All Episodes
Previous Next
Sept. 24, 2021 - Bannon's War Room
57:48
Episode 1,288 – Live Results From The Arizona AuditEpisode 1,288 – Live Results From The Arizona Audit
Participants
Main voices
b
ben cotton
18:01
Appearances
b
boris epshteyn
01:11
| Copy link to current segment

Speaker Time Text
unidentified
Okay, welcome.
You're in the War Room.
We are watching the hearing in Arizona about the presentation of the full forensic audit.
And we're going to go back and forth.
We're going to cut back there.
We're going to have John Fredericks.
I've got Steve Cortez and Boris Epstein in studio.
We have many people tied in by Phone, text, other things, do breaking analysis.
I want to bring in real quickly Matt DiPerno.
Dr. Shiva is presenting about the signature, which is not in the report that we saw this morning, not in table 6.2.
It's another 17,000.
I guess, ballots that he would say is illegitimate.
I want to bring in Matt DiPerno.
Matt, there's a big question out there of various copies of this report.
Can you get our audience up to speed?
There was one leaked last night that the mainstream media got all over.
Another one I know that you're associated with, and then whatever version they're going to be presenting today.
Can you get us up to speed on exactly what's happening?
Yeah, thanks for having me on, Steve.
So, yesterday there was a report that was leaked It appears that that was a earlier version of the report and not the report that was final.
And then there was another report that I received yesterday that was purported to be the actual final report.
That's the one that we had put out on Twitter earlier today.
So that's my understanding of the report that will be presented today.
boris epshteyn ▲ ● ▼
Matt, this is Boris Epstein.
How are you?
And God bless you for everything you're doing.
Question for you.
I'm looking at a copy of a report that was sent to me dated 9-24, which is obviously today, that has an executive summary that says the election should not be certified and the reported results are not reliable.
Is that correct?
But then when I go down to page 4, it doesn't have the same numbers on the tally sheet that have been present in other reports.
So, you know, obviously a lot of confusion here.
And I'm going to send this report to you to take a look at.
Is this report, dated 9-24, that's on your phone now, is that the report being presented?
Or is this some stub report?
unidentified
No, this is my understanding is the 924 report is the report that would be presented today with updated numbers with the language that states the election should not be certified.
boris epshteyn ▲ ● ▼
OK, so just just so we're clear, if that is the case, sir, that is a nuclear Well, we won't know until the actual report is presented on the Senate floor today.
in American history regarding our Constitution, that is overwhelming.
So what you're saying, and I'm hearing the same from the House, from the Senate floor, I'm hearing the same from Arizona, that that language may be in that report.
Are you sure, sir?
unidentified
Well, we won't know until the actual report is presented on the Senate floor today.
What I'm telling you is this was the report that I received last night, And what we were told was actually being suppressed.
by an attorney who works for the Arizona Senate.
boris epshteyn ▲ ● ▼
What's his name?
unidentified
Hang on, they were talking about maybe pulling the indemnification of the artist.
Let's go into the hearing.
Let's hear a little bit of the hearing.
Matt, you hang on.
John Ferguson is going to join us.
Seth Keschel, the entire posse here.
Hang on, Matt.
Let's go to the Senate and hear what's going on.
We also had interior checks so that as you walked through the door, you came up to a desk where you were both checked for COVID, it valid to be on the list, make sure you had a badge, and all those things to make sure that you were someone that was supposed to be there to even be in the building.
All the ballots and election equipment were stored inside, within these cages, and anytime they ever left the cage, they were actually signed out by an individual.
So we have a complete signed record of every individual that came and picked up every box.
So someone, you know, someone took over custody of that box, and we actually had individuals called runners, and they would run it from The ballot corral, and they take it over to whatever table they need to go to, and that individual would then sign the box over to the table manager at the table that would then utilize it to process it.
So at no time was a box of ballots or individual ballots outside of the care of someone's specific authorized care who has to sign off of it.
In fact, we actually had 24-7 video surveillance on everything at all times.
In addition, you'll see this lovely police officer.
They were actually there 24-7 as well, and they were always within sight of the ballot corrals or where we had the election equipment stored.
We had police officers at both locations, always maintaining and always making sure that the ballots and the equipment was 100% secure and that nothing could happen to them.
So this is one of our tallying tables.
What you can see in the middle is actually a lazy Susan.
You'll notice that there's three counters around the table.
There's someone who's actually, at this table, they're loading and someone who's unloading.
So all counters were Maricopa residents who specifically voted in the last election.
We wanted to make sure that if anyone was involved in this very important action that they had skin in the game and they were local.
We didn't use anyone out of state for any functions having to do with the actual tallying of the ballots.
I should say actually count the tallying of the ballots.
