven.

00:35:40.000 I'm sorry, I've already gone through that.

00:35:42.000 The next anomaly is: we also noted that the EV33 system, which is the system that is the one that contains all the early voting ballots, had 932 voters who submitted duplicates versus the 17,126 that we identified.

00:36:03.000 But what's fascinating is when we matched those 932 voters against R17, 126, only 2,138 voters matched.

00:36:12.000 Let me repeat that again.

00:36:13.000 The EV33, as we understand, we're not experts, that this is a system where all the early voting ballots are stored.

00:36:21.000 When that was gone through and found that 9,382 of those were voters who'd submitted duplicates, clearly this should be a subset of ours because we're supposed to have all the early voting ballots.

00:36:33.000 We found out only 2,113 matched.

00:36:36.000 And let me just walk you through some of these duplicates where the duplicates are stamped and also approved.

00:36:43.000 So you see the duplicate, and here it's being stamped.

00:36:46.000 Nothing on here, it's being approved.

00:36:49.000 Duplicate one, duplicate two, this one is being approved.

00:36:52.000 And again, all of these came in after November 4th.

00:36:55.000 Same here, another duplicate being approved and a blank.

00:37:00.000 Here's another one: example three, two duplicates, the blank being approved.

00:37:06.000 Same here, fourth example, and there are many others, but these are pure blanks and they're being approved.

00:37:12.000 In fact, this is a three-copy duplicate where two are approved.

00:37:16.000 So one voter sent in three copies and two got approved.

00:37:20.000 Another one is three-copy duplicates where one is approved.

00:37:24.000 All right.

00:37:24.000 The next anomaly is verified and approved in the blank signature region.

00:37:30.000 So what do I mean by that?

00:37:31.000 So this is blank, but they're verified and approved as appearing right in the blank.

00:37:36.000 Again, this is process issues which we'd love to get answers to.

00:37:41.000 So same thing here.

00:37:43.000 Same thing here.

00:37:44.000 The verified and approved is right there.

00:37:47.000 And then finally, this is an interesting anomaly where we have two EVBs from two EVBs where people have the same voter ID, same name, address, and phone number with matching signatures with two different voter IDs.

00:38:00.000 Okay.

00:38:01.000 So we had to redact this, but imagine if you could see this, there's a person's name here and address, which is the same as the name and address here.

00:38:10.000 Very similar matching signatures, same phone numbers, but they have two different voter IDs.

00:38:15.000 So let me repeat again: two different voter IDs, same name, matching signatures, as if you looked at them visually, same phone numbers.

00:38:26.000 And another example here.

00:38:28.000 Actually, there's three examples here.

00:38:31.000 Another person here, we call, by the way, there's not a person called John Doe.

00:38:36.000 This is a, just to protect the innocent.

00:38:40.000 And this is Jane Doe.

00:38:42.000 Again, matching signatures, same address, same phone number, but two different voter IDs.

00:38:49.000 Same here, two different voter IDs, same address, same name.

00:38:54.000 We don't have a phone number here, et cetera.

00:38:55.000 So we have three examples of that.

00:38:57.000 Then finally, the last anomaly I want to show is where we saw something fascinating is where the verified and approved stamp, and you have to look at this carefully, it's occurring behind the envelope triangle.

00:39:09.000 Let me explain.

00:39:10.000 So if you look at this carefully, this is an image of an envelope.

00:39:15.000 Here is a triangle, which is pointing people to print here.

00:39:19.000 Now, you would think if it was stamped, this stamp should be over this image, but it is actually behind the triangle.

00:39:29.000 All right, and you see it here again, close up here.

00:39:32.000 These are all different ballots which were approved post-November 4th, predominantly, where the image of the verified and approved is behind this.

00:39:41.000 Now, maybe this is done for a good reason, maybe it's an imaging technology, but typically you could, you know, if you use Photoshop, you'd have layers, but I don't want to even accuse that, but I just want to say that it is interesting that the verified and approved is behind the envelope here, the envelope triangle.

00:40:00.000 All right.

00:40:01.000 So, again, there's some examples here.

00:40:03.000 So, questions.

00:40:04.000 These are the questions we have for Maricopa officials.

00:40:07.000 One is: did Maricopa receive any duplicates?

00:40:10.000 Again, I've gone through, he received, we have in our possession 34,448 images representing 17 duplicates from 17,126 unique voters, two copy, three copy, four copy.

00:40:23.000 The word duplicate does not show up as a keyword in their report, but it would be interesting to know if duplicates exist.

00:40:28.000 The second one: is there a reason that Echo Mail has no more or no signatures than reported by Maricopa?

00:40:36.000 Is it because we solely analyze only the signature region?

00:40:39.000 And if not, why?

00:40:41.000 The next question is: why did EchoMail detect more scribbles in Maricopa's reporting of bad signatures?

00:40:47.000 Again, this comes to the point which I probably emphasized enough here.

00:40:51.000 But if our scribbles at that less than 1%, 0.1 to 1% pixel density were considered bad signatures, that is significantly more, three to four times more than the Maricopa's 587 bad signatures.

00:41:04.000 And the other question is the date stamps and the directories that we have, the date on which the EVB return envelopes were received by Maricopa officials.

00:41:12.000 We've assumed that when we did our time temporal charts, and then finally, why does the approval stamp verified and approved appear to exist only on a small subset of the EVB return envelopes?

00:41:22.000 Out of all the 1.9 million, that verified and approved, we find most of them exist after 11.0, after election day, but very few sprinkled.

00:41:33.000 So, out of all those envelopes, our initial supervised review reveals maybe 10% have this stamp on them.

00:41:41.000 The other thing is: did Maricopa stamp some EVB return envelopes as EVB approved, even though signature, even though signature is blank, since they found a signature elsewhere?

00:41:51.000 And that would be good to know.

00:41:52.000 How did they do that?

00:41:53.000 What is the adjudication process?

00:41:57.000 Finally, all of this leads to a very important set of things from an engineering standpoint.

00:42:01.000 What is the standard operating procedure?

00:42:04.000 We call it an SOP for the EVB processing.

00:42:07.000 If in any engineering system, you have the SOPs.

00:42:10.000 Because again, we're relying on this very, very important process of the signature and its verification.

00:42:16.000 What is the SOP for the signature verification?

00:42:19.000 And what is the SOP procuring of questionable signatures?

00:42:22.000 And finally, what is the chain of custody?

00:42:25.000 Talk a little bit more about that.

00:42:26.000 And the last set of questions is: why was there a sudden surge of duplicates during 1104 to 1109, which is incongruent with the trend we were seeing with the early voting ballot return envelope counts?

00:42:40.000 Finally, why is a verified and approved stamp envelope appearing behind the printed envelope triangle?

00:42:46.000 How does that happen?

00:42:47.000 Is there some imaging that's done?

00:42:49.000 Are the envelopes printed?

00:42:50.000 I mean, it's a very, I just have a question from an imaging standpoint.

00:42:54.000 And the other question is: can two voter IDs, can two different voter IDs, be associated with the same person at the same address of matching signatures?

00:43:03.000 Is that allowed?

00:43:05.000 And then finally, why are blanks being stamped as verified and approved?

00:43:10.000 And then, more importantly, why is a stamp verified and approved appearing in a blank signature region?

00:43:16.000 So, those are our questions.

00:43:17.000 In conclusion, as I started this conversation, the EVB return envelope is a container of the ballot.

00:43:23.000 It's a very important thing.

00:43:25.000 I mean, if you think about the human body as a system, your skin is what contains you.

00:43:28.000 That envelope is what contains these values.

00:43:32.000 A very, very important part.

00:43:33.000 So there's significant opportunities to enhance precision, verifiability, reliability, auditability, and reproducibility.

00:43:40.000 In the world of engineering systems, we call these properties.

00:43:43.000 And these anomalies give us a wonderful opportunity to enhance at least these five attributes.

00:43:49.000 So we believe what needs to happen is that our conclusions, a signature verification process, no pun intended, is unverifiable.

00:43:58.000 Okay, we can't really verify this process.

00:44:01.000 And there's a lack of systems integration and reporting.

00:44:03.000 Example, the EV33s, which should have all the early voting ballots, just on the duplicates issue.

00:44:10.000 We haven't had time to do a full systems integration.

00:44:13.000 That wasn't the scope.

00:44:14.000 But even on the ballots, we have far more duplicates than what are even in the system.

00:44:20.000 And currently, to us, because we haven't been able to get access to the standard operating procedures, that is opaque and non-transparent.

00:44:28.000 So the future research we believe that is absolutely necessary is we need to do full signature verification audit, which means do the full 27-point analysis.

00:44:38.000 We have the capability right now, we have everything imaged.

00:44:41.000 If we have the, if we acquire Maricopa's SOP for signature verification, if we can get their 27-point analysis algorithm, we can replicate all of this and using the algorithm that they have, define an actual false positive, false negative error rate.

00:44:59.000 What I mean by this is this would be a profound opportunity for improving U.S. election processes because this has not been done.

00:45:06.000 You read literature on the left or the right, everyone complains that the signature verification process has significant issues.

00:45:13.000 We have an opportunity right now with this data and the opportunity here to do a 27-point analysis and really come up with an actual rate, which would give us a scientific metric of the confidence value of the entire EVP system.

00:45:29.000 And finally, we need to review the chain of custody.

00:45:32.000 Today, what happens is when a signature is, there's questionable signature, people call the person, they contact them, and then they have some conversation, which is then verified.

00:45:43.000 Where are those conversation records?

00:45:45.000 Are those tickets stored anywhere?

00:45:47.000 And do we have access to that?

00:45:49.000 That's it.

00:45:50.000 Thank you, everyone.

00:45:51.000 I'll take questions if there are any.

00:45:51.000 Thank you very much.

00:45:53.000 Dr. Shiva, just before you get off here, I think it's really important that we know your credentials.

00:45:59.000 You kind of just breezed through that slide.

00:46:01.000 Can you go back to that real quick and just go over your credentials for everybody?

00:46:05.000 So that's important for us as we're reading your report.

00:46:11.000 Sure.

00:46:13.000 I appreciate the opportunity to share that.

00:46:15.000 Let me bring it up.

00:46:19.000 So let me just give you a little bit of my background.

00:46:21.000 I have four degrees from MIT, a PhD in biological engineering, and what's called computational systems biology, which is all about doing computation recognizing patterns.

00:46:31.000 My master's is also from the MIT Department of Mechanical Engineering, where I did computational weight propagation to look at a very important area of pattern recognition called non-destructive testing, where you're looking, you don't want to actually open up a bridge or you don't want to open up an aircraft wing.

00:46:45.000 You're sending signals in and you're classifying them.

00:46:48.000 My other degrees from the MIT Media Lab in scientific visualization, my master's, where I also use these same techniques to do some of the earliest complex visualizations for classification.

00:46:58.000 And my bachelor's is in electrical engineering computer science, also from MIT, where I built for that one of the first cardio cardiology systems for doing pattern analysis, cardiology signals.

00:47:11.000 But beyond that, my focus for 40 plus years has been in this field of pattern recognition and classification in biology, medicine, engineering, aeronautics, civil, electrical, banking, and finance, military, across a range of areas, handwriting recognition on bank checks, email analysis.

00:47:29.000 In fact, as a graduate student, I won, I was the only graduate student asked to participate.

00:47:35.000 I won the White House competition for automatically categorizing the White House's email.

00:47:40.000 This is 1993 when email was becoming a consumer application prior to when it was a business application of the email that I created back in 1978.

00:47:48.000 1993 is when email actually became a consumer application.

00:47:51.000 The Clinton White House was getting tons of email.

00:47:53.000 They wanted to automatically analyze it.

00:47:55.000 I ended up winning that, left MIT, took a 10-year hiatus and built EchoMail pattern analysis recognition emails.

00:48:03.000 Did a lot of work for many years as an undergraduate helping deafblind analysis of signature pattern analysis there.

00:48:10.000 Currently, I work in a company called Cytosol, where we're looking at analysis of signals, biomarker signals, to figure out the right combinations of medicines.

00:48:18.000 That company actually got a multi-combination therapy allowed by the FDA for pancreatic cancer.

00:48:24.000 I've written a number of patents, books.

00:48:27.000 Anyone wants to go to go to vashiva.com and you can look at my biography over there.

00:48:32.000 I've published in the leading journals in the world.

00:48:34.000 Nature, neuroscience is one of the eminent journals in the world, Cell Biophysical Journal, IEEE.

00:48:41.000 These are high-impact peer-reviewed journals.

00:48:45.000 The U.S. Copyright Office delivered me the first copyright for the invention of email.

00:48:49.000 I'm a Fulbright scholar, a Lemelson MIT finalist.

00:48:52.000 I won one of the earliest Westinghouse Science Honors Award.

00:48:55.000 I was a nominee for the National Medal of Technology and Innovation.

00:48:58.000 And I've been invited to give distinguished lectures at the National Science Foundation, NIH, FDA.

00:49:03.000 In fact, in November 19, I delivered the prestige lecture on the immune system, an invited lecture at the NSF where we discussed the immune system.

00:49:13.000 And several years ago, MIT had me deliver their presidential fellows lecture.

00:49:20.000 Thank you for sharing that.

00:49:22.000 You've raised a lot of very important questions for us to get answers to.

00:49:29.000 Thank you, Dr. Shiva.

00:49:30.000 Your report was extremely insightful.

00:49:33.000 And considering the fact that we only got the envelopes just a few short weeks ago, we appreciate you dropping everything, all of your other responsibilities, and jumped on this right away so that this could be accomplished by today's hearing date.

