2020-11-17 TRO Motion With Exhibits

Case 1:20-cv-04651-SDG Document 6 Filed 11/17/20 Page 1 of 29

Case 1:20-cv-04651-SDG Document 6-1 Filed 11/17/20 Page 1 of 6
Democratic Party of Georgia, et al. v.

Raffensperger, et al.
Ex. A to TRO Motion:

Litigation Settlement




/s/ Bruce V. Spiva /s/ Vincent R. Russo
*Admitted Pro Hac Vice
Counsel for State Defendants
Counsel for Plaintiffs

Ex. B to TRO Motion:

Coleman Affidavit

Coleman Affidavit

Coleman Affidavit

Coleman Affidavit
Ex. C to TRO Motion:

Diedrich Affidavit

Diedrich Affidavit

Diedrich Affidavit

Diedrich Affidavit

Diedrich Affidavit
Ex. D to TRO Motion:

Voyles Affidavit

Voyles Affidavit

Voyles Affidavit

Voyles Affidavit

Voyles Affidavit

Voyles Affidavit

Voyles Affidavit

Voyles Affidavit

Voyles Affidavit

Voyles Affidavit
Ex. E to TRO Motion:

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit

Zeher Affidavit
UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF GEORGIA
ATLANTA DIVISION
L. LIN WOOD,JR.,
Plaintiff, CIVIL ACTION FILE NO.

l:20-cv-04651-SDG
V.
BRAD RAFFENSPERGER,in his official

capacity as Secretary of State of the State
of Georgia,REBECCA N.SULLIVAN,
in her offlcial capacity as Vice Chair of
the Georgia State Election Board,
DAVID J. WORLEY,in his official
capacity as a Member of the Georgia
State Election Board, MATTHEW
MASHBURN,in his official capacity as
a Member of the Georgia State Election
Board,and ANH LE,in her official
State Election Board,
Defendants.
AFFIDAVIT OF MAYRA ROMERA IN SUPPORT OF PLAINTIFF'S

MOTION FOR TEMPORARY RESTRAINING ORDER
I, Mayra Romera, declare under penalty of perjury that the following is true
and correct:
{00584021.}
Ex. F to TRO Motion:

Romero Affidavit
1.1 am over the age of 18 years and competent to testify herein. I have
personal knowledge ofthe matters stated herein.
2.1 am a Florida Bar licensed paralegal.
3.1 am a registered Democrat.
4.1 was interested in the election process in this country and wanted to be an
observer in the Georgia recount process.
5. On Monday, November 16, 2020, I presented myself to Cobb County Poll
Precinct located at 2245 Callaway Road SW, Marietta, OA. I was able to be
on the floor observing the recount process in Room C. I observed the poll
workers not calling out verbally the names on each ballot. They simply
passed each ballot to each other in silence.
6. It was of particular interest to me that hundreds ofthese ballots seemed
impeccable, with no folds or creases. The bubble selections were perfectly
made (all within the circle), only observed selections in black ink, and all
happened to be selections for Biden.
7. It was also of particular interest to me to see that signatures were not being
verified and there were no corresponding envelopes seen in site.
{00584021.}

Romero Affidavit
8. At one point in time, while on the floor, I overheard a woman tell someone
else that they should keep an eye on the guy with a blue blazer and a pocket
square, that he was not allowed to come on the floor and observe past the
yellow tape. They also kept an eye on him as he took photographs and video
of some boxes being stored on a rack. Shortly thereafter, I observed a police
officer standing at the door. I had not observed a police officer present up
until that moment. They began to walk towards him to stop him as he was
photographing those boxes, but at that point, he walked away from that area.
9. Based on my observations, I believe there was fraud was committed in the
presidential election and question the validity of the Georgia recount
process.
[SIGNATURE AND OATH ON NEXT PAGE]
{00584021.}

Romero Affidavit
I declare under penalty of perjury that the foregoing statements are true and
correct.
MayraL. Romera
STATE OF GEORGIA
COUNTY OF FULTON
Mayra L. Romera appeared before me, a Notary Public in and for the above
jurisdiction, this 17th day of November 2020, and after being duly sworn, made this
Declaration, under oath.
I \
[Affix Se^J ^
jtary Public
My Commission Expires_ (yi'i'\'2DzU
{00584021.)

Romero Affidavit

ATLANTA DIVISION
L. LIN WOOD,JR.,

l:20-cv-04651-SDG
V.

in her official capacity as Vice Chair of
MASHBURN,in his offlcial capacity as
Defendants.
AFFIDAVIT OF IBRAHIM REYES.ESOUIRE IN

ISUPPORT OF PLAINTIFF'S MOTION FOR TEMPORARY
RESTRAINING ORDER
I, Ibrahim Reyes, declare under penalty of perjury that the following is true
and correct:
1. My name is Ibrahim Reyes. I am an attorney licensed to practice law in the
State of Florida since 2002, my office address is 236 Valencia Avenue, Coral
Gables, FL 33134, and my email address is [email protected].
{00584025. }
Ex. G to TRO Motion:
Reyes Affidavit
2.1 am over the age of 18 years and competent to testify herein. I have personal
knowledge ofthe matters stated herein.
3.1 volimteered to assist in the manual recount in the State of Georgia and was
assigned to work as a Monitor and as a member ofthe Vote Review Panel.
4. On November 16, 2020,1 went to Clayton County from 8:00 A.M. to 6:00
P.M.
5.1 identified myself as a Monitor and Vote Review Panel associated with the
Republican Party, and the person in charge ofthe Clayton County precinct, Erica
Johnston, said that I could not be present on the floor until I received a badge
with my name,that it would be printed shortly, within thirty minutes, but could
stand in the observers area, away from the counting tables.
6.1 did not receive my identification badge until three hours, so I was prevented
from acting as a Monitor all morning.
7. However,as an observer,I observed that the precinct had twelve(12)counting
tables, but only one (1) monitor from the Republican Party. I brought it up to
Erica Johnston since the recount rules provided for one (1) monitor from each
Party per ten(10)tables or part thereof.
8. Erica Johnston said that I was wrong,that there were only ten tables counting
and explained that because there were ten tables, not twenty, only one monitor
was allowed. I explained to her that there were twelve tables counting, and
{00584025. }
Reyes Affidavit
that the rules did not state what she said, and read to her the rule, which I had on
my phone.
9. Erica Johnston proceeded to tell me that it did not matter, that she was in
charge, and that unless there were twenty tables, one monitor for twelve tables
was fine because ofthe limited space. I explained that I did not note an exception
where due to limited space, she could individually determine how many
Monitors to allow, and that she had created her own rules for the manual recount,
which precluded Republican Monitors from monitoring the recount. Erica
Johnston said that if I continued to insist on having one more Monitor for the
Republican Party, she would call the Police.
10.We were inside the Clayton County Police Department. I pointed her where
a Police officer was and asked her to call her over. I explained to the female
police officer that the Clayton County precinct was not counting ballots following
the rules for counting ballots, and I was requesting Erica Johnston to follow the
rules. The police officer told me that she could not do anything about it.
11.A Clayton County journalist named Robin Kemp of @RKempNews,
overheard the exchange, as a member ofthe media went in and photographed the
twelve (12) counting tables, confirmed to me that she had seen twelve counting
tables, and published it in Twitter.
{00584025. }
Reyes Affidavit
12.Soon thereafter, before noon, we were notified that the location would close,
and the recount would be moved to Jackson Elementary to allow for more space
and more monitors.
13. The recount resumed at Jackson Elementary on or about 1:30 P.M., after
boxes of ballots were brought in a Clayton County white van with tag GV57976
and taken into Jackson Elementary.
14.1 had my identification badge by then, so I went in and noticed that one
Republican Monitor was allowed, yet now there were twenty six(26)tables, and
informed Erica Johnston that, again, if there were twenty six tables for
recounting, three(3)monitors from each Party were to be permitted.
15.Erica Johnston told me that she was in charge, and that I should stop
interfering with the process. I informed Erica Johnston that she was interfering
with the process, since she was not following the recount rules, knowingly.
16.At that point in time, a young man named Trevin McKoy,associated with the
Georgia Republican Party, told Erica Johnston that the Republicans were
entitled to three, not one. Monitor, since there were twenty-six tables. Erica
Johnston called over a Police officer. Officer Johnson, and Erica Johnston asked
Officer Johnson to remove Mr. McKoy from the building.
{00584025.)
Reyes Affidavit
17.1 intervened and explained to Officer Johnson that Erica Johnston was not
following the rules, and Officer Johnson replied that Erica Johnston was in
charge, and that we were not in a Courtroom.
18.1 walked outside with Trevin McKoy,and so did the journalist, Robin Kemp,
who proceeded to publish the violation of rules on her Twitter account.
19.Within five minutes of the Twitter having been published. Erica Johnston
approached me and told me that the Republicans could have two additional
Monitors, and two additional Monitors went on the floor.
20.She also offered me to participate in the Voting Review Panel, which I did
until 6:00 P.M.
21.As a Voting Review Panel member, I sat next to two counting tables, and
monitored whether counters were following the rules.
22.For example,the procedure required that the two counters sitting next to each
other would recite the name of the candidate for whom the vote was cast, one
first, the second after, to confirm agreement, and then place the 'ballot' on the
appropriate stack. Trump,Biden, etc.
23.The counters on the two tables next to my table were not doing that, and I
served as a next to them for over three hours. One would give a 'ballot' to the
next, and the next would place it on top ofone ofthe stacks, without confirmation
from counter 2 to counter 1.
{00584025.)
Reyes Affidavit
24,1 witnessed that Erica Johnston did not follow the rules until I complained,
and journalist Robin Kemp published the violations on her Twitter account.
25.1 also witnessed that Officer Johnson, of the Clayton County Police
Department, removed Trevin McKoy from the Jackson Elementary precinct only
because Erica Johnston told him to remove him, even though Trevin McKoy had
not done or said anything improper.
26.1 also observed that the precinct had Democratic Party monitors, Republican
Party monitors, and Carter Center monitors, and only Republican Monitors were
being mistreated by Erica Johnston and by Officer Johnson.
{00584025. }
Reyes Affidavit
correct
STATE OF GEORGIA
COUNTY OF FULTON
Ibrahim Reyes appeared before me, a Notary Public in and for the above
jurisdiction, this 17*^ day of November 2020, and after being duly sworn, made this
V
I / I
[Affix-Seall qI .o,'A, 'JJAi d.
Notary Public
COBB
My Commission Expires
{00584025. } 7
Reyes Affidavit
11/17/2020
Case 1:20-cv-04651-SDG Document
05:54PM
6-8& CONNIE
JIM Filed 11/17/20
JGHNSGN Page 1 of 3 PAGE 01/03