Some of the table managers were from out of state, but the people actually counting the ballots were all Maricopa residents.
There were other functions where we had volunteers from other states.
As much as possible, we tried to keep everybody local in Maricopa County.
We think it's very important for our local community to take ownership for their election process, and we wanted to facilitate that as much as possible.
All these individuals were background checked.
Validated.
We had one individual that had slipped through the process because he'd been on the ballot versus specifically that doesn't have something that shows up in standard background checks.
So we started doing additional checks, comparing everything on things to make sure that never happened again.
It was very important to us to make sure that we always had things that were going to make sure that were beyond reproach.
Transparency in everything we did was very, very important.
Now, all three counters were blind.
That means they were not allowed to talk to each other.
As that ballot went around and was in front of them, they would tally on a sheet of paper and they'd put a little mark based on whether, for both the presidential and the Senate race, they'd put a mark to see whatever it was.
Roughly every 50 ballots, they would compare the numbers with each other.
Actually, the table manager would take them and compare them, and if two out of three of them agreed, And the third person was no more than one count off for the race.
They would proceed and they would move on.
If there's any more discrepancies beyond that, they actually had to stop.
They had to find the ballots in question.
That they're in question, they had to recount them.
So there's absolutely no way to have speed here without having accuracy.
And we found that when we had a brand new table, it was relatively slow.
But as soon as they've been doing it for about two shifts or so, their speed greatly increased.
And it was amazing at how quickly they could count ballots.
In the very beginning of the process, in our first three weeks, our fastest, I think our most ballots we ever counted was roughly 30,000.
When we came back and had more of a full shop, I think at our peak we did over 150,000 ballots in a day, and we're routinely doing over 100,000.
So the speed, like I said, greatly increased, especially as we work through this.
So the way the ballots would actually work is we have a ballot corral where the ballots were originally in.
They would be signed out of that ballot corral, and they'd be taken to a tally table.
After they were tallied, they'd go back to a ballot corral, which was specific to being in progress.
And then when we had our paper examination tables, they were ready for a box of ballots.
That's where it came.
It came out of the in progress.
So at the paper examination tables, we had DSLR cameras.
Those DSLR cameras took pictures on the front and the back of these ballots, and they gave us very high-definition images that allowed us to see all sorts of intricacies of the paper and what's going on.
After it was done with DSLR, actually... Excuse me, sir?
I'm sorry, the clicker's not working.
There we go.
Let's go back there real quick.
So once we went into the microscope stands, we had four microscopes that were taking images of the magnified image, and that was over a number of different places.
That included the presidential oval to take a look at how that was filled out.
And with the way we had the lights, we could actually see when it was filled out with a ballpoint pen, you could actually see the ridges of the person pressing down on it.
So you could tell the difference between something that was filled out with a Sharpie, you could tell something was printed out by a pen, Or you could tell actually if something was computer printed.
You could tell the difference between all of them.
We also had a microscope over certain parts of the ballot that would allow us to look at the paper fibers to help determine what type of paper was utilized.
Now, when we were done with this, we actually had over 140 terabytes of data just from the paper examination alone.
So we had massive amounts of data.
In fact, with our camera footage and everything that ran the operation, we ended up with close to two petabytes of data.
To give you a comparison, that is vastly more data that your average large thousand person company has.
So we were running a very impressive network here that was completely air-gapped, wasn't connected to anything outside of the floor in order to support this, in order to have all the data requirements associated with it.
It was a very complicated operation.
So just I want to give a high-level status of where we are right now.
So first of all, we've completed the hand counting of all federal races.
We've done all the image and microchip capture of all the ballots.
We've reviewed and did a comparison of the official results.
We've done analysis of the voter rolls.
We've done the vast majority of the analysis of the actual voting machines and voting equipment.
In progress right now.
We're hopeful to soon, with the settlement that the Senate put together, to be reviewing the spunk logs and routers based on the settlement terms.
We're also hoping that the completion of the paper analysis that's being done will be done very shortly.
Now from a scope standpoint... Stopped again.
So, no longer in scope was the canvas in.
That was the side that was removed.
We have the tabular configuration to check internet configuration was something that was not provided.
We believe with the other information we have, we'll be able to get similar data, but it will not be the same exact data.
We had requested a review of the voter roll system, but a lot of the systems that are used for checking in for the CIPOC system were not provided as part of the equipment that was given us.
We had hoped to look at the review of the ICX devices, but again those had not been provided.
We had wanted to look at the provisional ballots, the ones that had not been counted, to count the sealed envelopes to make sure they matched up with everything and made sense, and those again were not provided.
We had also hoped to take a look at the undeliverable ballots.