00:49:47.000 So we appreciate that very, very much.

00:49:52.000 I also want to thank Doug Applegate and Phil Evans, too, and my colleagues at EchoMail and the Echomail team, and particularly all the stakeholders.

00:49:59.000 And again, I want to thank the courage of the leadership of the Arizona State Senate.

00:50:04.000 This will go down in history as one of the most important engineering events, not just an election event.

00:50:08.000 It will go down as a very important engineering event for engineering systems of election voting systems.

00:50:13.000 So I really appreciate the opportunity, and I'm very honored to support this effort.

00:50:17.000 Thank you.

00:50:18.000 Thank you, Dr. Shiva.

00:50:20.000 And for everyone in TV land or whatever, these reports all will be made available in their entirety.

00:50:28.000 They'll be uploaded on the website as soon as we can get them uploaded so you can see all of these.

00:50:33.000 Personal information will be redacted.

00:50:34.000 And the personal, yeah, just make sure that the redaction that you saw was any personal information.

00:50:40.000 We tried very hard to make sure we complied with the court order and make sure anybody's names, addresses that were on there was not available to the public.

00:50:49.000 However, the unredacted version will go to the Attorney General's office so he can seek further investigation on these anomalies.

00:50:59.000 Thank you, Dr. Shiva.

00:51:00.000 Thank you very much.

00:51:02.000 All right.

00:51:03.000 Thank you so much.

00:51:04.000 And just also a note, it was interesting.

00:51:06.000 We had received a lot of Emails, affidavits, you name it, from people that actually worked at MTech and at the polls, and that they had told us that when it all started, what is it, 27 or 29 points of signature variegation, 27, thank you, that that's what you're supposed to do: 27 points of signature verification.

00:51:29.000 And at some point, it went to 20, it went to 10.

00:51:32.000 And towards the last few weeks, we were told that they were told, just stop checking signatures.

00:51:39.000 We've got to get this done.

00:51:41.000 So what he's showing us here does, in some sense, correlate with the things that people had told us.

00:51:47.000 So, for what it's worth.

00:51:48.000 Okay, let's go to Doug Logan, Cyber Ninjas.

00:51:52.000 You were going to give us your report.

00:51:55.000 And would you please give us just a tad of your background?

00:51:59.000 Sure.

00:51:59.000 So I'm Doug Logan.

00:52:00.000 I'm the CEO of Cyber Ninjas.

00:52:02.000 I have done cybersecurity work for a lot of major organizations, including Bank of America and JP Mark and Chase.

00:52:09.000 I've done a decent amount of work in the federal government as well.

00:52:12.000 I hold Certified Information Systems Security Professionals, or CISSP.

00:52:17.000 I also have GX Web Application Penetration Tester and GX Certified Incident Handler.

00:52:24.000 I am listed as I am actually an expert on the Antrim election case associate and have a report that's actually published associated with that.

00:52:33.000 It's publicly available from Matt DiPerno's website.

00:52:36.000 And I have, of course, been running this audit for the last roughly five months.

00:52:40.000 Mr. Loon, could you pull the mic or could you get a little bit closer to the mic, please?

00:52:46.000 Is that better?

00:52:47.000 Okay, awesome.

00:52:56.000 It's not clicking.

00:53:05.000 There we go.

00:53:08.000 So I just want to start with an overview of what we actually accomplished here because this is an audit like we've never had before.

00:53:15.000 And involved, as you mentioned earlier, Madam President, involved over 1,500 people.

00:53:21.000 And based on our calculations, it was actually more than 100,000 hours put in place.

00:53:26.000 As you can see up on the photo right now, this is an example.

00:53:28.000 This actually happened in the evening, one of the days.

00:53:31.000 So this isn't even a full group of everybody.

00:53:34.000 We're going to go through each role that was out there, what functions they were performing.

00:53:39.000 But you'll notice that everyone is located based on colors.

00:53:42.000 That helped us keep track of where people were and make sure no one was out of place and helped us make sure that we both secured and maintained custody of all the ballots at all times.

00:53:53.000 Custody of all the ballots at all times.

00:54:02.000 Over 1,500 people and like 100,000 hours.

00:54:08.000 Now, security was something that was extremely important with everything that we did here.

00:54:13.000 We had multiple layers of security.

00:54:15.000 We actually had an external perimeter that was maintained by the Arizona Rangers.

00:54:20.000 So as you came in, they would validate that you're on a list of individuals in order to be able to get in.

00:54:26.000 We also had an interior checks so that as you walked through the door, you came up to a desk where you were both checked for COVID and validated to be on the list, made sure you had a badge and all those things to make sure that you were someone that was supposed to be there to even be in the building.

00:54:44.000 All the ballots and election equipment were stored beside within these cages.

00:54:49.000 And anytime they ever left the cage, they were actually signed out by an individual.

00:54:53.000 So we have a complete signed record of every individual that came and picked up every box.

00:54:58.000 So someone took over custody of that box.

00:55:02.000 We actually had individuals called runners and they would run it from the ballot corral and they'd take it over to whatever table they need to go to.

00:55:10.000 And that individual would then sign the box over to the table manager at the table that would then utilize it to process it.

00:55:16.000 So at no time was a box of ballots or individual ballots outside of the care of someone's specific authorized care who has to sign off of it.

00:55:25.000 In fact, we actually had 24-7 video surveillance on everything at all times.

00:55:31.000 In addition, you'll see this lovely police officer.

00:55:35.000 They were actually there 24-7 as well, and they were always within sight of the ballot corrals or where we had the election equipment stored.

00:55:43.000 We had police officers at both locations, always maintaining and always making sure that the ballots and the equipment was 100% secure and that nothing could happen to them.

00:55:57.000 So this is one of our tallying tables.

00:55:59.000 What you can see in the middle is actually a lazy Susan.

00:56:02.000 You'll notice that there's three counters around the table.

00:56:05.000 There's someone who's actually at this table they're loading and someone who's unloading.

00:56:10.000 So all counters were Maricopa residents who specifically voted in the last election.

00:56:15.000 We wanted to make sure that if anyone was involved in this very important action, that they had skin in the game and they were local.

00:56:23.000 We didn't use anyone out of state for any functions having to do with the actual tallying of the ballots.

00:56:28.000 I should say actually tallying the ballots.

00:56:31.000 Some of the table managers were from out of state, but the people actually counting the ballots were all Maricopa residents.

00:56:36.000 There were other functions where we had volunteers from other states.

00:56:39.000 As much as possible, we tried to keep everybody local in Maricopa County.

00:56:44.000 We think it's very important for a local community to take ownership for their election process, and we wanted to facilitate that as much as possible.

00:56:52.000 All these individuals were background checked and validated.

00:56:57.000 We had one individual that had slipped through the process because he'd been on the ballot versus specifically that doesn't have something that shows up in standard background checks.

00:57:07.000 So we started doing additional checks, comparing everything on things to make sure that never happened again.

00:57:11.000 It was very important to us to make sure that we always had things that were going to make sure that were beyond reproach.

00:57:17.000 Transparency in everything we did was very, very important.

00:57:22.000 Now, all three counters were blind.

00:57:24.000 That means they were not allowed to talk to each other.

00:57:27.000 As that ballot went around and was in front of them, they would tally on a sheet of paper and they put a little mark based on whether for both the presidential and the senate race.

00:57:35.000 They'd put a mark to see whatever it was.

00:57:38.000 Roughly every 50 ballots, they would compare the numbers with each other.

00:57:43.000 Actually, the table manager took him to compare them.

00:57:44.000 And if two out of three of them agreed and the third person was no more than one count off for the race, they would proceed and they would move on.

00:57:54.000 If there was any more discrepancies beyond that, they actually had to stop.

00:57:58.000 They had to find the ballots in question.

00:58:00.000 That they're in question, they had to recount them.

00:58:03.000 So there was absolutely no way to have speed here without having accuracy.

00:58:08.000 And we found that when we had a brand new table, it was relatively slow.

00:58:13.000 But as soon as they'd been doing it for about two shifts or so, their speed greatly increased.

00:58:17.000 And it was amazing at how quickly they could count ballots.

00:58:20.000 In the very beginning of the process, in our first three weeks, our fastest, I think our most ballots we ever counted was roughly 30,000.

00:58:29.000 When we came back and had more of a full shop, I think at our peak we did over 150,000 ballots in a day and were routinely doing over 100,000.

00:58:37.000 So the speed, like I said, greatly increased, especially as we worked through this.

00:58:48.000 So the way the ballots would actually work is we had a ballot corral where the ballots were originally in.

00:58:56.000 They would be signed out of that ballot corral and they'd be taken to a tally table.

00:59:00.000 After they were tallied, they'd go back to a ballot corral, which was specific to being in progress.

00:59:05.000 And then when we had our paper examination tables, they were ready for a box of ballots.

00:59:09.000 That's where it came.

00:59:10.000 It came out of the in-progress.

00:59:12.000 So at the paper examination tables, we had DSLR cameras.

00:59:16.000 Those DSLR cameras took pictures on the front and the back of these ballots, and they gave us very high-definition images that allowed us to see all sorts of intricacies of the paper and what's going on.

00:59:29.000 After it was done with DSLR, actually excuse me, sir.

00:59:35.000 I'm sorry, the clicker's not working.

00:59:39.000 There we go.

00:59:42.000 Let's go back there really quick.

00:59:48.000 So once it went into the microscope stands, we had four microscopes that were taking images of the magnified image, and that was over a number of different places.

00:59:59.000 That included the presidential oval to take a look at how that was filled out.

01:00:03.000 And with the way we had the lights, we could actually see when it was filled out with a ballpoint pen, you could actually see the ridges of the person pressing down on it.

01:00:11.000 So you could tell the difference between something that was filled out with a Sharpie, you could tell something that was printed out by a pen, or you could tell actually if something was computer printed.

01:00:20.000 You could tell the difference between all of them.

01:00:21.000 We also had a microscope over certain parts of the ballot that would allow us to look at the paper fibers to help determine what type of paper was utilized.

01:00:30.000 Now, when we were done with this, we actually had over 140 terabytes of data just from the paper examination alone.

01:00:36.000 So we had massive amounts of data.

01:00:38.000 In fact, with our camera footage and everything that ran the operation, we ended up with close to two petabytes of data.

01:00:47.000 To give you a comparison, that is vastly more data that your average large thousand-person company has.

01:00:53.000 So we are running a very impressive network here that was completely air gapped, wasn't connected to anything outside of the floor in order to support this, in order to have all the data requirements associated with it.

01:01:05.000 It was a very complicated operation.

01:01:09.000 So just I want to give a high-level status of where we are right now.

01:01:13.000 So first of all, we've completed the hand counted of all federal races.

01:01:15.000 We've done all the image and microscope capture of all the ballots.

01:01:19.000 We've reviewed and did a comparison of the official results.

01:01:21.000 We've done analysis of the voter rolls.

01:01:23.000 We've done the vast majority of the analysis of the actual voting machines and voting equipment in progress right now.

01:01:31.000 We are hopeful to soon with the settlement that the Senate put together to be reviewing the splint logs and routers based on the settlement terms.

01:01:40.000 We're also hoping that the completion of the paper analysis that's being done will be done very shortly.

01:01:46.000 Now from a scope standpoint, stopped again.

01:01:54.000 So no longer in scope was the canvassing that was decided that was removed.

01:02:00.000 We have the tabula configuration to check internet configuration was something that was not provided.

01:02:05.000 We believe with the other information we have we'll be able to get similar data, but it will not be the same exact data.

01:02:12.000 We had requested to review the voter roll system, but a lot of the systems are used for checking in for the site book system were not provided as part of the equipment that was given us.

01:02:21.000 We had hoped to look at the review of the ICX devices, but again, those had not been provided.

01:02:26.000 We had wanted to look at the provisional ballots, the ones that had not been counted, to count the sealed envelopes to make sure they matched up with everything and made sense.

01:02:35.000 And those, again, were not provided.

01:02:37.000 And we'd also hoped to take a look at the undeliverable ballots to see how many of them were bounced back or what happened to them.

01:02:43.000 And again, those were not things that were provided.

01:02:46.000 And so there were things that are no longer in scope and we're not able to take a look at.

01:02:52.000 Okay, so now we'll get into the fun part and get more into the actual talliates and results.

01:02:57.000 In order to understand some of these findings, I want to make sure that everyone has a clear picture as to how this process works.

01:03:04.000 So, if we have ballots that are actually damaged or otherwise can't be run through the tabulators, for example, the Braille ballots won't fit through the tabulators, some of the Yukava ones are in formats that can't.

01:03:16.000 They need to go through what's called a duplication process. 0.93

01:03:19.000 Now, this is a different thing than what Dr. Shiva was talking about when he talked about duplicates.

01:03:24.000 When he talked about duplicates, he was talking about more than one envelope going to the same person.

01:03:29.000 So, we're going to talk about the word duplicates here, but we're actually talking about when there was an original ballot that couldn't be run through the scanner and they created a copy of it, which was run through the scanner and counted.

01:03:39.000 So, when you have duplicates, when you have the originals and you have the duplicates, only one of those counted, and it should only be the duplicates.

01:03:45.000 Now, specifically, the originals are often referred to as damage sent to duplication or DSD.

01:03:51.000 And we're going to use that notation throughout things: that DSD means the original ballots, whereas the actual duplicates are referred to as dupes.

01:04:00.000 So, there should be one DSD per dupe, and there should be a unique serial number on every single DSD in every single dupe to match them up.