ATLANTA DIVISION
L.LIN WOOD,JR.

l:20-cv-04651-SDG
V.
BRAD RAFFENSPERGER,in Ms official

of Geoi^ia,REBECCA N.SULLIVAN,
State Election Board,MATTHEW
MASHBURN,in Ms official capacity as
a Member ofthe Georgia State Election
Board,and ANH L£,in her official
Defendants.
AFFIDAVIT OF CQNSETTA S.JOHNSON IN SUPPORT OF

PLAINTIFF'SMOTTON FOR TEMPORARY RESTRAINING ORDER
I, Consetta S, Johnson, declare imder penalty of pequiy that the following is

true and correct;
1, I am over the age of 18 years and competent to testify herein. 1 have personal

{00534a2&}
Ex. H to TRO Motion:

Johnston Affidavit
11/17/2020 Case
05:54PM 1:20-cv-04651-SDG DocumentJIM
6-8S CONNIE
Filed 11/17/20
JOHNSON Page 2 of 3 PAGE 02/03
2. I was a volunteer audit monitor at the Jim R. Miller Park for the recount process
on November 16,2020.
3. As a floor monitor, I could see by the markings that the ballots being audited
were absentee ballots.
4. I witnessed two poll workers placing already separated paper machine receipt
ballots with barcodes in the Trump tray, placing them in to the Biden tray.
5. I also witnessed the same two poll workers putting the already separated paper
receipt ballots in the'No Vote" and "Jorgensen" tray, and removing them and
putting them inside the Biden tray.
6. They then took out all of the ballots out of the Biden tray and stacked them on
the table, writing on the count ballot sheet. A copy ofthe video reflecting this is
attached as Exhibit A.
7. Although I observed a supervisor provide guidance and instructions, the process

was not uniform, and most poll workers were working in their own format and
style.
8. I also observed the poll workers not calling out verbally the names ofeach ballot.
They simply passed each ballot to each other in silence.
9. I believe the Board of Elections operations were sloppy, unorganized, and

suspicious. As an observer I could not observe presidential vote preference
{(»Sa4Q2&}

Johnston Affidavit
11/17/2020 Case
05:54PM 1:20-cv-04651-SDG DocumentJIM
6-8& CONNIE
Filed 11/17/20
JOHNSON Page 3 of 3 PAGE 03/03
because the font size of the machine paper printed ballots were diflScult to read
from my distance. This is my personal experience.
I declare under penalty of pequiy that the foregoing statements are true and
correct
Consetta S. ^hng^S
STATE OF GEORGIA
COUNTY OF COBB
Consetta S. Johnson appeared before me,a Notary Public in and for the above
jurisdiction, this 17^ day ofNovember 2020,and after being duly sworn, made this
Declaration, under pathj'
[Affix Seal] cob6<^V

' taty Public
(005a4Q2&}

Johnston Affidavit

ATLANTA DIVISION
L. LIN WOOD,JR.,

l:20-cv-04651-SDG
V.

in her offlcial capacity as Vice Chair of
Defendants.
AFFIDAVIT OF CARLOS E. SILVA IN SUPPORT OF PLAINTIFF'S

MOTION FOR TEMPORARY RESTRAINING ORDER
I, Carlos E. Silva, declare under penalty of perjury that the following is true
and correct:
{00584033.}
Ex. I to TRO Motion:

Silva Affidavit
1.1 am over the age of 18 years and competent to testify herein. I have
personal knowledge ofthe matters stated herein.
2.1 am and have been a Florida trial lawyer for over 26 years.
3.1 am a registered Democrat.
4. Me and several people from my firm were very interested in the election
process in this country and wanted to be observers in the Georgia recount
process to see if we had a valid, secure and non-biased voting system.
5. On Sunday, November 15, 20201 arrived to Dekalb County Poll Precinct
located at 2998 Turner Hill Road, Stonecrest, OA 30038.
6.1 was allowed to be an observer and walked over to a table oftwo women
counting votes.
7.1 watched them pull out a pile of what I observed to be absentee ballots and
noticed two very distinct characteristics that these ballots had. One,I noticed
that they all had a perfect black bubble and were all Biden select. I was able
to observe the perfect bubble for a few minutes before they made me move
away from the table. At no time did I speak to the poll workers or obstruct
them in any way. I heard them go through the stack and call out Biden's
name over 500 times in a row.
{00584033.}

Silva Affidavit
8. On the following day, on November 16, 2020, I presented myself to Cobb
County Poll Precinct located at 2245 Callaway Road SW, Marietta, GA. At
first, I was standing next to the panel reviewers in Room B, where I observed
absentee ballots being reviewed with the same perfect bubble that I had seen
the night before at Dekalb County. All of these ballots had the same two
characteristics: they were all for Biden and had the same perfect black bubble.
9. After being there for over an hour, I walked over to Room C where the
absentee ballots were being manually recounted (audited). While in this room,
I did not hear a verbal callout as to each ballot as I had heard the day before
in Dekalb County. It was instead, done in a silent manner between both poll
workers.
lO.I was able to visualize the perfect bubble with the name Biden on it for
approximately ten minutes before a female middle aged (blonde hair with
glasses)supervisor in a ski jacket asked me to move ten feet away and refused
to give me her name. Later on, one of the people traveling with me from my
office, heard her say to keep an eye on the guy with a blue blazer and a pocket
square, he is not allowed to come on the floor and observe past the yellow
tape. I was the only one wearing a blue blazer with a pocket square.
{00584033.)

Silva Affidavit
11.1 also observed a dispute at one ofthe tables between an observer and
a male supervisor(perhaps in his mid-thirties) who stated that a box had been
certified incorrectly because the recount number was different than the
original number. The observer was also upset because nothing was done about
it.
12.1 also saw absentee ballots for Trump inserted into Biden's stack and were
counted as Biden votes. This occurred a few times.
13.1 also observed throughout my three days in Atlanta, not once did anyone
verify signatures on these ballots. In fact, there was no authentication process
in place and no envelopes were observed or allowed to be observed.
14.1 saw hostility towards Republican observers but never towards Democrat
observers. Both were identified by badges.
15.Lastly, after my frustrating experience, I decided to try to speak one of the

poll workers after hours. I identified myself as an observer that wanted to
know more about the process and any pressure he may have been under. He
advised that they, as poll workers, have been prohibited to speak to observers
at any time, and that the pressure they have been under by their supeiwisors
has been great. Not only in the speed of counting, but in reference to
{00584033.}

Silva Affidavit
irregularities that he was not at liberty to discuss with me. I asked him if he
could find some time to speak with me after he was done counting and relieved
of his duties and he said he was advised to never speak to anyone about the
process.
16.Based on my observations, I have reached the conclusion that in the counties
I have observed,there is widespread fraud favoring candidate Biden only.
There were thousands of ballots thatjust had the perfect bubble marked for
Biden and no other markings in the rest of the ballot.
{00584033.)

Silva Affidavit
correct.
STATE OF GEORGIA
COUNTY OF FULTON
Carlos E. Silva appeared before me, a Notary Public in and for the
above jurisdiction, this _j^day of November 2020, and after being duly sworn,
made this Declaration, under oath.
[A% l'(ikk)!
U
M L.
Notary Public
My Commission Expires_
{00584033.2 )

Silva Affidavit
Ex. J to TRO Motion:

O'Neal Affidavit

O'Neal Affidavit

O'Neal Affidavit

O'Neal Affidavit

O'Neal Affidavit

O'Neal Affidavit

ATLANTA DIVISION
L. LIN WOOD,JR.,

l:20-cv-04651-SDG
V.

Board, and ANH LE,in her official
Defendants.
AFFIDAVIT OF DEBRA J. FISHER IN SUPPORT OF

PLAINTIFF^S MOTION FOR TEMPORARY RESTRAINING ORDER
I, Debra J. Fisher, declare under penalty of perjury that the following is true
and correct:
{00584029.)
Ex. K to TRO Motion:

Fisher Affidavit
1. I am over the age of 18 years and competent to testify herein. I have personal
2. On November 16,2020 I witnessed the various issues on military and overseas
ballots.
3. All military and overseas ballots I reviewed were very clean. No bubbles were
colored outside of the line. Not one ballot used an "x" or check mark. The
ballots I observed were marked in black ink and were for Biden. Not one ballot
had a selection crossed out to change the vote selection.
4. I noticed that almost all ofthe ballots I reviewed were for Biden. Many batches
went 100% for Biden.
5. I also observed that the watermark on at least 3 ballots were solid gray instead
of transparent, leading me to believe the ballot was counterfeit. I challenged
this and the Elections Director said it was a legitimate ballot and was due to the
use of different printers.
6. Many ballots had markings for Biden only, and no markings on the rest of the
ballot. This did not occur on any ofthe Trump ballots I observed.
7. Ballots were rejected because people chose 2 or more candidates.I found it odd
that none ofthis happened with the military ballots.
{00584029.}

Fisher Affidavit
8. The military ballots did not have one specific precinct code on them. Instead,
they had multiple precincts printed on it(a"combo"),I challenged this as when
this is done, you do not know what precinct the voter is registered in.
9. Based on my observations above and the fact that signatures on the ballots were
not being verified, I believe the military ballots are highly suspicious offraud.
correct.
{00584029.}