To see how many of them were bounced back or what happened to them and again those were not things that were provided and so there were things that are no longer in scope and we're not able to take a look at.
Okay, so now we'll get into the fun part and get more into the actual tally and results.
In order to understand some of these findings, I want to make sure that everyone has a clear picture as to how this process works.
So if we have ballots that are actually damaged or otherwise can't be run through the tabulators, for example, the Braille ballots won't fit through the tabulators.
Some of the UCAVA ones are in formats that can't.
They need to go through what's called a duplication process.
Now this is a different thing than what Dr. Schaefer was talking about when he talked about duplicates.
When he talked about duplicates, he was talking about more than one envelope going to the same person.
So we're going to talk about the word duplicates here, but we're actually talking about when there was an original ballot They couldn't be run through the scanner, and they created a copy of it, which was run through the scanner and counted.
So when you have duplicates, when you have the originals and you have the duplicates, only one of those counted, and it should only be the duplicates.
Now specifically, the originals are often referred to as damaged, sent to duplication, or DSD.
And we're going to use that notation throughout things.
A DSD means the original ballots, whereas the actual duplicates are referred to as dupes.
So there should be one DSD per dupe.
And there should be a unique serial number on every single DSD and every single DEEP to match them up so that you will know for sure that this ballot right here was duplicated to this other ballot.
And if you want to compare and make sure the duplication process was done correctly and that it actually represented the voter intent, you'd be able to easily match them up and it'd be easier to handle from an audit standpoint.
Duplicate ballots also should be stored separately from the original ballots so there's not confusion and they don't get mixed up.
So let's talk a little bit about those findings.
So our duplicate ballots were commingled with the original ballots, not all of them.
There were in at least one box case, which is something that they are not supposed to do according to the EPM.
Duplicate ballots had incorrect and missing serial numbers.
If you take a look at this table that's showing up, you'll notice the Serial number on the left is what was actually on the ballot, the duplicate ballot, and the serial number, the board one, hand dupe 2114 on the right is what was actually on the original damage.
You'll notice the numbers are actually different.
On the left-hand side, this is DUP Board 3, Hand 0214.
On the right, this is Board 1, Hand DUP 214.
We were able to match these up because of the ballot characteristics and the precinct that it came from, but it's a very painful process and it has to be done manually in order to figure out what matches to what else when they're not actually stamped with the same exact serial number on them.
We also had a number of serial numbers that were printed like this one that you see on the screen, where you can't really read it.
It's not legible.
So it theoretically has a serial number on it, but there's no way to match it up because you cannot read what the value is on it.
In addition to having ballots that flat out did not have a serial number anywhere on there whatsoever, so there was no way to match them up with originals.
Now, we also had duplicate ballots that reused serial numbers.
You would expect that a serial number, in order to match it up, went out being unique.
But you'll notice there's two examples up here of two different pairs that are not associated with each other, but had the same exact serial number utilized.
In this case, I believe, we've got a large print and a standard damage pad.
We also have a few others in here.
Again, same exact serial number, but these were not the same ballots.
And specifically, if you ever take a look at a large print ballot, they're huge.
They're very, very large.
So it's not just that something was photocopied or anything like that.
They literally use the same serial number on otherwise unrelated ballots.
And this is probably one of the more interesting parts is that we had more duplicates than original ballots.
So, according to our counts from our audit, we had 26,965 original ballots, and then we had 29,557 that were duplicate ballots, and those numbers should be the same.
Based on the numbers received from Maricopa County, we should have had 27,869 of both originals and duplicates, and they should have matched up perfectly.
Now, these extra duplicates did appear to favor Trump and Jorgensen.
If you take a look at the original ballots, we've got Trump has 995,404.
And if you take a look at the duplicates, there's some number of more of them.
So if you take a look at the percentage all the way over to the right, the expected percentage per candidate, and that's based on if we take the originals and assume the duplicates should be at the same exact percentage.
So we had 48% of the originals were Trump, 50% of the originals were Biden, and 2% of the originals were Jorgensen.
You can see what they actually have at the difference.
In reality, Trump had 58% of the duplicates, 33 and 3.
So both Trump and Jorgensen gained slightly with the duplicate process.
Same thing, when we take a look at the Senate race, it favors slightly to McSally, not necessarily as much as it does in the other case.
Both of these percentages are within the realm of error, of just human error, making mistakes.
So if we take a look at our final tally of results, and we look at the Senate race, it does look like Kelly still shows up as a head.
And we actually run into that we have 541 less for McSally and 60 less for Kelly in the ballot totals.
If we take a look at the presidential race, Trump actually loses 261 votes from the official votes.
Biden gains 99 and Jorgensen loses 204 votes.