01:04:09.000 So, that you will know for sure that this ballot right here was duplicated to this other ballot.

01:04:15.000 And if you want to compare and make sure the duplication process was done correctly and that it actually represented the voter intent, you'd be able to easily match them up, and it'd be easier to handle from an audit standpoint.

01:04:27.000 Duplicate ballots also should be stored separately from the original ballots so there's not confusion, they don't get mixed up.

01:04:33.000 So, let's talk a little bit about those findings.

01:04:36.000 So, our duplicate ballots were commingled with the original ballots, not all of them.

01:04:40.000 They were in at least one box case, which is something that they are not supposed to do according to the EPM.

01:04:46.000 Duplicate ballots had incorrect and missing serial numbers.

01:04:49.000 If you take a look at this table that's showing up, you'll notice that the serial number on the left is what was actually on the ballot, for the duplicate ballot, and the serial number, the board one, hand dupe on the right is what was actually on the original damage.

01:05:09.000 You'll notice the numbers are actually different.

01:05:11.000 On the left-hand side, this is dupe board three, hand zero, two, one, fourteen.

01:05:16.000 On the right, it has board one, hand dupe 214.

01:05:19.000 We were able to match these up because of the ballot characteristics and the precinct that it came from, but it's a very painful process, and it has to be done manually in order to figure out what matches to what else when they're not actually stamped with the same exact serial number on them.

01:05:36.000 We also had a number of serial numbers that were printed like this one that you see on the screen, where you can't really read it, it's not legible, so it theoretically has a serial number on it, but there's no way to match it up because you cannot read what the value is on it.

01:05:51.000 In addition to having ballots that flat out did not have a serial number anywhere on there whatsoever, so there was no way to match them up with originals.

01:06:02.000 Now, we also had duplicate ballots that reuse serial numbers.

01:06:06.000 You would expect that a serial number in order to match it up would not be unique, but you'll notice there's two examples up here of two different pairs that are not associated with each other, but had the same exact serial number utilized.

01:06:18.000 In this case, I believe we've got a large print and a damaged standard damage ballot.

01:06:23.000 We also have a few others in here again.

01:06:25.000 Same exact serial number, but these were not the same ballots.

01:06:29.000 And specifically, if you ever take a look at a large print ballot, they're huge.

01:06:33.000 They're very, very large.

01:06:34.000 So, it's not just that something was photocopied or anything like that.

01:06:38.000 They literally use the same serial number on otherwise unrelated ballots.

01:06:44.000 And this is probably one of the more interesting parts: is that we had more duplicates than original ballots.

01:06:49.000 So according to our counts from our audit, we had 26,965 original ballots, and then we had 29,557 that were duplicate ballots, and those numbers should be the same.

01:07:03.000 Based on the numbers received from Maricopa County, we should have had 27,869 of both originals and duplicates, and they should have matched up perfectly.

01:07:17.000 Now, these extra duplicates did appear to favor Trump and Jorgensen.

01:07:23.000 If you take a look at the original ballots, we've got Trump has 995, 404.

01:07:31.000 And if you take a look at the duplicates, there's some number of more of them.

01:07:36.000 So if you take a look at the percentage all the way over to the right, the expected percentage per candidate, and that's based on if we take the originals and assume the duplicates should be at the same exact percentage.

01:07:46.000 So we had 48% of the originals were Trump, 50% of the originals were Biden, and 2% of the originals were Jorgensen.

01:07:58.000 You can see what they actually have at the difference.

01:08:00.000 In reality, Trump had 58% of the duplicates, 33% and 3.

01:08:03.000 So both Trump and Jorgensen gained slightly with the duplicate process.

01:08:10.000 Same thing, when we take a look at the Senate race, it favors slightly to McSally, not necessarily as much as it does in the other case.

01:08:20.000 Both of these percentages are within the realm of error, of just human error making mistakes.

01:08:26.000 So if we take a look at our final tally of results and we look at the Senate race, it does look like Kelly still shows up as a head. 0.86

01:08:39.000 And we actually run into that we have 541 less for McSally and 60 less for Kelly in the ballot totals.

01:08:48.000 If we take a look at the presidential race, Trump actually loses 261 votes from the official votes.

01:08:54.000 Biden gains 99 and Jorgensen loses 204 votes.

01:09:00.000 And again, these are all very small numbers when we're talking about 2.1 million ballots.

01:09:06.000 These are very small discrepancies.

01:09:08.000 So we can say that the ballots that were provided to us to count in the Coliseum very accurately correlate with the official Canvas numbers that came through.

01:09:24.000 So we did have at least a batch of 50 ballots that was run through the tabulators twice.

01:09:29.000 This is specifically when they took the Dominion tabulators.

01:09:32.000 They had the same batch and it was run through more than one time.

01:09:35.000 We found this because through our various counts, we had very clear confirmations of how many ballots were supposed to be in a box.

01:09:43.000 And when we compared our results against the cast vote records, we were roughly 50 off and that made us go take a look at the Dominion images.

01:09:51.000 And when we compared it to nearby ballots, we actually found that there was a set of 50 ballots that had been run through, again, twice.

01:10:00.000 As far as we could tell, with it only happened in once, there's no indication as to whether that, you know, we have no clear indication whether it was human error or whether it was intentional.

01:10:09.000 We assume that's human error because it happened in very small frequency.

01:10:12.000 This is an example of a ballot from two different batches.

01:10:15.000 It's probably relatively small text for people to read, but if you read all the way down in the bottom, it'll tell you that it's tabulator on the left-hand picture tabulator 6,004, BTC, which is the batch 288, and that's the image 154.

01:10:29.000 And then the right-hand side, we have, again, same tabulator, but batch number 287, which is one different, and it's image number five.

01:10:37.000 And we had roughly 50 of them that were in between the two of these.

01:10:42.000 We found something similar from the Yukava where the Yukava, for those of you who don't know Yu Akava ballots are for military and overseas personnel, it's the way that they can actually cast votes even though they're not physically here.

01:10:54.000 Those ballots get turned in either via an online portal, they can be submitted via email, they can be mailed in.

01:11:01.000 I think they can fax them in.

01:11:03.000 There's a whole bunch of different ways these can come in.

01:11:05.000 As a result, they're in a lot of different formats and there's a lot of variance among them.

01:11:10.000 But on the left-hand picture, you can actually see that it's board number two.

01:11:14.000 HandDupe 573 is what approved it.

01:11:16.000 On the right-hand side, it's HandDupe 574.

01:11:20.000 And it's probably too small for you to read.

01:11:22.000 But if you read the serial number circled on the top left, you'll notice that the time stamp and the serial numbers are exactly the same, which means that someone likely printed out the Yuakava ballot twice and both of them made it into the Saints.

01:11:36.000 We did not find this in a lot of quantities, but the only way we had to look at it was by hand.

01:11:44.000 And there's over 10,000 Yuakava ballots.

01:11:47.000 Because every single one of these Yukava ballots is slightly different form, it's actually even difficult to do it in an automated fashion.

01:11:53.000 The only good way would be to go through by hand without some sophisticated processing. 0.98

01:12:02.000 Okay, so we're going to talk a little bit about the official results that are actually turned out by the county.

01:12:08.000 And this actually connects quite a bit with some of the stuff that Dr. Shaba was talking about.

01:12:13.000 So from a definition standpoint, we have the official canvas.

01:12:16.000 The official canvas is the official certified results that are put out by the county.

01:12:20.000 It has the tallies of votes per candidate, per precinct, and provisional.

01:12:24.000 It tells what the turnout was for a given precinct and all of that information.

01:12:31.000 We also have what's called here in Maricopa County, they call it the VM55 file or the final voted file.

01:12:36.000 It is a list of every single person that showed up to vote.

01:12:40.000 And that's counted both for in-person, whether it's early voting in person or whether it's mail-in, and all of those are kept track of separately.

01:12:47.000 So we have a number of all those different categories of who showed up to vote on any given day.

01:12:55.000 We then have the VM34 full voter file.

01:12:59.000 This is also referred to as your voter rolls.

01:13:02.000 This is a list of everybody who should be eligible to vote.

01:13:05.000 And the county in Maricopa seems to make these available roughly on a monthly basis so that the full voter rolls.

01:13:12.000 So that is your theoretical full list of everyone that may be able to, you know, may show up to vote at a given election.

01:13:20.000 Then we have our EV32 files or EV32 early voting sense.

01:13:24.000 Every single time a mail-in ballot is sent, it's supposed to have an entry in an EV32 file that corresponds with that mail-in ballot that's sent out.

01:13:33.000 Likewise, we have an EV33 file, which is when any type of early vote is returned.

01:13:39.000 Now, this both includes when a mail-in ballot is received and an in-person when someone comes and votes in person.

01:13:47.000 EV33 includes both of those.

01:13:49.000 You may remember at the hearing that we had a while ago, we had mentioned that the EV32s do not match the EV33s.

01:13:57.000 We were doing a quick analysis in order to justify canvassing, and there were 74,000 that were off.

01:14:04.000 The vast majority of those 74,000 were from early voting in person, and that is why there was not an EV32 associated with it.

01:14:12.000 We have this clarified in a report as well.

01:14:14.000 That was not a purposeful discrepancy.

01:14:17.000 It was just something that was not immediately clear at that point.

01:14:24.000 So just to give an example and how these systems work in order to match everything up.

01:14:28.000 So if we have 10 people who mailed in a ballot, and we had 10 people who voted early in person, and we had 10 people voted on election day in person, we have 30 votes that are out there.

01:14:39.000 So what this means is we should have the official canvas with 30 votes and it should be allocated per precinct accordingly.

01:14:47.000 It should be allocated.

01:14:49.000 It should be allocated based on the candidates and you should have your official tallies associated with it.

01:14:54.000 You would also expect that if you went to your VM55 file, you should see 10 people who voted via mail-in because it has different codes based on that.

01:15:02.000 You should have 10 people who vote in early in person and 10 people who vote in election day.

01:15:07.000 And every single one of those entries should have the name and address associated with the person that matches up with their voter rolls.

01:15:13.000 Likewise, you would expect that your EV32 would only have 10 ballots mailed in it because that was what was sent out.

01:15:20.000 And your EV33 should have 10 people in it from the mail-in ballots and 10 people from the actual EV in person for a total of 20.

01:15:29.000 This is what you would expect in a balanced system.

01:15:33.000 This is not actually what we found when we started comparing all these numbers.

01:15:36.000 All these numbers were different in very different ways and it's something that creates quite a few discrepancies.

01:15:43.000 So none of these systems actually balanced.

01:15:45.000 We're going to go through these.

01:15:47.000 So our official canvas has 3,432 more ballots cast than the list of people who show as having cast a vote in the VM55 file.

01:15:55.000 Now I do want to specifically interject in here that we finally heard back from Maricopa County because we asked them about this discrepancy.

01:16:04.000 I think it was at least a week ago, but it was a couple weeks ago.

01:16:06.000 So the day before we were presented our results, they decided to tell us that those were actually for the protected voters who don't actually, you know, who are either judges or battered women or other individuals who are concerned about publishing their addresses, that that is the reason why that discrepancy is in there.

01:16:26.000 I can't validate whether that's accurate or not accurate.

01:16:30.000 This is information that we just received.

01:16:34.000 What I can say is that this sort of stuff is exactly why with audits, usually the organization you're in the process of auditing cooperates and works with you.

01:16:44.000 And that would have been, you know, these would have been extremely helpful in order to get feedback and work through them through this entire process.

01:16:55.000 Now we do have 9,041 mail-in voters shown return ballots, more return ballots in EV33 than they were sent in EV32.

01:17:03.000 Sounds like Dr. Shiva found something very similar to this as well.

01:17:06.000 So specifically we found they were mailed one ballot, but somehow two ballots were received, which I do not know how you would have one ballot sent and two received.

01:17:17.000 The assumption would have to be that it's a clerical error or there's something else going on.

01:17:21.000 It's not clear how you can have that happen.

01:17:25.000 277 printings show an official canvas as having more ballots cast than people showed up to vote for a total of 1,551 excess votes.

01:17:35.000 Again, the county has explained to us that the same reason for the VM55 difference they're saying is a reason there.

01:17:41.000 We have not had a chance to validate that.

01:17:44.000 There are 2,472 ballots shown in EV33 that don't have a correspondent entries in the VM55 and only 2,042 ballots show as rejected in the official canvas for a discrepancy of 430.

01:17:56.000 So let's walk through this really quickly.

01:17:59.000 So if something is in the EV33, that means that an early vote was received.

01:18:06.000 And we have the individual's name and the voter ID associated with it.

01:18:09.000 So if an EV33 was received, you would expect that if it's not in the VM55 file of who voted, then it had to be a rejected ballot.

01:18:19.000 Just makes logical sense.

01:18:20.000 It has to be a rejected ballot.

01:18:21.000 But there's 2,472 that show in the EV33, but there's only 2,000, sorry, there's only 2,042 ballots that show as rejected.

01:18:32.000 So there's a discrepancy of 430.

01:18:34.000 Again, just another place where these show that they don't seem to match up.

01:18:39.000 We also have 397 mail-in ballots show as received that were never shown as sent.

01:18:46.000 So we know that they are in the VM55, they're mail-in ballots, and they were received without somehow ever being sent a ballot.

01:18:56.000 Now we also have 255,326 early votes shown in the VM55 that do not have a corresponding entry in the EV33.