Fisher Affidavit
correct
Debra J. Fishe
STATE OF GEORGIA
COUNTY OF COBB
Debra J. Fisher appeared before me, a Notary Public in and for the above
jurisdiction, this 17*^ day of November 2020, and after being duly sworn, made this
r^.'O =
[AffixIS^al]- - - - -
otary Public
(005«4iSS.J

Fisher Affidavit

ATLANTA DIVISION
L. LIN WOOD,JR.,

l:20-cv-04651-SDG
V.

of Georgia,REBECCA N. SULLIVAN,
Board, and ANH LE,in her official
Defendants.
AFFIDAVIT OF TIFFANY SAVAGE IN SUPPORT OF

PLAINTIFFS'MOTION FOR TEMPORARY RESTRAINING ORDER
I, Tiffany Savage, declare under penalty of perjury that the following is true
and correct:
1. I am over the age of 18 years and competent to testify herein. I have personal
knowledge ofthe matters stated herein. I am a resident of Gwinnett County.
My husband and I own two small businesses in Gwinnett County.
{00584011.}
Ex. L to TRO Motion:

Savage Affidavit
2. I volunteered to be a monitor for the Donald J. Trump Presidential Campaign,
Inc.(the "Trump Campaign")in connection with what was identified to me as
the "hand count" of votes cast in the November 3, 2020 presidential election.
I was assigned to monitor the hand count on November 14 through 17.
3. I was assigned to be an official monitor at the location at Beauty P. Baldwin
Voter Registrations and Elections Building in Lawrenceville. I believed that
we were there to watch actual "hand counting" as had been announced in the
newspapers and by the Secretary of State when he requested a "hand count."
4. In the course of monitoring on November 14,1 noticed some major red flags
that undermined the fairness ofthe process. I do not see these being addressed
in a way that is fair and equitable.
5. Ballots were being grouped into batches. It was not clear for what purpose.
They were not being counted,as far as I could tell. I do not know what training
or instruction had been given to these groupers, but the activity seemed
meaningless.
6. Envelopes from mail in ballots had been separated from the signatures on the
absentee ballot eternal envelopes. Electors during in-person early voting or
on Election Day were required to show identification; signature verification
was not available for audit in the recount.
{00584011.)

Savage Affidavit
7. Batches of ballots were marked with discrepancies on post it notes. See
picture on Annex 1. Ballots were placed in unmarked bins that are unattended
or just placed randomly on a counter just lying around. There appeared to be
little, if any, supervision, or control. I saw at least one open ballot box
(container ABM5B/ 31148252). See picture on Annex 1.
8. Four hours after a shift change, at many stations (at least 4 that I could see),
the counters were not counting ballots correctly. Instead of the "pass count"
for dual control purposes,counters were opening ballot batches independently
and "fast counting."
9. I reported the fast counting, and announcement was made to cause the
counters to use a confirmed process for reviewing and counting the ballots.
Perhaps there had been some training, but it seemed inconsistent. But even
after an announcement was made asking them to resume "pass counting." they
continued to batch and group "just get it over with."
10.Unsecured, completed ballot boxes were left all day when they should have
been secured by the(green)numbered lock tags. The security tags were being
used to lock the bags of ballots, but they were lying around in the open and
could have been used by anyone. See picture on Annex 1. There was no
permanent processing of assigning a tag number to a bag, so every bag was
{00584011.}

Savage Affidavit
vulnerable to opening,tampering, and relocking at any point in time when the
room was not being monitored.
11.The counters did not note the time verification on the machine-read voting
ballots.
12.1 overheard a poll official saying that damaged ballots were being or had been
"duplicated." I am not allowed to directly interact with a poll official, so I
could not ask what that official meant by that statement. There were hundreds
of damaged or voided ballots(which were all duplicated).
13.On November 15, 2020, the counting continued in the same haphazard way
until 2:48 p.m., when counting was stopped because the laptops all "went
down." The official counting did not resume that day but at 5:00 p.m., the
counters were dismissed due to "counter fatigue."
14.Batches of ballots were sitting around unattended. The ballot boxes were
locked with green security tags on the front but could be opened from the other
side without cutting the green security tag. The boxes are not secured.
15.*Gwinnett Election informed that the Green security tag numbers are not
documented and maintained anywhere except on a Post-it note inside the box.
The bag numbers are not kept in an independent location, so the ballots are
subject to tampering. The tags can be cut, the ballot box opened, ballots can
{00584011.)

Savage Affidavit
be manipulated. And a new Post-it note can be placed inside the box with the
new (not original) green security tag when the boxes are unmonitored.
16.The "24 hour camera feed" only shows ballot counters, not the voter review
or "secured ballot boxes." The 24 hour camera feed is closed off after hours
and appears dark.
17.All officers, who work for sheriff office, left the building when the counters
left. Yet persons with badges were exiting and entering the building and
walking out with folders.
18.After hours, anyone with a key to the building can have access to the open
room and this counting area.
19.1 returned on November 16 and witnessed the same level of confusion as the
14^ and 15^. On the 16*'', we were not permitted in the counting area until
9:30. At 8:30, all poll workers were released (approximately 75% of all
counters). The remaining counters did not appear to be aware of the rules,
and even when instructed, continued to blatantly disregard the counting
procedures.
20.The ballot box that had been left unsecured on November 14 was still
unsecured two days later. Green security tags were cut and replacement tags
were not being recorded properly.
{00584011.}

Savage Affidavit
21. Some ballot batch tally sheets have no number written at all in the Trump
column but include numbers for Biden; I regarded those as not likely to be
100% Biden votes in a given batch, butjust incomplete.
22.A laptop with access to the data entry system was left in the open area with
the password for the wifi and the laptop on a Post-it note affixed to the laptop.
When informed ofthis security breach, the supervisor simply said,"I know."
The "secured ballot counting area" was wide open to many people, even some
without a security badge.
23.One worker was entering numbers and writing on ballot sheets alone and out
ofsight ofthe security camera. When informed,the supervisor simply moved
her to another table.
24.The ballot batch tally sheets that are then given to the data entry tables were
marked in red pen. Red pens were left on the table, which would permit the
auditors to correct the ballot batch tally sheets they were auditing.
25.On November 17, the lack of security, confusion, and hostility to Republican
poll watchers continued. The supervisor placed a red line in tape across the
floor and instructed the poll watchers to stand behind the gold tape. There
was no way to see if the ballots were being read correctly. See picture on
Annex 1.
{00584011.}

Savage Affidavit

Savage Affidavit

Savage Affidavit

Savage Affidavit
Ex. M to TRO Motion:

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit

Peterford Affidavit
DECLARATION OF
I, , hereby state the following:
1.
2. I am an adult of sound mine. All statements in this declaration are based

on my personal knowledge and are true and correct.
3. I am making this statement voluntarily and on my own initiative. I have

not been promised, nor do I expect to receive, anything in exchange for my
testimony and giving this statement. I have no expectation of any profit
or reward and understand that there are those who may seek to harm me
for what I say in this statement. I have not participated in any political
process in the United States, have not supported any candidate for office
in the United States, am not legally permitted to vote in the United
States, and have never attempted to vote in the United States.
4. I want to alert the public and let the world know the truth about the
corruption, manipulation, and lies being committed by a conspiracy of
people and companies intent upon betraying the honest people of the
United States and their legally constituted institutions and fundamental
rights as citizens. This conspiracy began more than a decade ago in
Venezuela and has spread to countries all over the world. It is a conspiracy
to wrongfully gain and keep power and wealth. It involves political
leaders, powerful companies, and other persons whose purpose is to gain
and keep power by changing the free will of the people and subverting the
proper course of governing.
5.
Over the course of my career, I
specialized in the marines
6. Due to my training in special operations and my extensive military and

academic formations, I was selected for the national security guard detail
of the President of Venezuela.
- Page 1 of 8
Ex. N to TRO Motion:

Redacted Declaration

sophisticated electronic voting system that permitted the leaders of the

Venezuelan government to manipulate the tabulation of votes for national
and local elections and select the winner of those elections in order to gain
and maintain their power.
10. Importantly, I was a direct witness to the creation and operation of an

electronic voting system in a conspiracy between a company known as
Smartmatic and the leaders of conspiracy with the Venezuelan
government. This conspiracy specifically involved President Hugo Chavez
Frias, the person in charge of the National Electoral Council named Jorge
Rodriguez, and principals, representatives, and personnel from
Smartmatic which included . The
purpose of this conspiracy was to create and operate a voting system that
could change the votes in elections from votes against persons running
the Venezuelan government to votes in their favor in order to maintain
control of the government.
11. In mid-February of 2009, there was a national referendum to change the

Constitution of Venezuela to end term limits for elected officials, including
the President of Venezuela. The referendum passed. This permitted Hugo
Chavez to be re-elected an unlimited number of times.
12. After passage of the referendum, President Chavez instructed me to make

arrangements for him to meet with Jorge Rodriguez, then President of the
National Electoral Council, and three executives from Smartmatic.
Among the three Smartmatic representatives were
President Chavez had multiple meetings with Rodriguez

and the Smartmatic team at which I was present. In the first of four
meetings, Jorge Rodriguez promoted the idea to create software that
would manipulate elections. Chavez was very excited and made it clear
that he would provide whatever Smartmatic needed. He wanted them
immediately to create a voting system which would ensure that any time
anything was going to be voted on the voting system would guarantee
results that Chavez wanted. Chavez offered Smartmatic many
inducements, including large sums of money, for Smartmatic to create or
modify the voting system so that it would guarantee Chavez would win
every election cycle. Smartmatic eam ag eed to create such a system
and did so.
13. I arranged and attended three more meetings between President Chavez
and the representatives from Smartmatic at which details of the new
- Page 3 of 8

voting system were discussed and agreed upon. For each of these
meetings, I communicated directly with on details of
where and when to meet, where the participants would be picked up and
delivered to the meetings, and what was to be accomplished. At these
meetings, the participants called their project the Chavez revolution.
From that point on, Chavez never lost any election. In fact, he was able
to ensure wins for himself, his party, Congress persons and mayors from
townships.
14. Smartmatic electoral technology was called Sistema de Gestión