And again, these are all, you know, very small numbers when we're talking about 2.1 million ballots.
These are very small discrepancies.
So we can say that the the ballots that were provided to us to count in the Coliseum very accurately correlate with the official campus numbers that came through.
So we did have at least a batch of 50 ballots that was run through the tabulators twice.
This is specifically when they took the Dominion tabulators, they had the same batch and it was run through more than one time.
We found this because through our various counts we had Very clear confirmations of how many ballots were supposed to be in a box, and when we compared our results against the cast vote records, we were roughly 50 off, and that made us go take a look at the Dominion images, and when we compared it to nearby ballots, we actually found that there was a set of 50 ballots that had been run through, I said again, twice.
As far as we could tell, with it only happening once, there's no indication as to whether that, you know, we have no clear indication whether it was human error or whether it was intentional.
We assume that it's human error because it happened in very small frequency.
This is an example of a ballot from two different batches.
It's probably relatively small text for people to read, but if you read all the way down on the bottom, It'll tell you that it's tabulator on the left hand picture tabulator 6004 BTC which is the batch 288 and that's the image 154 and then the right hand side we have again same tabulator but batch number 287 which is one different and it's image number 5 and we had roughly 50 of them that were in between the two of these.
We found something similar from the UOCAVA, where the UOCAVA, for those of you who don't know, UOCAVA ballots are for military and overseas personnel.
It's a way that they can actually cast votes even though they're not physically here.
Those ballots get turned in either via an online portal, they can be submitted via email, they can be mailed in, I think they can fax them in.
There's a whole bunch of different ways these can come in.
As a result, they're in a lot of different formats, and there's a lot of variance among them.
But on the left-hand picture, you can actually see that it's board number 2, hand-duped 573 is what approved it.
On the right hand side, it's HintDup574, and it's probably too small for you to read, but if you read the serial number circled on the top left, you'll notice that the time stamp and the serial numbers are exactly the same, which means that someone likely printed out the UOCAVA ballot twice, and both of them made it into these things.
We did not find this in a lot of quantities, but the only way we had to look at it was by hand.
There's over 10,000 UOCAVA ballots.
Because every single one of these UOCAVA ballots is slightly different form, it's actually even difficult to do it in automated fashion.
The only good way would be to go through by hand without some sophisticated processing.
Okay, so we're going to talk a little bit about the official results that are actually Turned out by the county.
And this actually connects quite a bit with some of the stuff that Dr. Shiva was talking about.
So from a definition standpoint, we have the official canvas.
The official canvas is the official certified results that are put out by the county.
It has the tallies of votes per candidate, per precinct, and provisional.
It tells what the turnout was for a given precinct and all of that information.
We also have what's called, here in Maricopa County, they call it the VM55 file, or the final voted file.
It is a list of every single person that showed up to vote.
And that's counted both for, you know, for in-person, whether it's early voting in-person, or whether it's mail-in, and all of those are kept track of separately.
So we have a number of all those different categories of who showed up to vote on any given day.
We then have the VM34 full voter file.
This is also referred to as, say, your voter rolls.
This is a list of everybody who should be eligible to vote.
And the county in Maricopa seems to make these available roughly on a monthly basis.
So the full voter rolls.
So that is your theoretical full list of everyone that may be able to, you know, may show up to vote at a given election.
Then we have our EV32 files, our EV32 early vote-in cents.
Every single time a mail-in ballot is sent, it's supposed to have an entry in an EV32 file that corresponds with that mail-in ballot that's sent out.
Likewise, we have an EV33 file, which is when any type of early vote is returned.
Now this both includes when a mail-in ballot is received and an in-person, when someone comes and votes in person.
EV33 includes both of those.
You may remember at the hearing that we had a while ago, we had mentioned that the EB-32s do not match the EB-33s.
We were doing a quick analysis in order to justify canvassing and there were 74,000 that were off.
The vast majority of those 74,000 were from early voting in person.
And that is why there was not an EB32 associated with it.
We have this clarified in our report as well.
That was not a purposeful discrepancy.
It was just something that was not immediately clear at that point.
So just to give an example on how these systems work in order to match everything up.
So if we have 10 people who mailed in a ballot, And we had 10 people who voted early in person.
And we had 10 people who voted on election day in person.
We have 30 votes that are out there.
So what this means is we should have the official canvas with 30 votes.
And it should be allocated per precinct accordingly.
It should be allocated based on the candidates.
And you should have your official tallies associated with it.
You would also expect that if you went to your VM55 file, you should see 10 people who voted via mail-in, because it has different codes based on that.
You should have 10 people who voted early in person and 10 people who voted on election day.
And every single one of those entries should have the name and address associated with the person that matches up with their voter rolls.