01:19:06.000 And just to be clear, this is not You know, when you were looking at EV33 entries, EV33 entries are supposed to happen when a ballot is received, but it's not, you know, the actual tracking of the ballots are under the actual official canvas or the VM55.

01:19:23.000 So we had in the VM55 individuals who voted, we had entries for early voting that were in there, where in 255,000 cases of those, they were not actually included in the EV33 file.

01:19:39.000 In reality, all of these, you know, all these systems, to be audible and to be verifiable, all these systems should be able to be in agreement with each other.

01:19:49.000 And even if we have protected voters, there should be some way to know the number of protected voters who voted in order to match it all up so that you have a system that balances.

01:20:01.000 Voters who removed.

01:20:04.000 So we took a look at the entire list of individuals who voted, and specifically that was from the VM55 final voted file.

01:20:13.000 And we ran it through a commercial database called put out by Melissa called Personator.

01:20:18.000 And Personator is a best-in-class identity system that helps check addresses and make sure they're associated with the user.

01:20:24.000 It'll show prior and current addresses.

01:20:26.000 It'll track move dates.

01:20:27.000 And it'll also track date of birth and date of deaths.

01:20:31.000 So we went and took the voter rolls and we compared them against this to see how many people might have moved and based on statute should not have necessarily cast a vote.

01:20:43.000 So the first thing we found is that 23,344 voters who voted via mail-in ballots, even though they showed in Melissa as having moved from that address.

01:20:54.000 And we wanted to make sure we accounted for the circumstances where a college student might have moved away from home or a family member might have moved somewhere else.

01:21:01.000 So we actually eliminated all the chances, all the cases where someone was still at that residence that had the same last name.

01:21:08.000 And that's how we came up with 23,344.

01:21:11.000 So if your mail-in ballot is sent to an address that you no longer live at, there should be no way for you to receive that mail-in ballot.

01:21:19.000 At least it's generally not accepted a way for you to receive that mail ballot because mail-in ballots are legally not allowed to be forwarded.

01:21:25.000 So it can't be forwarded to your new address.

01:21:27.000 So the only way this situation could happen legally is if you know the prior, if you know the current resident and you're able to meet with them and pick up your mail-in ballot or somehow have some other arrangement to pick up your ballots were there.

01:21:38.000 But still, 23,344 people voted when they should no longer have access, would not normally have access at that given address.

01:21:49.000 We had 2,382 voters who voted in person, even though they showed Melissa as having moved out of Maricopa County prior to that date.

01:21:59.000 We have 2,081 voters who moved out of state in the 29 days before the election and appeared to be given a full ballot, which should have been, if anything, if they voted at all, it should have been a president-only ballot, where literally the only option on the ballot would have been president.

01:22:16.000 That is something that is by Arizona statute.

01:22:21.000 Let's talk a little bit about the voter rolls.

01:22:25.000 So registration dates do not generally change in your voter rolls.

01:22:30.000 So this is your day of registration unless it's to correct a mistake.

01:22:34.000 And this is something that we received out of the actual recorder's office.

01:22:39.000 They told us that those dates should not generally be changing.

01:22:41.000 Your date of registration should be your data registration.

01:22:46.000 And it says there at the end, the only time a voter may have two dates of registration is if the registration has previously been canceled and the voter registers again.

01:22:53.000 The original record would be canceled for vital reasons, and then they'll have a new record with a new date of registration.

01:22:59.000 So the old record should not exist and it should not have a data registration change.

01:23:05.000 Likewise, we have this thing called AFSEQ.

01:23:07.000 And AFSEQ is actually a unique identifier that is a reference to a transaction.

01:23:14.000 So for example, if you went and you needed to change your address, you would fill out a form.

01:23:21.000 And when you filled out that form, you would turn it into the recorder's office and they would image that and they would process it.

01:23:27.000 And when they processed it, they would assign it a unique identifier.

01:23:31.000 That unique identifier actually gets stored in your voter rolls as the latest one, and it is specific to that change that change request.

01:23:39.000 So those should be unique.

01:23:41.000 You should not even have it twice in your voter rolls.

01:23:43.000 It should only happen once, and it should not be shared among multiple individuals.

01:23:52.000 And this is something again we confirmed with the recorder's office.

01:23:59.000 Now, we also have a statute that says complete names should be used, and that'll get into our findings that we have here in a second.

01:24:07.000 So we had as many as 5,047 individuals who voted in more than one county for up to 5,295 additional votes if these are duplicates.

01:24:18.000 Now, I will tell you that these individuals had the same name, first, middle, and last name, and the same exact birth year, because that's what's in the voter rolls.

01:24:30.000 But if you have an extremely common last name, which can happen, there's some of these may, in fact, just be individuals with the same exact name, same exact birth year.

01:24:40.000 We have no way to validate that 100%.

01:24:43.000 We had 393 voters with incomplete names that voted in the election.

01:24:47.000 This included individuals with last name only.

01:24:49.000 Last name is just an initial.

01:24:51.000 There's no last name, or first name is just an initial.

01:24:54.000 And again, there are some individuals who, in some cases, this could happen, but this is not a frequent thing that you typically see.

01:25:01.000 We also had 198 individuals who registered after the October 15th cutoff and yet still voted in the election.

01:25:10.000 And we had 2,861 voters who have shared an AFSIQ number with another voter at some point in time.

01:25:16.000 And that does not, we don't know exactly what that means, but based on the descriptions of everything that's happened in the system, it suggests there may be some integrity issues with the data.

01:25:28.000 When an impossible situation is happening in a system, and if you've got integrity systems in something as important as the voter rolls, there would be a concern.

01:25:38.000 We have 282 potentially deceased voters in this election.

01:25:43.000 I know that there's been some much wider numbers that have been circulated on the internet.

01:25:47.000 We tried to validate this stuff very, very precisely.

01:25:51.000 It can be a difficult thing to match up voter rolls to individuals.

01:25:55.000 From our testing, we believe that all the ones we have in here are accurate, but there are potentially additional ones as well.

01:26:02.000 We have 186 people who potentially have duplicate voter IDs that both voted.

01:26:07.000 I think that Dr. Shiva was mentioning that we haven't had individuals with the same first name, last name, and the same address and seem to have the same signature.

01:26:16.000 That is something that we have also seen in the voter rolls with people who seem to have literally the same exact name.

01:26:23.000 We have 186 people.

01:26:25.000 That's the case where they actually, the first name and last name, and the address, you know, all match up and year of birth.

01:26:31.000 Because the assumption would be you might have a junior in a different place, and so they'd have a different day of birth associated with it, but not the same address.

01:26:39.000 And that is the end of the presentation for right now.

01:26:42.000 With that, I'm going to hand it off to Ben Cotton, who's going to go over our digital findings.

01:26:47.000 Thank you, Mr. Cotton.

01:26:49.000 When you start, could you just give us a little bit of your background?

01:26:53.000 I have 25 plus years of doing digital forensics, incident response, and examinations in support of both government, government, and as part of my service.

01:27:12.000 Prior to my digital forensics background for the last 25 years, I also served 21 years as a tab-qualified special forces soldier serving this country and defending our freedoms.

01:27:31.000 I recognize how critically important the voter integrity is to this nation.

01:27:39.000 And this, again, Madam President, I agree with you.

01:27:43.000 This is not a left issue.

01:27:44.000 This is not a right issue.

01:27:45.000 This is an American issue.

01:27:47.000 And as I talk about this, you know, I would hope that the findings of this audit will be turned into actionable, legislative, meaningful product that we can move forward and secure these elections moving forward.

01:28:09.000 So, as I talk today, people may have heard some of my previous testimony.

01:28:17.000 We had a few of these will be redundant, but it's important to reiterate these findings in the course of this.

01:28:28.000 We had a few of these will be redundant, but it's important to reiterate these findings in the course of this final hearing.

01:28:40.000 So, we'll talk about the withheld devices and data and how that impacted our ability to provide a complete report to the Senate here today.

01:28:50.000 We'll talk about the cybersecurity issues that we have found, the hardware configuration control issues, atypical anonymous logins that are present on the systems, the listening ports and attempted connections on boot up, and internet connections and internet history that was found on these devices as part of the part of the course.

01:29:12.000 Next slide, please.

01:29:20.000 So, let's talk about the withheld devices for a moment here.

01:29:26.000 As with any audit, access to information and the right information in a timely manner is absolutely critical to finding a complete result for an investigation.

01:29:39.000 In the case of this audit, we were never provided access to the routers and network-related data, and that becomes very impactful when we start talking about validating and confirming unauthorized accesses to the election management system itself and to the other devices.

01:29:59.000 I would like to sit here today and tell you that I had fully ruled out any unauthorized access, but given the lack of access to this information, I cannot do that at this time.

01:30:11.000 It is our understanding that there has been an agreement reached with Maricopa County, and I look forward to getting access to this data so that we can complete these findings.

01:30:22.000 We were not provided the poll worker laptops.

01:30:24.000 Now these are the laptops that poll workers use at each precinct to validate the voters and to interact with election related functions at that particular precinct.

01:30:38.000 We were not provided any of the ICX devices.

01:30:42.000 So the ICX devices are used for handicapped and other graphically required interfaces with the voting systems.

01:30:53.000 We know that the county had a number of these based on the historical video from the MTech, but we were not provided any of those.

01:31:03.000 We were not provided with the ICP credentials to validate the configuration settings or the administrative settings on the actual scanners, the ICPs.

01:31:17.000 This was critical and a significant shortfinding in that I cannot sit here today and tell you whether or not the wireless modems were enabled and connected to the internet at the time of the vote.

01:31:31.000 And I cannot sit here and tell you today what the status was of the LAN connections that we know were inherent to those devices as part of the purchase from or the lease from Dominion.

01:31:47.000 Okay, let's go a little deeper into the cybersecurity issues as we found them.

01:31:57.000 Actually, you've skipped a slide.

01:31:59.000 Or no, I'm sorry.

01:32:01.000 So let's talk about the go back one slide, please.

01:32:07.000 Let's talk about the cybersecurity issues.

01:32:09.000 Now, the Department of Homeland Security has a division called CESA.

01:32:14.000 And CESA has a recommendation that's published on the internet for how to configure and manage election systems that is freely available and it's recognized as kind of the gold standard for securing an election system.

01:32:34.000 I will tell you that every item up here is part of that recommendation from CESA.

01:32:44.000 I will tell you that in Maricopa County, they failed to perform basic operating system patch management functions.

01:32:53.000 Now let me explain that for a bit.

01:32:55.000 So if you have a home computer, you realize that every Thursday or Wednesday, depending on your cycle, Microsoft will release a security patch to correct vulnerabilities that have been discovered since they released the operating system and it was installed on your computer.

01:33:14.000 The last time that the operating system was patched on the Maricopa County election systems was the date that they installed the Dominion software, which was the 6th of August of 2019.

01:33:30.000 So at the time of election, it had been over a year since that system had been patched.

01:33:36.000 We found that that was also the same case with the antivirus definitions.

01:33:42.000 So we know as part of this world that we live in, that people are coming up with new ways to hack a system, to exploit vulnerabilities and get unauthorized access to the systems.

01:33:55.000 And they're doing this continually.

01:33:58.000 All major security vendors update their antivirus at least on a weekly basis to make sure that we can protect our systems from these newly originated vulnerabilities and exploits.

01:34:14.000 The last time that the antivirus had been updated on the Maricopa County systems was the 6th of August 2019.

01:34:26.000 Now, Maricopa County did release a statement saying that if they had patched the operating system or if they had updated the antivirus, that would have invalidated the EAC certification for the voting system itself.

01:34:46.000 Obviously, there are a couple of issues with this position.

01:34:53.000 And the first one is that we are relying on a certification system that would impose obsolescence instead of security in the very act of trying to secure a voting system.

01:35:09.000 That is nonsensical and it should never occur.

01:35:13.000 So, if that is in fact the case, we need to take a very close look at what we're relying on to validate and certify these election systems and software to ensure that we're not certifying guaranteed obsolescence of the system.

01:35:33.000 Now, let's assume for a moment that what Maricopa County said was true, that they could not update those systems because of this certification issue.

01:35:45.000 There are a couple of problems with that, as borne out by the artifacts on the actual EMS server itself.

01:35:54.000 So, if that is true, then that would mean that no new executable files, no new dynamic link libraries could be created or modified on that system after the date of the software installation, which once again was 6 August 2019.

01:36:14.000 What we found is that there are four executable files that were created after this date of Dominion install.

01:36:23.000 There were 45 executable files that were modified after this date of install.

01:36:30.000 There were 377 dynamic link library files which were created after the Dominion software install.

01:36:39.000 And there were 1,053 DLL files that were modified after this date.

01:36:47.000 So, if we assume that what the county represented is true, then in fact, that voting system would not have been certified at the time of the election.

01:37:01.000 Let's talk a little bit about log management here.

01:37:04.000 So, there is a federal statute that requires the preservation of election-related materials for 22 months after the date of the election.

01:37:16.000 That applies not only to paper, but that also applies to digital artifacts.

01:37:24.000 Maricopa County failed to preserve the operating system security logs to cover the dates of the election.

01:37:35.000 They provided security logs early in the audit process, but they did not provide the Windows security lock itself.

01:37:45.000 When we examined the EMS server, we found that the dates covered by the security log only went back as far as the 5th of February 2021.

01:38:02.000 Now there's a couple reasons for that and we'll go into those later, but the bottom line is that they failed to preserve those logs, or at least those logs were not turned over to the auditors.

01:38:16.000 And so I'm assuming, since they were part of the subpoena, that those should have been provided had they been present.