Electoral (the Electoral Management System ). Smartmatic was a
pioneer in this area of computing systems. Their system provided for
transmission of voting data over the internet to a computerized central
tabulating center. The voting machines themselves had a digital display,
fingerprint recognition feature to identify the voter, and printed out the
voter ballot. The voter thumbprint was linked to a computerized record
of that voter iden i . Sma ma ic c ea ed and e a ed he en i e
system.
15. Chavez was most insistent that Smartmatic design the system in a way
that the system could change the vote of each voter without being
detected. He wanted the software itself to function in such a manner that
if the voter were to place their thumb print or fingerprint on a scanner,
then the thumbprint would be tied to a record of the voter name and
identity as having voted, but that voter would not tracked to the changed
vote. He made it clear that the system would have to be setup to not leave
any evidence of the changed vote for a specific voter and that there would
be no evidence to show and nothing to contradict that the name or the
fingerprint or thumb print was going with a changed vote. Smartmatic
agreed to create such a system and produced the software and hardware
that accomplished that result for President Chavez.
16. After the Smartmatic Electoral Management System was put in place, I
closely observed several elections where the results were manipulated
using Smartmatic software. One such election was in December 2006
when Chavez was running against Rosales. Chavez won with a landslide
over Manuel Rosales - a margin of nearly 6 million votes for Chavez versus
3.7 million for Rosales.
17. On April 14, 2013, I witnessed another Venezuelan national election in

which the Smartmatic Electoral Management System was used to
manipulate and change the results for the person to succeed Hugo Chávez
- Page 4 of 8

as President. In that election, Nicolás Maduro ran against Capriles

Radonsky.
Inside that location was a control room in which there were

multiple digital display screens TV screens for results of voting in each
state in Venezuela. The actual voting results were fed into that room and
onto the displays over an internet feed, which was connected to a
sophisticated computer system created by Smartmatic. People in that
room were able to see in eal ime hether the vote that came through
the electronic voting system was in their favor or against them. If one
looked at any particular screen, they could determine that the vote from
any specific area or as a national total was going against either candidate.
Persons controlling the vote tabulation computer had the ability to change
the reporting of votes by moving votes from one candidate to another by
using the Smartmatic software.
18. By two o'clock in the afternoon on that election day Capriles Radonsky
was ahead of Nicolás Maduro by two million votes. When Maduro and his
supporters realized the size of Radonsky s lead they were worried that
they were in a crisis mode and would lose the election. The Smartmatic
machines used for voting in each state were connected to the internet and
reported their information over the internet to the Caracas control center
in real-time. So, the decision was made to reset the entire system.
Maduro s and his supporters ordered the network controllers to take the
internet itself offline in practically all parts in Venezuela and to change
the results.
19. It took the voting system operators approximately two hours to make the
adjustments in the vote from Radonsky to Maduro. Then, when they
turned the internet back on and the on-line reporting was up and running
again, they checked each screen state by state to be certain where they
could see that each vote was changed in favor of Nicholas Maduro. At that
moment the Smartmatic system changed votes that were for Capriles
Radonsky to Maduro. By the time the system operators finish, they had
achieved a convincing, but narrow victory of 200,000 votes for Maduro.
20. After Smartmatic created the voting system President Chavez wanted, he
exported the software and system all over Latin America. It was sent to
Bolivia, Nicaragua, Argentina, Ecuador, and Chile countries that were
in alliance with President Chavez. This was a group of leaders who
wanted to be able to guarantee they maintained power in their countries.
When Chavez died, Smartmatic was in a position of being the only
- Page 5 of 8

company that could guarantee results in Venezuelan elections for the

party in power.
21. I want to point out that the software and fundamental design of the
electronic electoral system and software of Dominion and other election
tabulating companies relies upon software that is a descendant of the
Smartmatic Electoral Management System. In short, the Smartmatic
software is in the DNA of every vote tabulating company software and
system.
22. Dominion is one of three major companies that tabulates votes in the
United States. Dominion uses the same methods and fundamentally same
software design for the storage, transfer and computation of voter
identification data and voting data. Dominion and Smartmatic did
business together. The software, hardware and system have the same
fundamental flaws which allow multiple opportunities to corrupt the data
and mask the process in a way that the average person cannot detect any
fraud or manipulation. The fact that the voting machine displays a voting
result that the voter intends and then prints out a paper ballot which
reflects that change does not matter. It is the software that counts the
digitized vote and reports the results. The software itself is the one that
changes the information electronically to the result that the operator of
the software and vote counting system intends to produce that counts.
That how it is done. So the software, the software itself configures the
vote and voting result -- changing the selection made by the voter. The
software decides the result regardless of what the voter votes.
23. All of the computer controlled voting tabulation is done in a closed

environment so that the voter and any observer cannot detect what is
taking place unless there is a malfunction or other event which causes the
observer to question the process. I saw first-hand that the manipulation
and changing of votes can be done in real-time at the secret counting
center which existed in Caracas, Venezuela. For me it was something
very surprising and disturbing. I was in awe because I had never been
present to actually see it occur and I saw it happen. So, I learned first-
hand that it doesn ma e ha he e decides or what the paper
ballot says. It he f a e e a and he f a e ha decide what
counts not the voter.
24. If one questions the reliability of my observations, they only have to read
the words of
a time period in
- Page 6 of 8

which Smartmatic had possession of all the votes and the voting, the votes
themselves and the voting information at their disposition in Venezuela.
he was assuring that the voting system implemented or used

by Smartmatic was completely secure, that it could not be compromised,
was not able to be altered.
25. But later, in 2017 when there were elections where Maduro was running
and elections for legislators in Venezuela, and Smartmatic broke
their secrecy pact with the government of Venezuela. He made a public
announcement through the media in which he stated that all the
Smartmatic voting machines used during those elections were totally
manipulated and they were manipulated by the electoral council of
Venezuela back then. stated that all of the votes for Nicholas
Maduro and the other persons running for the legislature were
manipulated and they actually had lost. So I think that's the greatest
proof that the fraud can be carried out and will be denied by the software
company that admitted publicly that Smartmatic had created,
used and still uses vote counting software that can be manipulated or
altered.
26. I am alarmed because of what is occurring in plain sight during this 2020
election for President of the United States. The circumstances and events
are eerily reminiscent of what happened with Smartmatic software
electronically changing votes in the 2013 presidential election in
Venezuela. What happened in the United States was that the vote
counting was abruptly stopped in five states using Dominion software. At
the time that vote counting was stopped, Donald Trump was significantly
ahead in the votes. Then during the wee hours of the morning, when there
was no voting occurring and the vote count reporting was off-line,
something significantly changed. When the vote reporting resumed the
very next morning there was a very pronounced change in voting in favor
of the opposing candidate, Joe Biden.
27. I have worked in gathering

information, researching, and working with information technology.
That's what I know how to do and the special knowledge that I have. Due
to these recent election events, I contacted a number of reliable and
intelligent ex-co-workers of mine that are still informants and work with
the intelligence community. I asked for them to give me information that
was up-to-date information in as far as how all these businesses are
acting, what actions they are taking.
- Page 7 of 8


Declaration of Christos A. Makridis
Pursuant to 28 U.S.C Section 1746, I, Christos A. Makridis, make the

following declaration.
1. I am over the age of 21 years, and I am under no legal disability,

which would prevent me from giving this declaration.
2. I hold dual Doctorates and dual Masters in Economics and
Management Science & Engineering from Stanford University and a
BS in Economics from Arizona State University. I hold roles in the
public sector, private sector, and higher education.
3. I reside at 875 10th Street NW, Washington, DC, 20001.
4. Georgia uses Dominion Voting Systems (DVS), which has a history of
technical glitches that have not been fixed. DVS was rejected three
times in Texas because of its inherent defects. It has caused multiple
anomalies and delays. In Gwinnett County alone, these software
glitches have affected roughly 80,000 absentee mail-in ballots.
Although election officials have said that these glitches have been
corrected and are not reflected in the final tallies, it is hard to take
these statements on faith without any evidence, particularly given
DVS’ bad track record. Moreover, it is also possible that there are
many other instances of “glitches” that were not caught.
5. These glitches are on top of those that occurred in Morgan and
Spalding counties. Marcia Ridley, elections supervisor at Spalding
County Board of Elections, said that the company “uploaded
something last night, which is not normal, and it caused a glitch,”
preventing poll workers from “using the pollbooks to program the
Ex. O to TRO Motion:

Makridis Declaration
smart cards that voters insert into voting machines” and causing
delays for voters.
6. Roughly 1.5 million Georgia voters requested absentee ballots, which
is far above the 200,000 absentee ballots from 2016, and is 30% of
their estimated 5 million voter turnout. As of November 6th at 6pm,
Georgia election officials said that more than 14,200 provisional
ballots needed to be counted. Jeff Greenburg, a former Mercer
County elections director, remarked that over his 13 years in the
role, he had only processed 200 provisional ballots in total and it
would take his county 2.5 days to process 650 provision ballots. That
implies nearly 55 days to approve, which suggests that the current
pace they are approving provisional ballots is implausibly fast if they
intend to call the election soon.
It is also curious that the correlation between the number of mail-
in votes for Biden net of Trump and the 2016 share of votes for
Clinton is stronger than the total votes for Biden net of Trump. This
evidence is consistent with the view that manipulation is easier with
mail-in votes and more likely to occur where there is less Republican
competitive oversight (e.g., poll watchers turned away).
7. The counties with the greatest reported software glitches and delays
are also the counties with the biggest swings in votes for Biden. The
list of numbers below tabulates the percent change in Democrat
votes from one election to the other for some of the most Democrat
counties in the state. Importantly, the increase between 2020 and
2016 is systematically larger than the 2008 to 2012 or 2012 to 2016
increases: for example, the median (mean) increase from 2016 to

2020 for these counties was 27% (30.6%), whereas they were only
11.5% (9.8%) and -4% (-2.8%).
These are anomalies that evidence a high likelihood of fraudulent

alterations within the software or the system.
Increase in Democrat Votes from Election-to-Election, in %
County 2008-2012 / 2012-2016 / 2016-2020
Fulton -6% 16% 28%
DeKalb -6% 6% 22%
Gwinnett 3% 25% 45%
Cobb -6% 20% 38%
Chatham -4% 3% 26%
Henry 8% 14% 46%
Muscogee -4% -6% 24%
Bibb -1% -5% 18%
Douglas 2% 9% 37%
Clarke -14% 16% 22%
Mean -2.8% 9.8% 30.6%
Median -4% 11.5% 27%
These changes alone are highly suspect. The 2016 to 2020 increase
in Democratic votes is at least over double in these counties.