Likewise, you would expect that your EB32 would only have 10 ballots mailed in it, because that was what was sent out.
And your EV33 should have 10 people in it from the mail-in ballots and 10 people from the actual EV in person for a total of 20.
This is what you would expect in a balanced system.
This is not actually what we found when we started comparing all these numbers.
All these numbers were different in very different ways and it's something that creates quite a few discrepancies.
So none of these systems are actually balanced.
We're going to go through these.
So our official campus has 3,432 more ballots cast than the list of people who show as having cast a vote in the VM55 file.
Now, I do want to specifically interject in here that we finally heard back from Maricopa County because we asked them about this discrepancy.
I think it was at least a week ago, but it was a couple weeks ago.
So the day before we were presented our results, they decided to tell us that those were actually for the protected voters who don't actually, who are either judges or battered women or other individuals who are concerned about publishing their addresses, that that is the reason why that discrepancy is in there.
I can't validate whether that's accurate or not accurate.
That's just information that we just received.
What I can say is that this sort of stuff is exactly why with audits, usually the organization you're in the process of auditing cooperates and works with you.
Amen It would have been extremely helpful in order to get feedback and work through them through this entire process.
Now we do have 9,041 mail-in voters showing return ballots, more return ballots in EB33 than there were sent in EB32.
Sounds like Dr. Shiva found something very similar to this as well.
So specifically we found they were mailed one ballot, but somehow two ballots were received, which I do not know how you would have one ballot sent and two received.
The assumption would have to be that it's a clerical error or there's something else going on.
It's not clear how you can have that happen.
277 printings showing the official canvas as having more ballots cast than people showed up to vote for a total of 1,551 excess votes.
Again, the county has explained to us that the same reason for the VM55 difference they're saying is the reason there.
We have not had a chance to validate that.
There are 2,472 ballots shown in EV33 that don't have a co-respondent entries in the VM55.
And only 2,042 ballots show as rejected in the official canvas for a discrepancy of 430.
So let's walk through this really quickly.
So if something is in the EB33, that means an early vote was received.
And we have the individual's name and the voter ID associated with it.
So if an EB33 was received, you would expect that if it's not in the VM55 file of who voted, then it had to be a rejected ballot.
Just makes logical sense.
It has to be a rejected ballot.
But there's 2,472 that show in the EB33, but there's only 2,000, I'm sorry, there's only 2,042 ballots that show as rejected.
So there's a discrepancy of 430.
Again, just another place where they show that they don't seem to match up.
We also have 397 mail-in ballots show as received that were never shown as sent.
So they were, we know that they are in the VM55, they're mail-in ballots, and they were received without somehow ever being sent a ballot.
Now we also have 2,500, 255,326 early votes shown in the VM55 that do not have a correspondent entry in the EV33.
326 early votes shown in the VM55 that do not have a correspondent entry in the EV33.
And just to be clear, this is not, you know, when you were looking at EV33 entries, EV33 entries are supposed to happen when a ballot is received, but it's not, you know, the actual tracking of the ballots are under, you know, the actual official canvas of the VM55.
So we had, in the VM55, individuals who voted, we had entries for early vote and they were in there, where in 255,000 cases of those, they were not actually included.
In reality, all of these systems, to be audible and to be verifiable, all these systems should be able to be in agreement with each other.
Even if we have protected voters, there should be some way to know the number of protected voters who voted in order to match it all up so that you have a system that balances.
Voters who moved.
So, we took a look at the entire list of individuals who voted.
Specifically, that was from the VM55 final voted file.
And we ran it through a commercial database called, put out by Melissa, called Personator.
And Personator is a best-in-class identity system that helps check addresses and make sure they're associated with a user.
It'll show prior and current addresses.
It'll track move dates.
And it'll also track date of birth and date of deaths.
So we went and took the voter rolls and we compared them against this to see how many people might have moved and based on statute should not have necessarily cast a vote.
So the first thing we found is that 23,344 voters who voted via mail-in ballots, even though they showed in Melissa as having moved from that address.
And we wanted to make sure we accounted for the circumstances where a college student might have moved away from home, or a family member might have moved somewhere else.
So we actually eliminated all the cases where someone was still at that residence that had the same last name.
That's how we came up with 23,344.
So if your mail-in ballot is sent to an address that you no longer live at, there should be no way for you to receive that mail-in ballot.
At least, it's generally not a way for you to re-sent mail-in ballot, because mail-in ballots are legally not allowed to be forwarded.
So it can't be forwarded to your new address.
So the only way this situation could happen legally is if you know the current resident, and you're able to meet with them and pick up your mail-in ballot, or somehow have some other arrangement to pick up your ballots were there.