01:38:27.000 Next item there is credential management.

01:38:30.000 This is probably the most offensive item on this list to me because it carries such a huge impact on the securability of a system.

01:38:45.000 What we found is that for the election management system, the adjudication systems, the ICCs, and all of the voting-related systems, they all shared a common password for both user accounts and for administrative accounts.

01:39:04.000 And just to be crystal clear, it was the same password for all those accounts.

01:39:10.000 So to complicate matters as well, those accounts had not been changed since the installation of the software.

01:39:21.000 So they were established on the 6th of August 2019 and never changed.

01:39:29.000 There furthermore was not an individual accountability of the users who access specific accounts so that you could tie a username, an action, and an individual when you discovered something that was an anomaly.

01:39:50.000 We did not see any software or any effort to establish and monitor a host baseline of programs and processes.

01:40:01.000 Furthermore, we did not see any log aggregation or methodology by which to establish and monitor the network communications for this system.

01:40:13.000 There simply was none of that software present on any of these devices.

01:40:18.000 Next slide, please.

01:40:23.000 We also saw and detected that there was a failure in hardware configuration within the voting system.

01:40:32.000 Now what you're seeing right here is the system, the acquisition photos for the system that was identified as the adjudication 2 workstation.

01:40:44.000 Now you will see in that picture that there are two hard drives that came out of that system.

01:40:50.000 It's not uncommon to have two hard drives in a system for data storage, et cetera, et cetera.

01:40:55.000 However, both of those hard drives are bootable.

01:41:03.000 So what that means is that you can boot from a hard drive that is not part of the election configuration and have access to the election network.

01:41:16.000 Very important.

01:41:19.000 It's clearly not an approved configuration.

01:41:22.000 It was the only system that we found a dual boot situation.

01:41:29.000 Now to further complicate matters a little bit, and I'm not going to make judgment as to the legality of this or whether or not this deserves further action, is that on that second bootable hard drive, there appeared to be non-Maricopa County data.

01:41:48.000 So let me define that a little bit.

01:41:51.000 With on that hard drive, there were Dominion databases that appeared to be one demonstration data, but also data that may have originated from Washington state and South Carolina.

01:42:06.000 And I derived that not from an in-depth investigation of the data that was outside my scope, but from the naming conventions of the databases themselves.

01:42:17.000 Okay, so once again, validating and approving the configuration of these systems is critically important to preserving the integrity of that election system.

01:42:32.000 I would also note that neither of the two audit Next slide.

01:43:01.000 One of the challenges that we had was actually the accountability of deleted items.

01:43:06.000 We'd talked about deleted items before, but let's be crystal clear about this.

01:43:14.000 From the EMS, which is the election management system server, on the C drive, there were 865 directories and 85,673 election-related files deleted between 1028 and 1105.

01:43:36.000 And they also included some log files.

01:44:03.000 So So what is difficult to determine is that I know they were deleted.

01:44:09.000 What I don't have is any accountability or any ability to track from an evidence management perspective how those deleted files were treated and what happened to them if they were archived or not.

01:44:41.000 There are a.dvd file, and those are actually the results of the election totals off of each tabulating device.

01:44:52.000 And those were part of the deleted files that were removed from the EMS.

01:44:59.000 So the EMS actually had two hard drives.

01:45:04.000 Well, they had six hard drives configured into two logical drives.

01:45:08.000 So the second logical drive was called.

01:45:15.000 So the second logical drive was called the D drive, and that contained all of the election database both historically and should have contained the information for this 2020 general election as well.

01:45:35.000 You'll note that there were 9,571 directories and 1,064,746 election-related files deleted between the 1st of November 2019.

01:45:48.000 On the HyPro 1, there were 304 directories containing 59,387 files of election data that were deleted from the HyPro scanner 1 on 3 March 2021.

01:46:02.000 Now, this becomes kind of important because part of our analysis was to look at the interaction of these scanners, these systems, and how data flowed.

01:46:13.000 You'll notice that that's about a month and a half before they turned that over to us.

01:46:18.000 Next slide.

01:46:21.000 You see a significant amount of deletion on HyPro 3 on that same date.

01:46:28.000 1,061 directories, 196,463 files containing election data deleted on that particular date on 3 March as well.

01:46:41.000 Next slide.

01:46:43.000 And on HyPro 4, you see the same high volume of deletions on the 3rd of March.

01:46:51.000 Now, once again, this may be part of a normal process with how they handle votes, but the timing of this becomes a bit suspect, as well as the fact that we didn't see these deletions on HyPro number two.

01:47:12.000 And once again, I don't have a chain of custody for what happened to these votes after they were deleted.

01:47:21.000 It may be a plausible explanation.

01:47:23.000 I simply don't know at this point.

01:47:26.000 Okay, next slide.

01:47:29.000 Let's talk about the failure to preserve the operating system logs.

01:47:32.000 As I explained earlier, the earliest timeframe that was covered by the EMS logs, security logs, was 5 February 2021.

01:47:44.000 That clearly does not cover the election time period.

01:47:49.000 Now, there's a very good reason why it didn't.

01:47:51.000 And if you go down to that last bullet there, you'll see there were three discussions.

01:47:59.000 Last bullet there.

01:48:01.000 You'll see there were three discussions.

01:48:13.000 There's a user-defined setting that you can define how much quantity of logs are retained before they get overwritten.

01:48:25.000 In this particular case, the EMS security log setting was set to 20 megabytes of data.

01:48:33.000 So the Windows operating system will preserve all the security logged entries up until the point at which it reaches 20 megabytes of data.

01:48:46.000 At that point, it starts following a first-in, last out approach to log retention.

01:48:53.000 So as you create a new entry, an older entry is deleted and overwritten inside of that log file.

01:49:03.000 Now, first and foremost, we need to remember that we do have that 22-minute month federal mandate.

01:49:12.000 So it's clear that at least what existed on the EMS when we received it as part of this audit, we did not have the time period covered by that federal mandate as it was supposed to be covered.

01:49:26.000 That security log was not turned over as part of any other documents that we have by Maricopa County.

01:49:34.000 So I'm going to assume at this point that it's not available for us to look at or else they would have turned that over to us.

01:49:44.000 Now, if you look at that last bullet, that first in, first out approach all of a sudden becomes readily apparent as to what happened on these distinct dates.

01:49:56.000 So, on each of these dates, an individual executed a script, and that script repeatedly looked for a blank password for all of the accounts on the system.

01:50:11.000 Depending on the system, there were only about 16 accounts that were present on a given system.

01:50:19.000 Okay, so this script was run multiple times on 211.

01:50:27.000 462 log entries were overwritten by this script.

01:50:32.000 On the 3rd of March, 37,686 log entries were overwritten by this same script.

01:50:42.000 On the 12th, which is the day before we received the system, there were 330 log entries overwritten by that script.

01:50:55.000 Now, the challenge here is that I know that this occurred.

01:51:00.000 I know which account did it.

01:51:03.000 It was the EMS admin account.

01:51:07.000 If you reflect back to what I just said about the lack of accountability of assigning that username to an individual, it now becomes extremely difficult to prove who did it.

01:51:24.000 Now, luckily, we happen to have some historical data from the MTAC video feeds.

01:51:32.000 And so, we leverage that data to backtrack and align these times.

01:51:36.000 And we have captured screenshots of Maricopa County people at the keyboards during those time periods.

01:51:53.000 Now, we've identified those individuals, but we will not release their names because we understand what the scrutiny is and what the impacts would be to those individuals.

01:52:07.000 But I just want to tell you that the very point that they did not have EMS.

01:52:18.000 Now, remember the lack of log retention at this point.

01:52:23.000 We could not find any logged entry that corresponded to this activity from the security logs.

01:52:37.000 Those Windows security logs only went back to the fifth, but everything was purged on the context of the election to be audited.

01:52:51.000 But that clearly was not the case in this instance.

01:52:55.000 So, just to clarify, so this is a log file specifically from report tally and sorry, results tallying and reporting, which is the Dominion software.

01:53:06.000 That entry says that someone went into the program and clicked on something that said, I want to purge all the results for this election.

01:53:14.000 That goes through and that deletes all of the rest.

01:53:22.000 We have redacted specific elements to include the host name and the IP address and some of those types of things.

01:53:34.000 But the fact of the matter is that those items are recorded as part of that normal anonymous log activity.

01:53:43.000 You will have the host name that logged into it.

01:53:46.000 You will have the IP address that originated the request.

01:53:50.000 In most cases, you'll have the username as anonymous.

01:53:55.000 But that username is then validated against the access control lists and the user authentication mechanisms and validated.

01:54:06.000 So the very next log entry in a normal anonymous activity is a validation of that user's credentials to access that particular device or process or whatever they were accessing.

01:54:24.000 What you see on the left is something that we discovered in the logs, which is what I call a typical anonymous login.

01:54:33.000 You will notice that none of those items that are captured by normal activity are present in this log.

01:54:43.000 You don't have an IP address of the originating device.

01:54:47.000 You don't have a host name of the originating device.

01:54:51.000 And furthermore, when I look at these in context of the actual security log itself, there is no validation of a user's credentials immediately following this.

01:55:05.000 There are hundreds of these types of anonymous logins in the security logs that we do have.

01:55:13.000 I cannot tell you at this point if the same type or pattern of activity occurred during the election cycle because these logs don't exist that cover the election.

01:55:29.000 But I can tell you that without access to that router data and the network data, I cannot validate whether or not these were legitimate accesses.

01:55:41.000 You'll notice that it is a login type 3, so it was a remote access.

01:55:47.000 I cannot tell if this is a legitimate access or an unauthorized access at this time.

01:55:54.000 Next slide, please.

01:55:59.000 So we also took a look at what happened when the EMS was booted up.

01:56:06.000 And let me walk through the methodology here to kind of assuage everybody's concerns.

01:56:13.000 So when we actually imaged all these processes and these systems, by the way, we imaged 770 devices and we gathered over 114 terabytes of original forensics data.

01:56:31.000 And we preserved that in a forensics image file that I could then leverage without fear of modifying or changing anything on the original device.

01:56:46.000 So we took that image file and we turned that into a virtual machine.

01:56:51.000 I created a enclave that I could boot that virtual machine up into and that I could then monitor the boot processes without connecting to the internet, without exposing any voter data to unauthorized users.

01:57:07.000 And I actually booted up the EMS to see what happened, what it was listening for, and to identify if there was in fact any zero-day malware in the memory.

01:57:22.000 What we did discover is that as you would expect, there were a number of ports.

01:57:27.000 This is a normal part of an operating system.

01:57:30.000 Ports are used to establish connections and provide functionality to the operating system.

01:57:37.000 We've discovered 59 of those that were open.

01:57:42.000 And while most of these things were what I would have expected, there were some unexpected high port activity specific to the Win EXE, which controls your accesses and your logons, and your DNS, which controls your domain name service.

01:57:58.000 So if you go and you type in yahoo.com, the computer will use the DNS service to actually determine which IP that is so that you can connect.

01:58:09.000 And then the DHCP server.

01:58:12.000 All of those are normal, valid Windows processes.

01:58:19.000 But for example, DNS, the default port on that is port 53.

01:58:25.000 In the case of the EMS, we not only had the port 53, but we also had DNS monitoring on a high port.

01:58:33.000 And I won't list that port number here in this open forum.

01:58:39.000 But that was a little bit unexpected.

01:58:42.000 I will tell you that on the EMS, you were utilizing both IPv4 and the newer version, IPv6, enabled.

01:58:52.000 So these services had dual functions with dual listening ports and things of that nature.

01:59:01.000 There were ports and there were services that were enabled that allowed remote access.

01:59:09.000 So the RDP protocol, for example, as well as the terminal services were enabled on the EMS.

01:59:19.000 Next slide.

01:59:22.000 As part of that memory analysis, we did a complete check of the call outs and the attempts to connect from the EMS out to the internet.

01:59:37.000 Now, once again, the county has repeatedly said that these were isolated systems, et cetera, et cetera, et cetera.

01:59:46.000 The EMS attempted to connect to those IPs, most of which are normal.

01:59:56.000 I would take a look at the level 3 parent, the EdgeCast connections there, and I would probably request from the Maricopa County the documentation for those functions that rely on those connections and to determine whether or not those are certified or not.

02:00:22.000 We were not provided any of that certification document, but those are the two items up there that I would ask Maricopa County for some further clarification on.

02:00:36.000 As part of this analysis, I was able to determine that there was no zero-day malware in the memory at boot up of the EMS server.

02:00:49.000 Next slide.

02:00:52.000 Let's talk about internet history and connections.

02:00:56.000 As you will recall, Maricopa County commissioned two independent auditors to come in.

02:01:04.000 Both of those auditors had a finding that there was no internet connection at the time that they conducted the audit.

02:01:13.000 When I initially did the analysis, and I was only searching what is called the allocated space, so the allocated space is what you as a user see when you open up Internet Explorer or when you open up File Explorer.

02:01:30.000 When you see that directory structure, that's allocated space.

02:01:34.000 When I looked at the internet history of the allocated space, I had the same conclusion as the auditors did.

02:01:42.000 However, I took this one step further.

02:01:45.000 I actually carved the unallocated space in the entire file system for internet artifacts.

02:01:53.000 And when I did that, the history was significantly different than both the representation by the auditors and the representation by Maricopa County that these systems had never connected or were exposed to the internet.

02:02:10.000 And we found internet activity and multiple visits on the EMS server, three of the EMS client workstations, one adjudication workstation, and then the reweb 1610 and the Regis 1202.