Moreover, all it takes is one or two counties, like Fulton, to become

a hotspot for fraud for it to sway the overall election outcome,
particularly via Atlanta.
Moreover, as a control group, consider the fact that counties that

are on the Northeastern border of Alabama have a much lower
increase in Democrat votes for Biden. These counties are
comparable given their proximity, making the especially large
surge in Georgia more suspect.
There are also many precincts within these counties that have highly
suspect numbers. For example, 97% of the votes are for Biden in
SC16A (Fulton County) and 97% in Snapfinger Road (DeKalb). Many
more examples abound. The distribution is also highly skewed
towards Biden: whereas 10% of the precincts have an over 95% Biden
vote, none of the precincts have an over 90% Trump vote. Given the
historical distribution of votes from 2016, this fact pattern is suspect.
8. One diagnostic for detecting fraud involves Benford’s law. In the case
of election fraud, that means looking at the distribution of digits
across votes within a specified geography. Using precinct level data
for Georgia, my research identified 1,017 suspicious precincts out of
2,656 when we look at advance ballots. Even more precincts (1,530)
were flagged as suspicious for election day votes. While Benford’s law
is not a silver-bullet for identifying fraud on its own, it suggests
suspicious activity that warrants additional attention.
9. Yet another way of detecting statistical anomalies involves looking at
the distribution of the change in 2020 to 2016 vote shares of Trump

10
15
20
25
10
20
30
40
50
60
70
80
0
5
0
10.
[-948, -… [-1029, -…
(-896.88, -… (-985.54, -…
(-845.76, -… (-942.08, -…
(-794.64, -… (-898.62, -…
(-743.52, -… (-855.16, -…
(-692.4, -… (-811.7, -…
(-641.28, -… (-768.24, -…
(-590.16, -… (-724.78, -…
(-539.04, -… (-681.32, -…
(-487.92, -… (-637.86, -…
(-436.8, -… (-594.4, -…
(-385.68, -… (-550.94, -…
(-334.56, -… (-507.48, -…
(-283.44, -… (-464.02, -…
(-232.32, -… (-420.56, -…
(-181.2, -… (-377.1, -…
(-130.08, -… (-333.64, -…
(-78.96, -… (-290.18, -…
(-27.84, -… (-246.72, -…
(23.28,… (-203.26, -…
(74.4, 99.96] (-159.8, -…
(125.52,… (-116.34, -…
(176.64,… (-72.88, -…
(227.76,… (-29.42, -…
(278.88,… (14.04,…
(330, 355.56] (57.5, 79.23]
(381.12,… (100.96,…
(432.24,… (144.42,…
those concerns (e.g., Pennsylvania too).

(483.36,… (187.88,…
(534.48,… (231.34,…
(585.6,… (274.8,…
(636.72,… (318.26,…
(687.84,… (361.72,…
Biden 2020-2016 Difference

(738.96,… (405.18,…
Trump 2020-2016 Difference
(790.08,… (448.64,…
(841.2,… (492.1,…
(892.32,… (535.56,…
(943.44, 969] (579.02,…
(994.56,… (622.48,…
(1045.68,… (665.94,…
(1096.8,… (709.4,…
(1147.92,… (752.86,…
(1199.04,… (796.32,…
(1250.16,… (839.78,…
coming in increasingly more slowly, but they were larger for

(1301.28,… (883.24,…
(1352.4,… (926.7,…
on the live Edison Research data reveals that new ballots were
There were many puzzling incidents across states, including
(1403.52,… (970.16,…
right. This is not present in other states that do not have similar
(1454.64,… (1013.62,…
(1505.76,… (1057.08,…
of the morning of November 4th. In particular, preliminary analysis

the distribution for Biden is non-normal: it is skewed heavily to the
(1556.88,… (1100.54,…
concerns about fraudulent activity, but is present in the states with
Georgia, where surges of votes for Biden were observed at odd hours
and Biden. Whereas the distribution for Trump is perfectly “normal,”
Democrats than for Republicans. The combination of the pattern and

timing is puzzling, particularly since it is not present in other states,
like Florida, that do not have similar concerns about fraud.
I declare under penalty of perjury that the forgoing is true and correct.
Executed this November 16, 2020.
Christos A. Makridis,

ELECTION LAW JOURNAL
Volume 19, Number 3, 2020
# Mary Ann Liebert, Inc.
DOI: 10.1089/elj.2019.0619
Ballot-Marking Devices
Cannot Ensure the Will of the Voters
Andrew W. Appel, Richard A. DeMillo, and Philip B. Stark
ABSTRACT
Downloaded by Mary Ann Liebert, Inc., publishers from www.liebertpub.com at 11/17/20. For personal use only.
The complexity of U.S. elections usually requires computers to count ballots—but computers can be hacked,
so election integrity requires a voting system in which paper ballots can be recounted by hand. However,
paper ballots provide no assurance unless they accurately record the votes as expressed by the voters.
Voters can express their intent by indelibly hand-marking ballots or using computers called ballot-
marking devices (BMDs). Voters can make mistakes in expressing their intent in either technology, but
only BMDs are also subject to hacking, bugs, and misconfiguration of the software that prints the marked
ballots. Most voters do not review BMD-printed ballots, and those who do often fail to notice when the
printed vote is not what they expressed on the touchscreen. Furthermore, there is no action a voter can
take to demonstrate to election officials that a BMD altered their expressed votes, nor is there a corrective
action that election officials can take if notified by voters—there is no way to deter, contain, or correct com-
puter hacking in BMDs. These are the essential security flaws of BMDs.
Risk-limiting audits can ensure that the votes recorded on paper ballots are tabulated correctly, but no
audit can ensure that the votes on paper are the ones expressed by the voter on a touchscreen: Elections
conducted on current BMDs cannot be confirmed by audits. We identify two properties of voting systems,
contestability and defensibility, necessary for audits to confirm election outcomes. No available BMD cer-
tified by the Election Assistance Commission is contestable or defensible.
Keywords: voting machines, paper ballot, ballot-marking device, election security
INTRODUCTION: CRITERIA on a paper ballot or on a machine. Computers have

FOR VOTING SYSTEMS become indispensable to conducting elections, but
computers are vulnerable. They can be hacked—
E lections for public office and on public

questions in the United States or any democ-
racy must produce outcomes based on the votes
compromised by insiders or external adversaries
who can replace their software with fraudulent soft-
ware that deliberately miscounts votes—and they
that voters express when they indicate their choices can contain design errors and bugs—hardware or
software flaws or configuration errors that result
in mis-recording or mis-tabulating votes. Hence
there must be some way, independent of any soft-
Andrew W. Appel is the Eugene Higgins Professor of Computer ware in any computers, to ensure that reported elec-
Science in the Department of Computer Science at Princeton
University in Princeton, New Jersey, USA. Richard A. DeMillo
tion outcomes are correct, i.e., consistent with the
is the Charlotte B. and Roger C. Warren Chair of Computing expressed votes as intended by the voters.
and a professor in the College of Computing at Georgia Tech Voting systems should be software independent,
in Atlanta, Georgia, USA. Philip B. Stark is a professor in the meaning that ‘‘an undetected change or error in its
Department of Statistics at the University of California, Berke-
ley, in Berkeley, California, USA. The authors are listed alpha- software cannot cause an undetectable change or
betically; they contributed equally to this work. error in an election outcome’’ (Rivest and Wack
432
Ex. P to TRO Motion:

Failure Study
BMDS CANNOT ENSURE THE WILL OF VOTERS 433
2006; Rivest 2008; Rivest and Virza 2016). Soft- We will define the terms contestable and defensi-
ware independence is similar to tamper-evident ble to better characterize properties of voting sys-
packaging: if somebody opens the container and tems that make them acceptable for use in public
disturbs the contents, it will leave a trace. elections.2
The use of software-independent voting systems is A voting system is contestable if an undetected
supposed to ensure that if someone fraudulently hacks change or error in its software that causes a change
the voting machines to steal votes, we’ll know about or error in an election outcome can always produce
it. But we also want to know the true outcome in order public evidence that the outcome is untrustworthy.
to avoid a do-over election.1 A voting system is For instance, if a voter selected candidate A on
strongly software independent if it is software inde- the touchscreen of a BMD, but the BMD prints can-
pendent and, moreover, a detected change or error didate B on the paper ballot, then this A-vs-B evi-
in an election outcome (due to change or error in dence is available to the individual voter, but the
the software) can be corrected using only the ballots voter cannot demonstrate this evidence to anyone
and ballot records of the current election (Rivest else, since nobody else saw—nor should have seen—
and Wack 2006; Rivest 2008). Strong software inde- where the voter touched the screen.3 Thus, the voting
pendence combines tamper evidence with a kind of system does not provide a way for the voter who ob-
resilience: there’s a way to tell whether faulty soft- served the misbehavior to prove to anyone else that
ware caused a problem, and a way to recover from there was a problem, even if the problems altered
the problem if it did. the reported outcome. Such a system is therefore
Software independence and strong software inde- not contestable.
pendence are now standard terms in the analysis of While the definition of software independence
voting systems, and it is widely accepted that voting might allow evidence available only to individual
systems should be software independent. Indeed, voters as ‘‘detection,’’ such evidence does not suf-
version 2.0 of the Voluntary Voting System Guide- fice for a system to be contestable. Contestibility
lines (VVSG 2.0) incorporates this principle (U.S. is software independence, plus the requirement that
Election Assistance Commission 2017). ‘‘detect’’ implies ‘‘can generate public evidence.’’
But as we will show, these standard definitions are ‘‘Trust me’’ does not count as public evidence. If
incomplete and inadequate, because the word undetect- a voting system is not contestable, then problems
able hides several important questions: Who detects voters ‘‘detect’’ might never see the light of day,
the change or error in an election outcome? How can much less be addressed or corrected.4
a person prove that she has detected an error? What
happens when someone detects an error—does the
election outcome remain erroneous? Or conversely: 1
Do-overs are expensive; they may delay the inauguration of an
How can an election administrator prove that the elec- elected official; there is no assurance that the same voters will
tion outcome not been altered, or prove that the correct vote in the do-over election as voted in the original; they de-
crease public trust. And if the do-over election is conducted
outcome was recovered if a software malfunction was with the same voting system that can only detect but not correct
detected? The standard definition does not distinguish errors, then there may need to be a do-over of the do-over, ad
evidence available to an election official, to the public, infinitum.
2
or just to a single voter; nor does it consider the possi- There are other notions connected to contestability and defen-
sibility, although essentially different: Benaloh et al. (2011) de-
bility of false alarms. fine a P-resilient canvass framework, personally verifiable
Those questions are not merely academic, as we P-resilient canvass framework, and privacy-preserving person-
show with an analysis of ballot-marking devices. ally verifiable P-resilient canvass frameworks.
3
See footnote 17.
Even if some voters ‘‘detect’’ that the printed output 4
If voters are the only means of detecting and quantifying the
is not what they expressed to the ballot-marking de- effect of those problems—as they are for ballot-marking de-
vice (BMD)—even if some of those voters report vices (BMDs)—then in practice the system is not strongly soft-
ware independent. The reason is that, as we will show, such
their detection to election officials—there is no claims by (some) voters cannot correct software-dependent
mechanism by which the election official can ‘‘de- changes to other voters’ ballots, and cannot be used as the
tect’’ whether a BMD has been hacked to alter elec- basis to invalidate or correct an election outcome. Thus,
tion outcomes. The questions of who detects, and BMD-based election systems are not even (weakly) software
independent, unless one takes ‘‘detection’’ to mean ‘‘somebody
then what happens, are critical—but unanswered claimed there was a problem, with no evidence to support that
by the standard definitions. claim.’’

Failure Study
434 APPEL ET AL.
Similarly, while strong software independence because no software is used in marking ballots.
demands that a system be able to report the correct Ballot-scanning-and-counting software can be the
outcome even if there was an error or alteration of source of errors, but such errors can be detected
the software, it does not require public evidence and corrected by audits.
that the (reconstructed) reported outcome is cor- That system is contestable: if an optical scan
rect. We believe, therefore, that voting systems voting machine reports the wrong outcome be-
must also be defensible. We say that a voting sys- cause it miscounted (because it was hacked, mis-
tem is defensible if, when the reported electoral programmed, or miscalibrated), the evidence is
outcome is correct, it is possible to generate con- public: the paper ballots, recounted before wit-
vincing public evidence that the reported electoral nesses, will not match the claimed results, also wit-
outcome is correct—despite any malfunctions, soft- nessed. It is strongly defensible: a recount before
ware errors, or software alterations that might have witnesses can demonstrate that the reported out-
occurred. If a voting system is not defensible, then come is correct or can find the correct outcome if
it is vulnerable to ‘‘crying wolf’’: malicious actors it was wrong—and provide public evidence that
could claim that the system malfunctioned when in the (reconstructed) outcome is correct. See Section
fact it did not, and election officials will have no 4, ‘‘Contestability/Defensibility of Hand-Marked
way to prove otherwise. Opscan,’’ for a detailed analysis.
By analogy with strong software independence, Over 40 states now use some form of paper ballot
we define: a voting system is strongly defensible for most voters (Verified Voting Foundation 2018).
if it is defensible and, moreover, a detected change Most of the remaining states are taking steps to
or error in an election outcome (due to change or adopt paper ballots. But not all voting systems that
error in the software) can be corrected (with convinc- use paper ballots are equally secure.
ing public evidence) using only the ballots and ballot Some are not even software independent. Some
records of the current election. are software independent but not strongly software
In short, a system is contestable if it can gener- independent, contestable, or defensible. In this re-
ate public evidence of a problem whenever a reported port we explain:
outcome is wrong, while a system is defensible if it
can generate public evidence whenever a reported out- ! Hand-marked paper ballot systems are the only
come is correct—despite any problems that might have practical technology for contestable, strongly
occurred. Contestable systems are publicly tamper- defensible voting systems.
evident; defensible systems are publicly, demon- ! Some ballot-marking devices can be software
strably resilient. independent, but they not strongly software in-
Defensibility is a key requirement for evidence- dependent, contestable, or defensible. Hacked
based elections (Stark and Wagner 2012): defensibil- or misprogrammed BMDs can alter election
ity makes it possible in principle for election officials outcomes undetectably, so elections conducted
to generate convincing evidence that the reported using BMDs cannot provide public evidence
winners really won—if the reported winners did re- that reported outcomes are correct. If BMD mal-
ally win. (We say an election system may be defensi- functions are detected, there is no way to deter-
ble, and an election may be evidence-based; there’s mine who really won. Therefore BMDs should
much more process to an election than just the choice not be used by voters who are able to mark an
of system.) optical-scan ballot with a pen.
! All-in-one BMD or DRE+VVPAT voting ma-
chines are not software independent, contest-
Examples
able, or defensible. They should not be used
The only known practical technology for contest- in public elections.
able, strongly defensible voting is a system of hand-
marked paper ballots, kept demonstrably physically
secure, counted by machine, audited manually, and 5
recountable by hand.5 In a hand-marked paper bal- The election must also generate convincing evidence that
physical security of the ballots was not compromised, and the
lot election, ballot-marking software cannot be the audit must generate convincing public evidence that the audit
source of an error or change-of-election-outcome, itself was conducted correctly.

Failure Study
BACKGROUND terface that enables voters with disabilities to vote

independently. Voter inputs (expressed votes) are
We briefly review the kinds of election equip- recorded electronically. When a voter indicates that
ment in use, their vulnerability to computer hacking the ballot is complete and ready to be cast, the
(or programming error), and in what circumstances BMD prints a paper version of the electronically
risk-limiting audits can mitigate that vulnerability. marked ballot. We use the term BMD for devices
that mark ballots but do not tabulate or retain them,
and all-in-one for devices that combine ballot mark-
Voting equipment
ing, tabulation, and retention into the same paper path.
Although a voter may form an intention to vote The paper ballot printed by a BMD may be in the
for a candidate or issue days, minutes, or seconds same format as an optical-scan form (e.g., with
before actually casting a ballot, that intention is a ovals filled as if by hand) or it may list just the
psychological state that cannot be directly observed names of the candidate(s) selected in each contest.
by anyone else. Others can have access to that inten- The BMD may also encode these selections into
tion through what the voter (privately) expresses to barcodes or QR codes for optical scanning. We dis-
the voting technology by interacting with it, e.g., by cuss issues with barcodes later in this report.
making selections on a BMD or marking a ballot by An all-in-one touchscreen voting machine com-
hand.6 Voting systems must accurately record the bines computerized ballot marking, tabulation, and
vote as the voter expressed it. retention in the same paper path. All-in-one ma-
With a hand-marked paper ballot optical-scan chines come in several configurations:
system, the voter is given a paper ballot on which
all choices (candidates) in each contest are listed; ! DRE+VVPAT machines—direct-recording elec-
next to each candidate is a target (typically an oval tronic (DRE) voting machines with a voter-
or other shape) which the voter marks with a pen verifiable paper audit trail (VVPAT)—provide
to indicate a vote. Ballots may be either preprinted the voter a touchscreen (or other) interface,
or printed (unvoted) at the polling place using ballot then print a paper ballot that is displayed to the
on demand printers. In either case, the voter creates voter under glass. The voter is expected to review
a tamper-evident record of intent by marking the this ballot and approve it, after which the ma-
printed paper ballot with a pen. chine deposits it into a ballot box. DRE+VVPAT
Such hand-marked paper ballots may be scanned machines do not contain optical scanners; that is,
and tabulated at the polling place using a precinct- they do not read what is marked on the paper bal-
count optical scanner (PCOS), or may be brought lot; instead, they tabulate the vote directly from
to a central place to be scanned and tabulated by a inputs to the touchscreen or other interface.
central-count optical scanner (CCOS). Mail-in bal- ! BMD+Scanner all-in-one machines8 provide
lots are typically counted by CCOS machines. the voter a touchscreen (or other) interface to
After scanning a ballot, a PCOS machine depos-
its the ballot in a secure, sealed ballot box for later
6
use in recounts or audits; this is ballot retention. We recognize that voters make mistakes in expressing their in-
Ballots counted by CCOS are also retained for re- tentions. For example, they may misunderstand the layout of a
ballot or express an unintended choice through a perceptual
counts or audits.7 error, inattention, or lapse of memory. The use of touchscreen
Paper ballots can also be hand counted, but technology does not necessarily correct for such user errors,
in most jurisdictions (especially where there are as every smartphone user who has mistyped an important text
message knows. Poorly designed ballots, poorly designed
many contests on the ballot) this is hard to do quick- touchscreen interfaces, and poorly designed assistive interfaces
ly; Americans expect election-night reporting of un- increase the rate of error in voters’ expressions of their votes.
official totals. Hand counting—i.e., manually For the purposes of this report, we assume that properly engi-
determining votes directly from the paper ballots— neered systems seek to minimize such usability errors.
7
Regulations and procedures governing custody and physical
is appropriate for audits and recounts. security of ballots are uneven, and in many cases inadequate,
A ballot-marking device provides a computer- but straightforward to correct because of decades of develop-
ized user interface (UI) that presents the ballot to ment of best practices.
8
Some voting machines, such as the ES&S ExpressVote, can be
voters and captures their expressed selections—for configured as either a BMD or a BMD+Scanner all-in-one. Others,
instance, a touchscreen interface or an assistive in- such as the ExpressVoteXL, work only as all-in-one machines.