But still, 23,344 people voted when they should no longer have access, would not normally have access at that given address.
We had 2,382 voters who voted in person, even though they showed Melissa, as having moved out of Maricopa County prior to that date.
We have 2,081 voters who moved out of state in the 29 days before the election and appeared to be given a full ballot, which should have been, you know, if anything, if they voted at all, it should have been a president-only ballot, where literally the only option on the ballot would have been president.
That is something that is by Arizona statute.
Let's talk a little bit about the voter rolls.
So registration dates do not generally change in your voter rolls.
So this is your day of registration, unless it's to correct a mistake.
And this is something that we received out of the actual recorder's office.
They told us that those dates should not generally be changing.
your date of registration should be your date of registration.
And it says there at the end, the only time a voter may have two dates of registration is if the registration has previously been canceled and the voter registers again.
The original record would be canceled for a variety of reasons and then they'll have a new record with a new date of registration.
So the old record should not exist and it should not have a date of registration change.
Otherwise we have this thing called AFSEQ and AFSEQ is actually a unique identifier that is a reference to a transaction.
So for example, if you went and you...
Um...
Needed to change your address.
You would fill out a form, and when you filled out that form, you would turn it into the recorder's office, and they would image that, and they would process it.
And when they processed it, they would assign it a unique identifier.
That unique identifier actually gets stored in your voter rolls as the latest one, and it is specific to that change request.
So those should be unique.
You should not even have it twice in your voter rolls.
It should only happen once and it should not be shared among multiple individuals.
And this is something, again, we confirmed with the recorder's office.
Thank you.
Now, we also have a statute that says complete names should be used, and that'll get into our findings that we have here in a second.
So we had as many as 5,047 individuals who voted in more than one county for up to 5,295 additional votes if these are duplicates.
Now I will tell you that these individuals had the same name, first, middle, and last name, and the same exact birth year because that's what's in the voter rolls.
But if you have an extremely common last name, which can happen, there's some of these may in fact just be individuals with the same exact name and the same exact birth year.
We have no way to validate that 100%.
We had 393 voters with incomplete names that voted in the election.
This includes individuals with last name only.
Last name is just an initial.
There's no last name.
Our first name is just an initial.
And again, there are some individuals who in some cases this could happen, but this is not a frequent thing that you typically see.
We also had 198 individuals who registered after the October 15th cutoff and yet still voted in the election.
And we had 2,861 voters who have shared an AFSEC number with another voter at some point in time.
And that does not, we don't know exactly what that means, but based on the descriptions of everything that's happened in the system, it suggests there may be some integrity issues with the data.
When impossible situations happen in a system, and if you've got integrity systems in something as important as the voter rolls, there would be a concern.
We have 282 potentially deceased voters in this election.
I know that there's been some much wider numbers that have been circulated on the internet.
We tried to validate this stuff very, very precisely.
It can be a difficult thing to match up voter rolls to individuals.
From our testing, we believe that all the ones we have in here are accurate, but there are potentially additional ones as well.
We have 186 people who potentially duplicate voter IDs that both voted.
I think that Dr. Shiva was mentioning that we haven't had individuals with the same first name, last name, and the same address and seem to have the same signature.
That is something that we have also seen in the voter rolls with people who seem to have literally the same exact name.
We have 186 people.
That's the case where they actually have the first name and last name and the address.
all match up, and year of birth.
Okay.
Because the assumption would be you might have a junior in a different place, and so they'd have a different date of birth associated with it, but not the same address.
And that is the end of the presentation for right now.
With that, I'm going to hand it off to Ben Cotton, who's going to go over our digital findings.
Thank you.
Mr. Cotton, when you start, could you just give us a little bit of your background, please, and then proceed.
ben cotton ▲ ● ▼
I'd be glad to, Madam President.
Thank you very much.
unidentified
Sorry, once again, can you pull that mic up further for you?
ben cotton ▲ ● ▼
Thank you very much for the opportunity to participate in this historic analysis of the voting systems of Maricopa County.
By way of background, I hold a Master's Degree in Information Technology from the University of Maryland.
I have a CISSP certification.
I have various forensic certifications.
I actually served as a contract instructor for Guidance Software, the maker of NCASE and NCASE Enterprise Software.
They're now owned by Open Text.
I have 25 plus years of doing digital forensics, incident response.
And examinations in support of both government and private industry.
I have served as an expert witness on multiple occasions and I've also testified before Congress as part of my service prior to My digital forensics background for the last 25 years.
I also served 21 years as a TAB qualified Special Forces soldier serving this country and defending our freedoms.
I recognize How critically important the voter integrity is to this nation.
And this again, Madam President, I agree with you.
This is not a left issue.
This is not a right issue.
This is an American issue.