02:02:31.000 Now, before I get into this, I want to kind of walk through my methodology a little bit.

02:02:37.000 So it's very common for operating systems to have default URLs, compatibility caches, things of that nature that may have an internet URL as part of that part of that artifact.

02:02:56.000 So in order to ensure that we didn't get any of that default data, I only reported on internet artifacts that one, the date occurred after the installation of the Dominion software, so after the 6th of August 2019, and that had multiple visits to the same site, okay, with dates after that timeframe.

02:03:23.000 So that would eliminate any of the default URL artifacts that may have been on the system.

02:03:32.000 Next slide, please.

02:03:36.000 Okay.

02:03:37.000 So from the EMS server, you'll see that there's actually three visits to the same site on the same day.

02:03:45.000 That clearly is not a private URL or a private IP address.

02:03:53.000 And so what I can tell you is that the EMS server, at least on that date, was connected to the internet.

02:04:02.000 Now, I'd also like to point out that relying on the unallocated space for these artifacts, I don't have a complete history of all the internet connections because things get overwritten, things get changed, things of that nature.

02:04:22.000 But the importance of this is that at some point in time, specifically those last visited dates, this device was connected to the internet.

02:04:35.000 Now, if you look at that date, there's also a correlation to the purging of the database.

02:04:47.000 It's the day before the audit.

02:04:50.000 On the same time, exactly.

02:04:52.000 Almost the same time, exactly.

02:04:56.000 Obviously, this requires an explanation.

02:05:00.000 Next slide, please.

02:05:05.000 When we talk about the EMS client, here are the connections.

02:05:10.000 Now, the nine connections at the top there, you'll see that as far back as February of 2020, there were four connections made to that URL, to the Microsoft URL.

02:05:26.000 And then on the 22nd, which coincidentally enough is during the time of the audits, there were five connections to the Microsoft URL.

02:05:39.000 I included that lower set of findings to illustrate that the importance of some of the items that were not produced to us.

02:05:52.000 So, not all of the election-connected devices were produced to us for analysis.

02:06:02.000 And that IP of a 192.168.100.11 is one of the private, it's a private network that was the election network.

02:06:14.000 And you will see that it accessed a bunch of web pages off of that device indicating that it was a configurator or it was a file server or something of that nature.

02:06:27.000 I want to draw your attention to that very last line: the M underscore network underscore wirelessland.html.

02:06:38.000 That was accessed on the 19th, or excuse me, on the 30th of October 2019.

02:06:50.000 Now, we have not received any information about any wireless LAN configurations, but yet here you have someone accessing it from the EMS client to access what I can only surmise was a wireless LAN configurator on that date.

02:07:11.000 And you can see that the EMS admin 01 account was used for that.

02:07:15.000 Once again, who the actual human was behind that account, I cannot tell you because of the shared passwords and the shared user accounts.

02:07:25.000 But I can tell you that not all the devices were produced to us that would have shed significant light on our findings.

02:07:36.000 Next slide.

02:07:41.000 Okay, once again, this is EMS client 3, and you can see that the last date last, there are six visits to Microsoft.com, and the last visit was on the 3rd of February 2021.

02:07:57.000 Now, keep in mind that those previous five visits were obviously before that timeframe.

02:08:03.000 And we don't have a record by nature of this artifact when each of those visits occurred.

02:08:09.000 Next slide.

02:08:14.000 Okay.

02:08:15.000 Now, ReWeb 1601 is kind of an interesting case.

02:08:18.000 Now, once again, we did not receive any network configuration diagram.

02:08:23.000 We did not receive any functional information as to the network.

02:08:29.000 It was one of those things that, as an auditor, in most cases, I can go back to the person being audited or the entity being audited and say, what is this?

02:08:39.000 Okay, how did this function?

02:08:40.000 How did this interact?

02:08:42.000 In this particular case, in this particular situation, there was extreme resistance and quite frankly, in my opinion, obstructionistic actions taken by the county to prevent this type of exchange.

02:08:59.000 Now, this system clearly was connected to the internet.

02:09:04.000 Now, whether or not that was by design or whether this is one of those isolated and protected systems that the county has indicated never touched the internet, I cannot tell you, but I can tell you that it had significant internet access.

02:09:19.000 And this is only something that would fit on the screen, right?

02:09:23.000 There's literally thousands of connections to the internet by this system.

02:09:29.000 Based on the naming convention, I would assume that this is some form of a web-based server that was used in the election system because it was produced under the subpoena, which that was one of the requirements for.

02:09:45.000 Now, the other thing that I will tell you is that this device was produced to us on an external four-terabyte hard drive.

02:09:55.000 And originally, it was represented to us as this was a forensics image of this device.

02:10:01.000 When we actually looked at it, we found that all of those devices that were produced on the external four-terabyte hard drives, they were simply an operational system clone of that device, and it was not preserved in a forensics manner.

02:10:17.000 What I can also not tell you is what steps were taken on the part of the county to ensure that the unused portion of that hard drive not occupied by this device, I cannot tell you what steps were taken by them to ensure that those were wiped or zeroed out so that we would not commingle data.

02:10:38.000 So, I do want to caveat these findings and the Regis findings with those statements.

02:10:43.000 But clearly, these devices had continual and repeated access to the internet.

02:10:51.000 Next slide.

02:10:56.000 This is the Regis 1201, and that, by the way, is the host name, not the function of this device.

02:11:05.000 And once again, you see repeated access.

02:11:08.000 That IP address is actually the public IP address for the maricopa.gov public URL.

02:11:19.000 Next slide.

02:11:22.000 So, I appreciate your diligence and your patience on this.

02:11:26.000 And as we think about what I've talked about today, it really boils down to accountability, right?

02:11:36.000 And making sure that our election systems are secured.

02:11:41.000 I will tell you that they were not based on any measure that I, as an IT professional performing countless vulnerability assessments and incident responses that I have occurred,

02:12:01.000 had a client that engaged me had this state of a network, it would have resulted in a failure on our audit.

02:12:14.000 So, at this point, I would like to remind people that from a totality of what these findings are, there simply is no accountability by anyone accessing these devices.

02:12:30.000 You had shared passwords, you had shared user accounts, you had remote access.

02:12:41.000 If someone could get access to this system, they wouldn't need a zero-day exploit.

02:12:50.000 The systems were so far out of date from a security compliance standpoint that it would have taken the average kitty hacker less than 10 minutes using Metasploit to hack this system.

02:13:04.000 And I would like to remind everyone that's listening to this that when you have a network of computers like you have in these voting systems, it only takes one person bringing in a little hockey punk with admin access to provide external remote access to that voting system.

02:13:31.000 And in the situations where you don't have accountability, you have shared usernames and you have shared passwords, you simply cannot guarantee the security and the accountability on those systems.

02:13:45.000 And I thank you very much for your time, and I'm available for questions if you have any.

02:13:50.000 Thank you, sir.

02:13:51.000 We appreciate that.

02:13:54.000 We're not doing questions at this time since it's just a presentation.

02:13:58.000 We will have committee hearings that will give everybody the opportunity to ask questions in the future.

02:14:03.000 So thank you.

02:14:04.000 Okay, we are going to go back to Mr. Logan.

02:14:07.000 For those that are looking at your watch, the bulk of this is done, but there's still some more important things to do.

02:14:15.000 Mr. Logan is going to quickly, because we are running over time, go through his recommendations of what improvements the Senate might be able to help do through legislation.

02:14:28.000 And then Mr. Pullen is going to quickly give his report about the independent ballot count the Senate did.

02:14:35.000 And then we have Ken Bennett standing by, who was our Senate liaison, who will be giving you the observations that he noted when he was there working every day.

02:14:46.000 So Doug, could you do me a favor and go through those recommendations quickly, please?

02:14:57.000 Are you clicking?

02:14:57.000 Is it working?

02:15:03.000 Okay, just click a bunch of times till I'll tell on the screen.

02:15:05.000 We'll talk through it.

02:15:06.000 Because if I can't control it, it's going to take too long.

02:15:10.000 Okay.

02:15:10.000 And pull your mic up closer, please.

02:15:12.000 Everybody's texting me saying they're having a hard time hearing you guys.

02:15:28.000 I have a lot of transitions on it, so if you just click and show it all up at once.

02:15:51.000 Maybe.

02:15:53.000 Ah, look at that.

02:15:54.000 Okay, I'm just going to mount.

02:15:56.000 Whoops.

02:15:58.000 So legislation should be considered that links voter roll registration to changes in driver's license.

02:16:04.000 We saw a lot of indications that there was old, potentially old information in the voter rolls, and it's very important that our voter rolls remain clean.

02:16:15.000 If they don't remain clean, it would facilitate, it makes it easier for almost any type of way that someone might want to take advantage of the system.

02:16:24.000 If only the people who are registered to vote and could show up to vote are in the voter rolls, that makes it more difficult.

02:16:31.000 And already when you go into the DMV, you can register the vote.

02:16:35.000 But specifically, if you change your license to another state, if you change your address, which are things that people are usually pretty diligent about taking care of, that should also update your voter registration details so that when you're out of state and you're in another state, it's not possible for your old voter rolls to be used by you or anybody else.

02:16:57.000 Specifically, we recommend that the NCOA is a natural change of address.

02:17:02.000 It's something put up at the U.S. Postal Service.

02:17:05.000 I view a ballot basically like money.

02:17:09.000 And we should not be, you know, just mailing money to people who are not necessarily still at that address or have moved.

02:17:15.000 So checking the NCOA before you mail out ballots will help make sure that the currency of the ballots are only ever received by individuals who are legitimate voters or still living at that location.

02:17:27.000 So 90 days before the election, in addition, it should check it right before mail-in ballots.

02:17:32.000 We are not ever effectively mailing currency out to an address where someone has moved to another state.

02:17:39.000 I understand that the EPM and guidance from the Secretary of State suggests that the ERIC and Social Security's master's death list and others should be checked regularly against voter rolls, but I believe it needs a little bit more oomph to it and that there should be a legally required frequency for counties to do so to make sure that the regulator being maintained rather than just a guidance that it should be done at some stage.

02:18:07.000 Talk a little bit about election software, both from the report I have out of Antrim and specifically with what some of the inconsistencies and oddities that we're finding about the voter role system both here and quite frankly across the country.

02:18:24.000 I highly recommend that we pass legislation that requires that these applications that are extremely important are built up to a higher standard and specifically are making sure that they're ensuring the confidentiality and integrity of the systems.

02:18:39.000 The Open Web Application Security Project is known as a leader in the application security space and they specifically have something called the Application Security Verification Standard or the ASVS.

02:18:51.000 It has levels one through levels three.

02:18:53.000 Level three is for a sensitive system and I would highly recommend that would be a requirement for anything associated with voter rolls or voter systems that they would build up to that standard.

02:19:03.000 Doing so make sure that the application itself has the necessary standards built into it in order to make sure things aren't altered and that there are appropriate logs if so in order to take care of that.

02:19:20.000 Specifically with that it's always a good idea to run the ASVS assessments on a regular basis, usually every three or four years and specifically that the vendors should be required to attest that the ASVS standard was fully applied.

02:19:35.000 I further recommend that the vendors you shouldn't be able to use the same vendor over and over again for any type of certification activity.

02:19:43.000 It's too it creates too much opportunity for if there was some impropriety by a vendor that it could continue to pass.

02:19:53.000 So rotating vendors at least every three years and putting that in the law would help ensure that not only are these being assessed but they're set up to a higher standard.

02:20:02.000 And this goes beyond specifically what the EAC is requiring because quite frankly based on everything that's being said the EAC is not requiring anything close to what is necessary in order to protect our election system and hopefully that will get better over time but in the meantime Arizona can be a leader in this area.

02:20:21.000 Okay voting machines.

02:20:23.000 Specifically legislation should be considered that requires falling of all the CESA guidelines for election systems and equipment and that any variances against those should be documented and there has to be risk manos that are signed off and should be public for the appropriate for any derivations from those guidelines.

02:20:39.000 Now those guidelines cover pretty much everything that Mr. Coton was covering today.

02:20:44.000 Everything from setting up baselines on the systems, everything from baselines and network processes, making sure that user accounts are handled properly.

02:20:54.000 All those details are all covered by that.

02:20:55.000 Was a very simple legislation that basically says that guidance needs to be followed.

02:21:01.000 Legislation should be considered, which requires assignment of individual usernames and passwords.

02:21:07.000 Mr. Cotton's talked about that a lot today.

02:21:10.000 Legislation should be considered that requires real-time network monitoring of all election equipment, even on the air gap networks.

02:21:17.000 So there is some indication of what occurred there.

02:21:19.000 It may seem odd to have that on an air-gapped network, but as Mr. Cotton was mentioning, there's very small devices that you can take in.

02:21:28.000 And if you can plug them into a network port, you can effectively give the entire network internet access.

02:21:34.000 I mean, they're physically very small, they can be hidden easily.

02:21:37.000 And if you've got real-time network monitoring on those systems, especially where the EMS is, you can identify that and at least have a log of it and potentially prevent it before anything happens.

02:21:49.000 And legislation should be considered that would prohibit it, internet-capable election management system servers or equipment from being utilized.

02:21:58.000 There's a number of devices that, when you look at the serial numbers from the Pro V and V and S LA audits, they show that they had Wi-Fi cards and stuff put into them.

02:22:07.000 Anytime the capability is within a device, there's the potential for it to turn on, or for someone to turn it on and activate it, or use it to connect to some other device.