Failure Study
436 APPEL ET AL.
input ballot choices and print a paper ballot mote access to voting-machine manufacturers’ com-
that is ejected from a slot for the voter to in- puters (and ‘‘hack’’ the firmware installed in new
spect. The voter then reinserts the ballot into machines, or the firmware updates supplied for exist-
the slot, after which the all-in-one BMD+Scan- ing machines), and so on. Supply-chain hacks are also
ner scans it and deposits it into a ballot box. Or, possible: the hardware installed by a voting system
some BMD+Scanner all-in-one machines dis- vendor may have malware pre-installed by the ven-
play the paper ballot behind plexiglass for the dor’s component suppliers.10
voter to inspect, before mechanically deposit- Computer systems (including voting machines)
ing it into a ballot box. have so many layers of software that it is impossible
to make them perfectly secure (National Academies
Opscan+BMD with separate paper paths. At of Sciences, Engineering, and Medicine 2018, 89–
least one model of voting machine (the Dominion 91). When manufacturers of voting machines use the
ICP320) contains an optical scanner (opscan) and a best known security practices, adversaries may find
BMD in the same cabinet,9 so that the optical scan- it more difficult to hack a BMD or optical scanner—
ner and BMD-printer are not in the same paper path; but not impossible. Every computer in every critical
no possible configuration of the software could system is vulnerable to compromise through hacking,
cause a BMD-marked ballot to be deposited in the insider attacks, or exploiting design flaws.
ballot box without human handling of the ballot.
We do not classify this as an all-in-one machine. Election assurance through risk-limiting audits
To ensure that the reported electoral outcome of
Hacking each contest corresponds to what the voters expressed,
the most practical known technology is a risk-limiting
There are many forms of computer hacking. In
audit (RLA) of trustworthy paper ballots (Stark
this analysis of voting machines we focus on the al-
2008; Stark 2009; Lindeman and Stark 2012).
teration of voting machine software so that it mis-
The National Academies of Science, Engineering,
counts votes or mis-marks ballots to alter election
and Medicine recommend routine RLAs after every
outcomes. There are many ways to alter the soft-
election (National Academies of Sciences, Engineer-
ware of a voting machine: a person with physical
ing, and Medicine 2018), as do many other organiza-
access to the computer can open it and directly ac-
tions and entities concerned with election integrity.11
cess the memory; one can plug in a special USB
The risk limit of a risk-limiting audit is the max-
thumbdrive that exploits bugs and vulnerabilities
imum chance that the audit will not correct the
in the computer’s USB drivers; one can connect
reported electoral outcome, if the reported out-
to its Wi-Fi port or Bluetooth port or telephone
come is wrong. ‘‘Electoral outcome’’ means the po-
modem (if any) and exploit bugs in those drivers,
litical result—who or what won—not the exact tally.
or in the operating system.
‘‘Wrong’’ means that the outcome does not corre-
‘‘Air-gapping’’ a system (i.e., never connecting
spond to what the voters expressed.
it to the Internet nor to any other network) does
not automatically protect it. Before each election,
election administrators must transfer a ballot defi-
nition into the voting machine by inserting a ballot 9
More precisely, the ICP320 optical scanner and the BMD au-
definition cartridge that was programmed on dio+buttons interface are in the same cabinet, but the printer is a
election-administration computers that may have separate box.
10
Given that many chips and other components are manufactured
been connected previously to various networks; it in China and elsewhere, this is a serious concern. Carsten Schür-
has been demonstrated that vote-changing viruses mann has found Chinese pop songs on the internal memory of vot-
can propagate via these ballot-definition cartridges ing machines (C. Schürmann, personal communication, 2018).
Presumably those files were left there accidentally—but this
(Feldman et al. 2007). shows that malicious code could have been pre-installed deliber-
Hackers might be corrupt insiders with access to a ately, and that neither the vendor’s nor the election official’s secu-
voting-machine warehouse; corrupt insiders with ac- rity and quality control measures discovered and removed the
cess to a county’s election-administration computers; extraneous files.
11
Among them are the Presidential Commission on Election
outsiders who can gain remote access to election- Administration, the American Statistical Association, the League
administration computers; outsiders who can gain re- of Women Voters, and Verified Voting Foundation.

Failure Study
An RLA involves manually inspecting randomly altered election outcomes. RLAs that rely on BMD
selected paper ballots following a rigorous protocol. output therefore cannot limit the risk that an incor-
The audit stops if and when the sample provides rect reported election outcome will go uncorrected.
convincing evidence that the reported outcome is A paper-based voting system (such as one that
correct; otherwise, the audit continues until every uses optical scanners) is systematically more secure
ballot has been inspected manually, which reveals than a paperless system (such as DREs) only if the
the correct electoral outcome if the paper trail is trust- paper trail is trustworthy and the results are
worthy. RLAs protect against vote-tabulation errors, checked against the paper trail using a rigorous
whether those errors are caused by failures to follow method such as an RLA or full manual tally. If it
procedures, misconfiguration, miscalibration, faulty is possible that error, hacking, bugs, or miscalibra-
engineering, bugs, or malicious hacking.12 tion caused the recorded-on-paper votes to differ
The risk limit should be determined as a matter of from the expressed votes, an RLA or even a full
policy or law. For instance, a 5% risk limit means hand recount cannot not provide convincing public
that, if a reported outcome is wrong solely because evidence that election outcomes are correct: such
of tabulation errors, there is at least a 95% chance a system cannot be defensible. In short, paper bal-
that the audit procedure will correct it. Smaller risk lots provide little assurance against hacking if they
limits give higher confidence in election outcomes, are never examined or if the paper might not accu-
but require inspecting more ballots, other things rately reflect the votes expressed by the voters.
being equal. RLAs never revise a correct outcome.
RLAs can be very efficient, depending in part on
how the voting system is designed and how jurisdic- (NON)CONTESTABILITY/
tions organize their ballots. If the computer results DEFENSIBILITY OF BMDS
are accurate, an efficient RLA with a risk limit of
5% requires examining just a few—about seven di- A BMD-generated paper trail is not a reliable
vided by the margin—ballots selected randomly record of the vote expressed by the voter.
from the contest.13 For instance, if the margin of vic-
Like any computer, a BMD (or a DRE+VVPAT)
tory is 10% and the results are correct, the RLA
is vulnerable to bugs, misconfiguration, hacking, in-
would need to examine about 7/10% = 70 ballots to
stallation of unauthorized (fraudulent) software, and
confirm the outcome at 5% risk. For a 1% margin,
alteration of installed software.
the RLA would need to examine about 7/1% = 700
If a hacker sought to steal an election by altering
ballots. The sample size does not depend much on
BMD software, what would the hacker program the
the total number of ballots cast in the contest, only
BMD to do? In cybersecurity practice, we call this
on the margin of the winning candidate’s victory.
the threat model.
RLAs assume that a full hand tally of the paper
The simplest threat model is this one: In some
trail would reveal the correct electoral outcomes:
contests, not necessarily top-of-the-ticket, change
the paper trail must be trustworthy. Other kinds of
a small percentage of the votes (such as 5%).
audits, such as compliance audits (Benaloh et al.
In recent national elections, analysts have con-
2011; Lindeman and Stark 2012; Stark and Wagner
sidered a candidate who received 60% of the vote
2012; Stark 2018), are required to establish whether
to have won by a landslide. Many contests are de-
the paper trail itself is trustworthy. Applying an
cided by less than a 10% margin. Changing 5% of
RLA procedure to an untrustworthy paper trail can-
the votes can change the margin by 10%, because
not limit the risk that a wrong reported outcome
goes uncorrected.
Properly preserved hand-marked paper ballots en-
12
sure that expressed votes are identical to recorded Risk-limiting audits (RLAs) do not protect against problems
that cause BMDs to print something other than what was
votes. But BMDs might not record expressed votes shown to the voter on the screen, nor do they protect against
accurately, for instance, if BMD software has bugs, problems with ballot custody.
13
was misconfigured, or was hacked: a BMD printout Technically, it is the diluted margin that enters the calcula-
is not a trustworthy record of the expressed votes. tion. The diluted margin is the number of votes that separate
the winner with the fewest votes from the loser with the most
Neither a compliance audit nor an RLA can possibly votes, divided by the number of ballots cast, including under-
check whether errors in recording expressed votes votes and invalid votes.