And as I as I talk about this, you know, I would hope that the findings of this audit We'll be turned into actionable, legislative, meaningful product that we can move forward and secure these elections moving forward.
So as I talk today, people may have heard some of my previous testimony.
unidentified
And this is not working.
So, I'm going to go ahead and get started.
Stand by, everybody.
Clean up the PowerPoint.
I'm going to go ahead and get started.
Okay.
Go ahead.
Okay.
You're watching right now, we're watching live from Arizona the hearing that is the the presentation of the full forensic audit.
Ben Cotton, now one of the cyber experts.
ben cotton ▲ ● ▼
As we're talking about these things, you may have heard on some of the previous hearings that we had.
A few of these will be redundant, but it's important to reiterate these findings in the course of this final hearing.
So we'll talk about the withheld devices and data and how that impacted our ability to provide a complete report to the Senate here today.
We'll talk about the cybersecurity issues that we have found, the hardware configuration control issues, file deletions,
The failure on the part of the county to preserve election artifacts, anonymous logins, and I might add atypical anonymous logins that are present on the systems, the listening ports and attempted connections on boot up, and internet connections and internet history that was found on these devices as part of the course.
unidentified
Next slide, please.
ben cotton ▲ ● ▼
So let's talk about the withheld devices for a moment here.
As with any audit, access to information and the right information in a timely manner is absolutely critical to finding a complete result for an investigation.
In the case of this audit, we were never provided access to the routers and network-related data.
That becomes very impactful when we start talking about validating and confirming unauthorized accesses to the election management system itself and to the other devices.
I would like to sit here today and tell you that I had fully ruled out any unauthorized access, but given the lack of access to this information, I cannot do that at this time.
It is our understanding that there has been an agreement reached with the Maricopa County and I look forward to getting access to this data so that we can complete these findings.
We were not provided the poll worker laptops.
Now these are the laptops that poll workers use at each precinct to validate the voters and to interact with election related functions at that particular precinct.
We were not provided any of the ICX devices.
So the ICX devices are used for handicapped and other graphically required interfaces with the voting systems.
We know that the county had a number of these based on the historical video from the M-TEC, but we were not provided any of those.
We were not provided with the ICP credentials to validate the configuration settings or the administrative Settings on the actual scanners, the ICPs.
This was critical and a significant short finding in that I cannot sit here today and tell you whether or not the wireless modems were enabled and connected to the Internet at the time of the vote.
I cannot sit here and tell you today what the status was of the LAN connections that we know We're inherent to those devices as part of the purchase from or the lease from Dominion.
unidentified
Okay.
ben cotton ▲ ● ▼
Let's go a little deeper into the cybersecurity issues as we found them.
Actually, you've skipped a slide.
Or no, I'm sorry.
So let's talk about the... Go back one slide, please.
Let's talk about the cybersecurity issues now.
The Department of Homeland Security has a division called CISA.
And CESA has a recommendation that's published on the Internet for how to configure and manage election systems that is freely available and it's recognized as kind of the gold standard for securing an election system.
I will tell you that every item up here is part of that recommendation from CESA.
I will tell you that in Maricopa County, they failed to perform basic operating system patch management functions.
Now let me explain that for a bit.
So if you have a home computer, you realize that every Thursday or Wednesday, depending on your cycle, Microsoft will release a security patch to correct vulnerabilities that have been discovered since they released the operating system and it was installed on your computer.
The last time that the operating system was patched on the Maricopa County election systems was the date that they installed the Dominion software, which was the 6th of August of 2019.
So at the time of election, it had been over a year since that system had been patched.
We found that that was also the same case with the antivirus definitions.
So we know, as part of this world that we live in, that people are coming up with new ways to hack a system, to exploit vulnerabilities and get unauthorized access to the systems.
And they're doing this continually.
All major security vendors update their antivirus at least on a weekly basis to make sure that we can protect our systems from these newly originated vulnerabilities and exploits.
The last time that the antivirus had been updated on the Maricopa County systems was the 6th of August 2019.
Now, Maricopa County did release a statement saying that if they had patched the operating system, or if they had updated the antivirus, that that would have invalidated the EAC certification for the voting system itself.
Obviously, there are a couple of issues with this position.
And the first one is that we are relying on a certification system that would impose obsolescence instead of security in the very act of trying to secure a voting system.
That is nonsensical and it should never occur.
So if that is in fact the case, we need to take a very close look At what we're relying on to validate and certify these election systems and software to ensure that we're not certifying guaranteed obsolescence of the system.
Now let's assume for a moment that what Maricopa County said was true.
That they could not update those systems because of this certification issue.
There are a couple of problems with that, as borne out by the artifacts on the actual EMS server itself.