02:22:17.000 So it's highly recommended.

02:22:19.000 If the equipment's not even there, then you can't have a failure to configure, create any issues.

02:22:24.000 So legislation that far, not just preventing internet access, but preventing any type of capability in the device, would help ensure the integrity, especially as we keep being told that things are not connected to the internet.

02:22:37.000 From the voting machine standpoint, county employees should have all the administrative access on all election equipment sufficient to independently validate all configuration.

02:22:47.000 The fact that Mayor Cupa County said they did not have the hardware tokens necessary in order to see if their election equipment was connected to the internet or not is extremely, extremely alarming.

02:22:59.000 The accountability, the county needs to be able to hold vendors accountable.

02:23:03.000 We may use subcontractors for various different actions, but the responsibility always falls on the county, and therefore they need to always have all access.

02:23:11.000 That should not be something they can relegate to somebody else.

02:23:14.000 In addition, election voting machines should have a paper backup of all ballots, which can be used to confirm the votes where CAST is intended.

02:23:20.000 And these machines must be regularly maintained to vendors' maintenance schedule.

02:23:25.000 One of the things that was found in some of our examination of the paper ballots is a lot of things were miscalibrated or otherwise not following general manufacturer guidance.

02:23:35.000 If we want to make sure that we get the intended results out of things always, we should make sure that whatever goes through logic and accuracy testing, whatever it is that's a standard equipment being used, is the same thing we're using on election day.

02:23:49.000 And if you're testing a system with something different than what has happened in the real world, it's not a very good test.

02:23:56.000 And legislation should be considered that requires that paper stocks utilized on election day conform to, again, to manufacture specifications and that it's been tested properly.

02:24:07.000 Now, we think that you should have legislation that should consider creating an audit department that should regularly conduct audits on a rotating basis across all the counties in Arizona.

02:24:17.000 To the best of my knowledge, nobody is currently doing this, but based on the audit we performed, there was a lot of processes and procedures that were not conducive to effective audits.

02:24:28.000 The way that stuff gets better is by regularly checking it and regularly validating it.

02:24:33.000 And now that the whole world is looking at our elections, I think it's very important that we take advantage of that and make sure that what is done in our election departments is brought up to the same standards that financial industry uses and other critical systems.

02:24:45.000 It should not be an area that's lagging.

02:24:48.000 When our voting equipment helps choose the most powerful individual in the world, there's a lot of adversaries that would like to take advantage of that, and we need to treat it accordingly and make sure that it is being audited so that those standards are maintained.

02:25:03.000 Legislation should be considered that requires batches of ballots to be clearly labeled, separated from each other in a manner that they cannot easily mix together and easily connected to the batches run through the tabulation equipment.

02:25:13.000 There was a lot of hoops we had to get through.

02:25:15.000 jump through to even connect a box of ballots to what was run through the software in order to match those two up.

02:25:24.000 And that is something that should be simple to do, again, because it facilitates audits and that those audits facilitate accountability.

02:25:33.000 While a full audit like what we did this time, it cannot always be done.

02:25:37.000 The better the record keeping is, the easier it is to do partial audits to confirm things.

02:25:41.000 And that's something the audit department can do on a regular basis, in addition to sometimes to info audits.

02:25:49.000 But it's not cost effective to do that every single year.

02:25:53.000 Legislation should be considered to penalize, purposely inhibit a legislative investigation or an officially sanctioned audit of an election.

02:26:00.000 I think why that's in there is a little bit obvious.

02:26:04.000 Audits are really effective when you have the cooperation of the management who controls things, and it's very, very difficult to manage them.

02:26:12.000 That's why financial services, if you're your typical financial audit, if you don't comply with the audit, you can literally be put in jail at times.

02:26:25.000 Okay, ballots.

02:26:26.000 Legislation should be considered that will make ballot images and cast vote records artifacts from an election that is published within a few days of the results being certified for increased transparency and accountability of the election process.

02:26:36.000 These are things that we think is important for the Arizona and the American public to be able to see and validate and see with their own eyes.

02:26:44.000 Currently in Arizona, we had a judge that stated that we could not make the ballot images publicly available.

02:26:51.000 There should be nothing that links, once a ballot comes out of its envelope, there should be nothing that links it back to a person, and there should be absolutely no reason why it shouldn't be able to be public.

02:27:01.000 Legislation should further be considered which require all ballots to be cast on paper with security features such as watermarks or similar technology with a detailed account of what papers were used.

02:27:13.000 With our paper analysis, we wanted to be able to say that this is legitimate paper and valid and real, and we wanted to be able to say this is not legitimate paper.

02:27:23.000 But with as many wide number of papers that were used, I think we were estimated over 10 different copies, different types of paper, it's very difficult to make that.

02:27:32.000 But if there's official paper that's kept track of, it'd be much easier for an audit when it's conducted to be able to say without a shadow of a doubt whether it is in fact printed on legitimate paper.

02:27:43.000 Mail-in voting should incorporate an objective standard of verification for early for voter identification similar to the ID requirements for in-person voting.

02:27:51.000 It seems likely that mail-in voting will continue to increase.

02:27:56.000 From a security standpoint, I advocate no more mail-in ballots, but that's not probably realistic.

02:28:02.000 So that being the case, if it's going to continue, we need to have good identification requirements.

02:28:11.000 And that is end.

02:28:12.000 Thank you for your time, Madam President.

02:28:14.000 Thank you, Mr. Logan.

02:28:15.000 I appreciate that very much.

02:28:17.000 We'll take all those into consideration.

02:28:20.000 I'm sure we'll have more.

02:28:21.000 Let's go now to Senator, Senator, sorry, Randy.

02:28:25.000 Mr. Pullen, Randy Pullen was our co-legislative liaison there as they saw the work building up quite so much.

02:28:36.000 Mr. Pullen, could you give us just a tad of your background and as to why I selected you to please do this independent count?

02:28:47.000 Thank you, President Phan, as well as Chairman Peterson.

02:28:51.000 Thank you for your commitment to this forensic audit and your resilience over the last six months as we went through it.

02:28:58.000 Thank you.

02:29:11.000 Okay, just real quickly about me personally.

02:29:14.000 Graduated from Arizona State University, undergraduate in math and chemistry and an MBA in 1981.

02:29:22.000 I sat for and passed the CPA exam in 1980, became a CPA, and I've been a CPA since then.

02:29:29.000 Employment-wise, I started out working on my MBA as a, I was working at a engineering company, writing software for them.

02:29:39.000 And then I joined Deloitte Haskins and Cells and began working in their audit department and helped them develop and test the first statistical sampling software and system for doing audits.

02:29:57.000 I became a partner at Panel Kerr Forrester.

02:30:00.000 And then again, I went back, became a partner at Deloitte and Touche, where I focused on financial auditing, specifically for bank savings and loans in the hospitality industry.

02:30:11.000 I actually did get involved in forensic audits, so I understood how they function and what you had to do in order to complete them.

02:30:19.000 I started my own company back in the 90s, and I still do consulting and accounting services.

02:30:25.000 And I also started an IT company in 2001, WageWatch, which still exists to this day.

02:30:33.000 And we developed software that's still considered some of the best in the industry that we're in.

02:30:41.000 Background-wise, the Senate decided they wanted to do an independent count of the ballots in order to confirm the count by the county as well as the count by cyber ninjas on the forensic audit.

02:30:55.000 And so that was kicked off on June 28th.

02:31:00.000 They selected me to run that machine count.

02:31:06.000 Again, it goes back to my experience and knowledge.

02:31:09.000 I immediately got Brian Blim, who was the attorney who had worked on the floor of the Coliseum and was the legal counsel that had dealt with any forensic issues that came up on the floor during the hand count.

02:31:24.000 And by the end of June, he was no longer a contractor with the cyber ninjas.

02:31:31.000 He was independent and he agreed to assist in the machine count.

02:31:36.000 We also enlisted a lot of former volunteers who had worked on the floor doing tally counts as well as working in the corrals taking care of the ballot boxes.

02:31:52.000 And so we put together a pretty good team.

02:31:55.000 We went out and found the equipment for doing a machine count and looked at several different varieties and finally decided on, I need to stop pushing this and found the equipment.

02:32:14.000 The equipment we found, interestingly enough, was highly considered around the country as very good equipment.

02:32:24.000 And it's all this is in the report.

02:32:27.000 And we selected two Bantam 1 counting machines that were made by U.S. paper counters.

02:32:34.000 And we also got two paper joggers, they're called.

02:32:42.000 what they do is they help align all the paper before you run it through and do the count on the paper.

02:32:48.000 And again, these ballots are very heavy paper.

02:32:51.000 So when the technician came in and set up the machines and we were testing the paper, he had to make adjustments to the machines that could handle the quality of the paper that we were running through the system.

02:33:03.000 And so once we had that figured out, then we had the technician train our volunteers who this worked for us.

02:33:12.000 And then the ballot counting started on 7-14 and we completed it in 12 days.

02:33:19.000 I will tell you that the volunteers worked incredibly hard on this as well as observers we had overseeing what they were doing.

02:33:28.000 And we started working at 8 o'clock in the morning and we went until midnight on those days.

02:33:34.000 We had two teams that were working that very, very solid work.

02:33:40.000 So here's what we found.

02:33:42.000 The Maricopa County official canvas, you can see it's as it's been reported earlier, and we did the machine count and it was very close.

02:33:52.000 We were 121 less ballots than they had counted, which again, you can see the forensic election audit that count on the ballots was a little bit less, but all of it's within a thousand of what Maricopa County did.

02:34:13.000 Not surprising.

02:34:15.000 One of the things we did learn on the machines when we were testing them and setting them up to operate is when they did was a miscount and we did do recounts based on that.

02:34:24.000 But when there was a miscount, essentially it was an undercount.

02:34:28.000 Okay, so being a little bit less than the official canvas count was not surprising.

02:34:34.000 Now here are some of the things we found, and this kind of confirms some of the things that were talked about earlier in these reports.

02:34:42.000 We did find missing batches and boxes where you would open a box and it was supposed to have seven batches in it.

02:34:49.000 There would only be six batches in the box.

02:34:52.000 Okay.

02:34:52.000 And then sometimes we found there were eight batches in the box, but only supposed to be seven.

02:34:57.000 So we found these kinds of problems.

02:35:04.000 Am I causing this?

02:35:07.000 Okay.

02:35:08.000 So we were finding missing batches and boxes.

02:35:12.000 We were finding batches and boxes not listed on the boxes.

02:35:19.000 So we're kind of like a ghost batch.

02:35:22.000 And then when you open some of the boxes, the batch counts that went with every batch, which was typically supposed to be about 200 in the batch, they weren't with the batch.

02:35:32.000 They were on top of the batch or they were on the side.

02:35:35.000 And so we'd have to go through and figure out manually which batch sheet went with which batch, which again goes back to if things were done more properly, this would be much easier.

02:35:50.000 It could have even been done faster as that.

02:35:53.000 So that's pretty much what we came up with with this.

02:35:57.000 And so again, it independently confirmed the numbers that the county and cyber ninjas found in the ballot count.

02:36:08.000 Thank you.

02:36:09.000 Thank you.

02:36:09.000 Well, thank you, Mr. Pollen.

02:36:11.000 We appreciate that very much.

02:36:13.000 We had, those who didn't know, we had the ballots.

02:36:17.000 And before we gave them back, we said, well, what do we do if Maricope County and Cyber Ninjas counts don't match?

02:36:24.000 How do we know which side to go with?

02:36:26.000 And so we decided, let's get a couple of machines of our own and do an independent just in case there was a difference.

02:36:32.000 We could have an idea of which side to go with.

02:36:35.000 Thank you.

02:36:36.000 All right, Mr. Bennett, are you still on Zoom with us?

02:36:40.000 I am, Madam President.

02:36:41.000 Thank you.

02:36:42.000 Thank you for waiting so long, sir.

02:36:44.000 I apologize for the delay.

02:36:46.000 Mr. Bennett, would you give us just a tad background about yourself and tell us what your observations were as the Senate liaison?

02:36:54.000 Well, there's a I've provided a I have provided a PowerPoint to your staff, and so I would ask that they prepare to bring that up.

02:37:05.000 But in the meantime, I served as the 21st Secretary of State from 2009 to 2015.

02:37:15.000 That's the chief elections official of the state of Arizona.

02:37:18.000 I also served as the president of the Senate for four years, like yourself, and another four years as a state senator.

02:37:26.000 So I kind of bridge that those two domains, maybe.

02:37:31.000 I've also an accounting degree from Arizona State University and have worked in numerous businesses, usually as the CEO or CFO, chief financial officer of those companies.

02:37:45.000 And I see the screen, so I'll jump in here.

02:37:49.000 I know our time has gone long today, but you asked me to observe throughout my days there at the audit areas where compliance with our election laws and procedures was accomplished and maybe where they weren't complied with.

02:38:12.000 As you know, elections in Arizona are governed by the election laws, which are adopted by the legislature and the governor, and then a Secretary of State's procedures manual, which is promulgated every other year by the Secretary of State's office, but has to have the consent of the Attorney General and the governor as well.

02:38:32.000 And between those two documents, there's over 1,300 pages of laws and procedures.

02:38:40.000 I'd like to just briefly say that no election can be conducted perfectly because it is administered by imperfect human beings, but that doesn't mean we don't try because it is through our elections that we the people give our consent of the governed, as is identified in the Declaration of Independence.

02:39:02.000 And every citizen deserves to know that they are being treated equally under the law as required by the Constitution.