So if that is true, then that would mean that no new executable files, no new dynamic link libraries could be created or modified on that system after the date of the software installation, which, once again, was 6 August 2019.
What we found is that there are four executable files that were created after this date of Dominion install.
There were 45 executable files that were modified after this date of install.
There were 377 dynamic link library files which were created after the Dominion software install.
And there were 1,053 DLL files that were modified after this date.
So if we assume that what the county represented is true, then in fact, that voting system would not have been certified at the time of the election.
Let's talk a little bit about log management here.
So there is a federal statute that requires the preservation of election related materials for 22 months after the date of the election.
That applies not only to paper, but that also applies to digital artifacts.
Maricopa County failed to preserve the operating system security logs to cover the dates of the election.
They provided security logs early in the audit process, but they did not provide the Windows security log itself.
When we examined the EMS server, we found that the dates covered by the security log only went back as far as the 5th of February, 2021.
There's a couple reasons for that, and we'll go into those later, but the bottom line is that they failed to preserve those logs, or at least those logs were not turned over to the auditors.
And so I'm assuming, since they were part of the subpoena, that those should have been provided had they been present.
Next item there is credential management.
This is probably the most offensive item on this list to me because it carries such a huge impact on the securability of a system.
What we found is that for the election management system, the adjudication systems, the ICCs, and all of the voting related systems, they all shared a common password For both user accounts and for administrative accounts.
And just to be crystal clear, it was the same password for all those accounts.
So, to complicate matters as well, those accounts had not been changed since the installation of the software.
So they were established on the 6th of August 2019 and never changed.
There furthermore was not an individual accountability of the users who access specific accounts so that you could tie a username and action and an individual when you discovered something that was an anomaly.
We did not see any software or any effort to establish and monitor a host baseline of programs and processes.
Furthermore, we did not see any log aggregation or methodology by which to establish and monitor the network communications for this system.
There simply was none of that software present on any of these devices.
Next slide, please.
We also didn't saw and detected That there was a failure in hardware configuration within the voting system.
Now what you're seeing right here is the system, the acquisition photos for the system that was identified as the adjudication 2 workstation.
Now you will see in that picture that there are two hard drives that came out of that system.
It's not uncommon to have two hard drives in a system for data storage, etc, etc.
However, Both of those hard drives are bootable.
So what that means is that you can boot from a hard drive that is not part of the election configuration and have access to the election network.
Very important.
It's clearly not an approved configuration.
It was the only system that we found a dual boot situation.
Now to further complicate matters a little bit, and I'm not going to make judgment as to the legality of this or whether or not this deserves further action, is that on that second bootable hard drive there appeared to be non-Maricopa County data.
So let me define that a little bit.
On that hard drive there were Dominion databases Okay.
that appeared to be one, demonstration data, but also data that may have originated from Washington State and South Carolina. And I derived that not from an in-depth investigation of the data, that was outside my scope, but from the naming conventions of the databases themselves. So, once again, validating and approving the
configuration of these systems is critically important to preserving the integrity of that election system.
I would also note that neither of the two audits commissioned by Maricopa County discovered this as a finding.
Next slide, please.
These are simply some screenshots of that data from the forensics platform.
To show I'm not making this stuff up.
Next slide.
One of the challenges that we had was actually accountability of deleted items.
We had talked about deleted items before.
Let's be crystal clear about this.
From the EMS, which is the Election Management System server, on the C drive, there were 865 directories and 85,673 election-related files deleted between 10-28 and 11-05-2020.
and 85,673 election-related files deleted between 10-28 and 11-05-2020.
Now, those files included S-logs, which are the logs that are created on the tabulating systems that record the vote.
They included scanned images of ballots.
You'll actually see a ballot there in the lower left.
And they also included some log files.
So what is difficult to determine is that I know they were deleted.
What I don't have is any accountability or any ability to track from a evidence management perspective how those deleted files were treated and what happened to them if they were archived or not.
I simply don't have any record of those files being hashed with an MD5 hash to preserve the integrity of the file or where they ended up going.
Next slide please.
One other item there is that there are a .dvd file, and those are actually the results of the election totals off of each tabulating device.
And those were part of the deleted files that were removed from the EMS.
The EMS actually had two hard drives.
Well, they had six hard drives configured into two logical drives.
So the second logical drive was called the D drive and that... Okay, you're watching War Room.
unidentified
We're live at the Arizona Senate.
I've seen the presentation of the Full Forensic Audit.
Short commercial break here in real America's Voice.
We're going to be back in a moment.
We're going to keep it in the box so you can continue to watch it.
Stay around for our second hour of the live hearing of the Full Forensic Audit.
Back in a moment.
▲
Export Selection