02:39:11.000 So every legal vote has to be accounted accurately and not canceled out by unlawful votes.

02:39:19.000 This report is intended to identify where Maricopa County failed or may have failed to comply with some of these statutes.

02:39:27.000 But having said that, I believe that the majority of our election officials in Arizona are honorable, well-intentioned people.

02:39:36.000 So I intend this report in the spirit of constructive improvement, but also maintaining appropriate accountability.

02:39:44.000 Let's go to the first slide.

02:39:49.000 As we've heard in previous testimony, and the slides aren't changing on my screen, but I hope they are at your end.

02:39:59.000 First slide or observation is related to the missing signatures on ballot envelope affidavits.

02:40:07.000 And there's some statutes there that I'm not seeing a change on your slides, but I'll assume that the slides are changing at your end.

02:40:18.000 You'll see the statutes 547, 16, 547, and 48 that early ballots have to be accompanied by an affidavit.

02:40:28.000 And by 7 o'clock on Election Day, there is a cure period in Section 550, which is not noted there.

02:40:38.000 ARS 16552 is very clear that the election board is to check the voter's affidavit and quote: if it's found to be sufficient, the vote shall be allowed.

02:40:49.000 If the affidavit is insufficient, the vote shall not be allowed.

02:40:53.000 And equally prescriptive in the election procedures manual: if the early ballot affidavit is not signed, the county recorder shall not count the ballot.

02:41:03.000 As you heard in previous testimony, the scope of this audit did not involve comparing signatures with the voter registration files, but you had people, Dr. Shiva,

02:41:18.000 look for and identify a number of missing signatures on ballot envelope affidavits, which to the extent that ballots from those envelopes were tallied would violate the above statutes and procedures.

02:41:35.000 Next slide, I hope you're seeing is because I'm not seeing it, original and duplicate ballots without matching serial numbers.

02:41:45.000 ARS 1621A is very specific that all duplicate ballots created pursuant to the subsection shall be clearly labeled duplicate.

02:41:55.000 There is a serial number that's recorded on the damaged or defective ballot, and the EPM says something very similar and gives one of the reasons, which is to tie the ballots together.

02:42:07.000 The other reason would be to make sure that the votes recorded on the duplicate correctly reflect the votes on the original or damaged ballot.

02:42:16.000 There were approximately 2,500 duplicated ballots where there were no discernible serial numbers recorded on either the original or the duplicate ballot.

02:42:25.000 Obviously, this does not comply with those statutes and procedures.

02:42:30.000 The next slide, I hope, is missing chain of custody.

02:42:38.000 ARS 16621 says that the county will maintain a chain of custody for all election equipment and ballots during early voting, which is kind of the beginning of an election through the completion of provisional voting tabulation or kind of the end of processing ballots.

02:42:56.000 The Senate requested this chain of custody.

02:42:59.000 The county provided a very detailed chain of custody of the ballots that we did receive, but we never received a chain of custody all the way back to the election period as this statute requires.

02:43:14.000 Next item is insufficient ballot paper thickness.

02:43:17.000 This is not a major item, but ARS 16502A says that ballots shall be printed on a paper of sufficient thickness to prevent the printing thereon from being discernible from the back.

02:43:31.000 And there can be debate as to whether this is just for the printing on the ballots or when the ballots are marked with their votes, but there were, as Mr. Logan noted, multiple the audit found multiple thicknesses of paper stock used in the printing of ballots, some of which would allow kind of that bleed-through effect, which would not be in compliance with the above statute.

02:44:02.000 Next one is common usernames and passwords, as Mr. Cotton noted.

02:44:08.000 The election procedures manual specifically says that applications within the EMS system should use separate usernames and secure passwords for each user or station.

02:44:21.000 And as he noted, he found common usernames and passwords being used, which is inconsistent with this guidance from the election procedures manual.

02:44:36.000 Another, the next one would be missing serial numbers on electronically adjudicated ballots.

02:44:42.000 An addendum to the 2019 election procedures manual specifies that tabulation machines may be programmed to outstack or to print identification numbers on the ballots with write-in votes that are electronically tallied.

02:45:01.000 This process is often known as adjudication.

02:45:06.000 There was, well, Maricopa's system, Dominion, does not use an outstack method, but it does not appear that these identification numbers were printed on the electronically adjudicated ballots as required by this part of the procedures manual.

02:45:25.000 And the last slide would be, well, I guess there's a one after this, but the last item is possible ineligible voters.

02:45:36.000 Several articles, which include multiple statutes within IRS 16, as well as many aspects of the election procedures manual, identify Arizona's requirements for an individual to be considered an eligible voter and therefore allowed to cast a legal vote.

02:45:54.000 The audit identified numerous questions regarding possible ineligible voters.

02:46:00.000 However, these determinations were, as you heard from Mr. Logan, made from comparisons between the county's final voted data and private data sources, not the official voter registration data.

02:46:11.000 So further investigation with the cooperation of the county, hopefully, is necessary to determine whether ineligible voters were allowed to vote in the 2020 election.

02:46:22.000 And Mr. Logan went into some of the possible categories of people who had moved or deceased or other categories that I think you saw in earlier testimony.

02:46:34.000 And the last slide is simply a thank you from me for allowing me to work on this project.

02:46:40.000 And I will conclude, I guess, by saying this, that I have already started to hear from people saying that, well, if the audit failed because it didn't prove that the election was overturned or that there was a different result.

02:46:59.000 Well, as you noted, when you began this process, Madam President, and when you began this hearing today, there was no predetermined, at least in my mind, and I know in yours and Warren's and everyone who worked on this audit, there was no predetermined outcome that if we didn't find this or didn't find that, we have failed because it's exactly the opposite.

02:47:25.000 If we identify strengths and weaknesses in our election procedures and statutes, and if we confirm that in this case, an election was conducted where the hand count of the ballots matches the electronic tally of the election proceed, the election system used by the county, I don't consider that a failure at all.

02:47:46.000 In fact, maybe Mr. Logan and his company have identified the most accurate hand counting process that has maybe ever been used in the country.

02:47:56.000 And that's directly in opposition to many within our state and across the country who said that their procedures were terrible or this was that, and nothing could be further from the truth.

02:48:11.000 I, you know, there were a lot of good, honest people that gave a lot of time, as you noted, to accomplish this audit.

02:48:25.000 That wasn't intentional, was it?

02:48:28.000 Was confirmed.

02:48:29.000 There we go.

02:48:30.000 I offer these, as you requested, as areas where we could make constructive improvement.

02:48:37.000 And I'll leave it at that.

02:48:38.000 Thank you.

02:48:39.000 Thank you, Mr. Bennett.

02:48:41.000 And we're sorry you went last and you had to hold on the logist, but thank you so much for doing this.

02:48:47.000 For some of you may not know, Mr. Bennett did this on his own time on his own nickel.

02:48:53.000 And he lives in Prescott, but literally drove down almost every single day to be at the audit with the rest of the team to make sure that everything was done accordingly and chain of custody was followed and everything was always documented.

02:49:09.000 So thank you, Mr. Bennett.

02:49:11.000 That was quite a yeoman's job on your part.

02:49:14.000 All right, closing comments.

02:49:15.000 Senator Peterson, I'll let you start.

02:49:18.000 Thank you, Madam President.

02:49:20.000 And I'll be fairly brief here.

02:49:21.000 I just, first of all, want to thank you for what you've done with this.

02:49:27.000 You have faced incredible opposition and hostility, and you have handled that with grace and dignity.

02:49:35.000 So I want to thank you and recognize you for that.

02:49:40.000 Again, the goal here is election integrity and making sure our citizens have faith in the process.

02:49:47.000 So as we wrap this up, what are our next steps?

02:49:51.000 Where do we go from here?

02:49:52.000 And I think there's legislation and I think there's law enforcement that needs to be involved.

02:49:58.000 So I'm going to name off eight bullet points here that I think need to be handled by my colleagues and by our attorney general.

02:50:08.000 First of all, and what I have found perhaps the most unsettling through this whole process is the obstruction that we have seen from the county.

02:50:19.000 The failure to comply with the auditor, a brazen willingness to violate a legal subpoena.

02:50:27.000 Our attorney general said that was against the law.

02:50:31.000 It's truly alarming.

02:50:33.000 And furthermore, to their willingness to expend significant resources, human capital, you name it, to block and to stop this audit.

02:50:48.000 As I recall, it was like $18,000 or something like that for one of their audits that they spent money on.

02:50:57.000 How much money have they spent trying to stop our audit?

02:51:01.000 It has to be in the hundreds of thousands of dollars.

02:51:05.000 But that would be an interesting number to see.

02:51:10.000 Number two, the numbers don't reconcile.

02:51:12.000 As you've seen through this, it is a theme throughout all the reports.

02:51:17.000 All of us as citizens, we should be able to pull up these election results and we should be able to, every direction, reconcile the numbers.

02:51:27.000 If I subtract, you know, early ballots or if I subtract, if I add the rejected, if I, you know, no matter which way, you should be able to come up with a reconciliation so that everything balances.

02:51:40.000 That needs to happen.

02:51:43.000 It appears that they broke the law with duplicate ballots.

02:51:47.000 And that's a huge deal.

02:51:49.000 That needs to be resolved.

02:51:51.000 We need to get to the bottom of whether that law was broken, how to prevent it in the future, hold people accountable that did it this time.

02:52:01.000 Churning of logs, the churning of logs.

02:52:06.000 We need to find out why that happened.

02:52:09.000 Who did it?

02:52:09.000 What was the motive?

02:52:13.000 And what was there?

02:52:14.000 We need to get to the bottom of the logs that were there.

02:52:18.000 Chain of custody issue.

02:52:19.000 Number five, chain of custody issues.

02:52:22.000 Number six, a failure to preserve data files.

02:52:26.000 And number seven, cybersecurity weaknesses that were so that were shown by Mr. Cotton, so evident here.

02:52:35.000 Those are not going to get any better.

02:52:38.000 We're seeing people being held hostage via cybersecurity every day, and it's constantly becoming more sophisticated.

02:52:45.000 We have to definitely need to up our game there.

02:52:49.000 And number eight, the envelopes with blank signatures.

02:52:54.000 We have a lot of questions there that need to be answered.

02:52:57.000 So with that, Madam President, I look forward to working with my colleagues and with the Attorney General in any way to resolve these issues and to improve our elections and to increase election integrity in the state of Arizona.

02:53:14.000 Thank you, Senator Peterson.

02:53:15.000 Senator Peterson is our Jude chairman.

02:53:19.000 This started in the Jude committee back in December and only appropriate to end up there.

02:53:25.000 And my closing remarks, first and foremost, let me tell everybody that all of these reports are up and posted on our website for you to access all of them.

02:53:35.000 That website is AZSenateRepublicans.com, AZSenateRepublicans.com.

02:53:42.000 You can all go there and see all of these reports.

02:53:46.000 Second of all, I have already transmitted a letter to our Attorney General's office with all of those reports.

02:53:54.000 That not only includes everything that we have noted here, but also everything that Senator Peterson has concerns about.

02:54:02.000 The Attorney General has that.

02:54:04.000 We are asking him to open up a formal investigation so that he can pursue and seek additional information, additional facts, perhaps get some of these missing things that we were never able to get, verify all this information and take the appropriate actions of anything that is necessary to do.

02:54:26.000 I have every confidence that he will be doing that.

02:54:31.000 I also want to say thank you to my Senate Republican colleagues.

02:54:36.000 When we started this, it was we had a claucus and every single one of our Republican members said this is important.

02:54:46.000 Our constituents have questions they want answered.

02:54:50.000 We didn't think it was going to be this long.

02:54:52.000 We didn't think it was going to be this expensive or this difficult, but we did it.

02:54:56.000 We hung in there.

02:54:57.000 We did it.

02:54:58.000 And as you can see, we do have some work to do here.

02:55:03.000 We have a lot of work to do because quite honestly, if we don't follow our rules, don't follow our elections, this is how problems can happen.

02:55:11.000 We also know that 18 different states sent representatives here because they have constituents asking the same questions.

02:55:19.000 And the very least, what I think that we can all come out of this is that we need to do audits to some extent.

02:55:27.000 We need to do bigger audits on every election just to make sure that everybody's following the rules.

02:55:35.000 So with that, I want to say thank you to Mr. Logan, Mr. Poland, Mr. Cotton, Mr. Bennett, all of you present, Mr. Shiva, Dr. Shiva.

02:55:44.000 Thank you for all your hard work.

02:55:46.000 I know this was very difficult on you and your family, Mr. Logan.

02:55:50.000 You've been here for many months and you've left your wife and 11 children back at home and he has another one due in next month in a couple of weeks.

02:55:59.000 So we gave up a lot for this and we appreciate it.

02:56:03.000 So to everyone, thank you all very much.

02:56:05.000 Thank you for being so polite up there.

02:56:07.000 We appreciate that.

02:56:09.000 And prayers and blessings to everybody and let's move our elections forward.

02:56:15.000 Thank you.

02:56:17.000 We are adjourned.

02:56:23.000 Thank you so much for listening, everybody.

02:56:24.000 Email us your thoughts.

02:56:25.000 Freedom at CharlieKirk.com.

02:56:27.000 God bless you guys.

02:56:28.000 Speak to you soon.

02:56:31.000 For more on many of these stories and news you can trust, go to CharlieKirk. com.

The Charlie Kirk Show - September 26, 2021

FULL Unedited Arizona Senate Hearing of the Maricopa County Audit

Episode Stats

Summary

Transcript