Failure Study
438 APPEL ET AL.
‘‘flipping’’ a vote for one candidate into a vote for half will remember the name of the candidate they
a different candidate changes the difference in intended to vote for.16
their tallies—i.e., the margin—by two votes. If Of those who notice that the vote printed is not the
hacking or bugs or misconfiguration could change candidate they intended to vote for, what will they
5% of the votes, that would be a very significant think, and what will they do? Will they think, ‘‘Oh,
threat. I must have made a mistake on the touchscreen,’’ or
Although public and media interests often focus will they think, ‘‘Hey, the machine is cheating or mal-
on top-of-the-ticket races such as president and gov- functioning!’’ There’s no way for the voter to know
ernor, elections for lower offices such as state repre- for sure—voters do make mistakes—and there’s ab-
sentatives, who control legislative agendas and solutely no way for the voter to prove to a pollworker
redistricting, and county officials, who manage elec- or election official that a BMD printed something
tions and assess taxes, are just as important in our de- other than what the voter entered on the screen.17,18
mocracy. Altering the outcome of smaller contests Either way, polling-place procedures generally
requires altering fewer votes, so fewer voters are in advise voters to ask a pollworker for a new ballot
a position to notice that their ballots were mis- if theirs does not show what they intended. Poll-
printed. And most voters are not as familiar with workers should void that BMD-printed ballot, and
the names of the candidates for those offices, so the voter should get another chance to mark a ballot.
they might be unlikely to notice if their ballots Anecdotal evidence suggests that many voters are
were misprinted, even if they checked. too timid to ask, or don’t know that they have the
Research in a real polling place in Tennessee dur- right to ask, or are not sure whom to ask. Even
ing the 2018 election found that half the voters if a voter asks for a new ballot, training for poll-
didn’t look at all at the paper ballot printed by a workers is uneven, and we are aware of no formal
BMD, even when they were holding it in their
hand and directed to do so while carrying it from
14
the BMD to the optical scanner (DeMillo et al. You might think, ‘‘the voter really should carefully review
their BMD-printed ballot.’’ But because the scientific evidence
2018). Those voters who did look at the BMD- shows that voters do not (DeMillo et al. 2018) and cognitively
printed ballot spent an average of 4 seconds exam- cannot (Everett 2007) perform this task well, legislators and
ining it to verify that the eighteen or more choices election administrators should provide a voting system that
they made were correctly recorded. That amounts counts the votes as voters express them.
15
Studies of voter confidence about their ability to verify their
to 222 milliseconds per contest, barely enough ballots are not relevant: in typical situations, subjective confi-
time for the human eye to move and refocus under dence and objective accuracy are at best weakly correlated.
perfect conditions and not nearly enough time The relationship between confidence and accuracy has been
studied in contexts ranging from eyewitness accuracy
for perception, comprehension, and recall (Rayner (Bothwell et al. 1987; Deffenbacher 1980; Wixted and Wells
2009). A study by other researchers (Bernhard 2017) to confidence in psychological clinical assessments (Des-
et al. 2020), in a simulated polling place using marais et al. 2010) and social predictions (Dunning et al. 1990).
The disconnect is particularly severe at high confidence.
real BMDs deliberately hacked to alter one vote Indeed, this is known as ‘‘the overconfidence effect.’’ For a
on each paper ballot, found that only 6.6% of vot- lay discussion, see Thinking, Fast and Slow by Nobel econo-
ers told a pollworker something was wrong.14,15 mist Daniel Kahnemann (2011).
16
The same study found that among voters who ex- We ask the reader, ‘‘do you know the name of the most recent
losing candidate for county commissioner?’’ We recognize that
amined their hand-marked ballots, half were unable some readers of this document are county commissioners, so
to recall key features of ballots cast moments before, we ask those readers to imagine the frame of mind of their con-
a prerequisite step for being able to recall their own stituents.
17
You might think, ‘‘the voter can prove it by showing someone
ballot choices. This finding is broadly consistent that the vote on the paper doesn’t match the vote onscreen.’’ But
with studies of effects like ‘‘change blindness’’ or that won’t work. On a typical BMD, by the time a paper record
‘‘choice blindness,’’ in which human subjects fail is printed and ejected for the voter to hold and examine, the
touchscreen no longer shows the voter’s choice. You might
to notice changes made to choices made only sec- think, ‘‘BMDs should be designed so that the choices still
onds before (Johansson et al. 2008). show on the screen for the voter to compare with the paper.’’
Suppose, then, that 10% of voters examine their But a hacked BMD could easily alter the on-screen choices to
paper ballots carefully enough to even see the can- match the paper, after the voter hits the ‘‘print’’ button.
18
Voters should certainly not video-record themselves voting!
didate’s name recorded as their vote for legislator That would defeat the privacy of the secret ballot and is illegal
or county commissioner. Of those, perhaps only in most jurisdictions.

Failure Study
procedure for resolving disputes if a request for a The only way an investigation can ensure that the
new ballot is refused. Moreover, there is no sensible outcome accurately reflects what voters expressed
protocol for ensuring that BMDs that misbehave are to the BMDs is to void an election in which the
investigated—nor can there be, as we argue below. BMDs have altered votes and conduct a new election.
Let’s summarize. If a machine alters votes on 5% of But how do you know whether the BMDs have al-
the ballots (enabling it to change the margin by 10%), tered votes, except based on the claims of the vot-
and 10% of voters check their ballots carefully and ers?21 Furthermore, the investigation itself would
50% of the voters who check notice the error, then op- suffer from the same problem as above: how can
timistically we might expect 5% x 10% x 50% or one distinguish between voters who detected BMD
0.25% of the voters to request a new ballot and correct hacking or bugs from voters who just want to interfere
their vote.19 This means that the machine will change with an election?
the margin by 9.75% and get away with it. This is the essential security flaw of BMDs: few
In this scenario, 0.25% of the voters, one in every voters will notice and promptly report discrepan-
400 voters, has requested a new ballot. You might cies between what they saw on the screen and
think, ‘‘that’s a form of detection of the hacking.’’ what is on the BMD printout, and even when they
But is isn’t, as a practical matter: a few individual do notice, there’s nothing appropriate that can be
voters may have detected that there was a problem, done. Even if election officials are convinced that
but there’s no procedure by which this translates BMDs malfunctioned, there is no way to determine
into any action that election administrators can take who really won.
to correct the outcome of the election. Polling-place Therefore, BMDs should not be used by most
procedures cannot correct or deter hacking, or voters.
even reliably detect it, as we discuss next. This is es-
sentially the distinction between a system that is Why can’t we rely on pre-election and post-election
merely software independent and one that is contest- logic and accuracy testing, or parallel testing?
able: a change to the software that alters the outcome
Most, if not all, jurisdictions perform some kind
might generate evidence for an alert, conscientious,
of logic and accuracy testing (LAT) of voting
individual voter, but it does not generate public evi-
equipment before elections. LAT generally involves
dence that an election official can rely on to conclude
voting on the equipment using various combinations
there is a problem.
of selections, then checking whether the equipment
tabulated the votes correctly. As the Volkswagen/
Even if some voters notice that BMDs are altering Audi ‘‘Dieselgate’’ scandal shows, devices can be
votes, there’s no way to correct the election programmed to behave properly when they are
outcome. tested but misbehave in use (Contag et al. 2017).
That is, BMD voting systems are not contestable,
not defensible (and therefore not strongly defensible),
and not strongly software independent. Suppose a state 19
This calculation assumes that the 10% of voters who check
election official wanted to detect whether the BMDs are in effect a random sample of voters: voters’ propensity to
are cheating, and correct election results, based on ac- check BMD printout is not associated with their political pref-
erences.
tions by those few alert voters who notice the error. 20
Note that in many jurisdictions, far fewer than 400 voters use
What procedures could possibly work against the ma- a given machine on Election Day: BMDs are typically expected
nipulation we are considering? to serve fewer than 300 voters per day. (The vendor ES&S rec-
ommended 27,000 BMDs to serve Georgia’s 7 million voters,
1. How about, ‘‘If at least 1 in 400 voters claims amounting to 260 voters per BMD (Election Systems and Soft-
that the machine misrepresented their vote, void the ware 2018).) Recall also that the rate one in 400 is tied to the
entire election.’’20 No responsible authority would amount of manipulation. What if the malware flipped only
implement such a procedure. A few dishonest voters one vote in 50, instead of one vote in 20? That could still change
the margin by 4%, but—in this hypothetical—would be noticed
could collaborate to invalidate entire elections simply by only one voter in 1,000, rather than one in 400. The smaller
by falsely claiming that BMDs changed their votes. the margin, the less manipulation it would have taken to alter
2. How about, ‘‘If at least 1 in 400 voters claims the electoral outcome.
21
Forensic examination of the BMD might show that it was
that the machine misrepresented their vote, then in- hacked or misconfigured, but it cannot prove that the BMD
vestigate.’’ Investigations are fine, but then what? was not hacked or misconfigured.

Failure Study
440 APPEL ET AL.
Therefore, LAT can never prove that voting ma- there’s no way they can prove to poll workers or
chines performed properly in practice. election officials that there were problems and
Parallel or ‘‘live’’ testing involves pollworkers or no way to ensure that election officials take ap-
election officials using some BMDs at random propriate remedial action.
times on Election Day to mark (but not cast) ballots
with test patterns, then check whether the marks
match the patterns. The idea is that the testing is CONTESTABILITY/DEFENSIBILITY
not subject to the ‘‘Dieselgate’’ problem, because OF HAND-MARKED OPSCAN
the machines cannot ‘‘know’’ they are being tested
on Election Day. As a practical matter, the number The most widely used voting system in the
of tests required to provide a reasonable chance of United States is optical-scan counting of hand-
detecting outcome-changing errors is prohibitive, marked paper ballots.22 Computers and computer
and even then the system is not defensible. See Sec- software are used in several stages of the voting pro-
tion 6, ‘‘Parallel Testing of BMDs.’’ cess, and if that software is hacked (or erroneous),
Suppose, counterfactually, that it was practical to then the computers will deliberately (or accidentally)
perform enough parallel testing to guarantee a large report incorrect outcomes.
chance of detecting a problem if BMD hacking or
malfunction altered electoral outcomes. Suppose, ! Computers are used to prepare the PDF files
counterfactually, that election officials were re- from which (unvoted) optical-scan ballots are
quired to conduct that amount of parallel testing printed, with ovals (or other targets to be
during every election, and that the required equip- marked) next to the names of candidates.
ment, staffing, infrastructure, and other resources Because the optical scanners respond to the po-
were provided. Even then, the system would not sition on the page, not the name of the candi-
be strongly defensible; that is, if testing detected a date nearest the target, computer software
problem, there would be no way to to determine could cheat by reordering the candidates on
who really won. The only remedy would be a new the page.
election. ! The optical-scan voting machine, which scans
the ballots and interprets the marks, is driven
by computer software. Fraudulent (hacked)
Don’t voters need to check hand-marked
software can deliberately record (some fraction
ballots, too?
of) votes for Candidate A and votes for Candi-
It is always a good idea to check one’s work, but date B.
there is a substantial body of research (e.g., Reason ! After the voting machine reports the in-the-
2009) suggesting that preventing error as a ballot is precinct vote totals (or, in the case of central-
being marked is a fundamentally different cognitive count optical scan, the individual-batch vote
task than detecting an error on a previously marked totals), computers are used to aggregate the
ballot. In cognitively similar tasks, such as proof various precincts or batches together. Hacked
reading for non-spelling errors, ten percent rates software could cheat in this addition process.
of error detection are common (Reason 2009, 167
et seq.), whereas by carefully attending to the task Protection against any or all of these attacks
of correctly marking their ballots, voters apparently relies on a system of risk-limiting audits, along
can largely avoid marking errors. with compliance audits to check that the chain of
A fundamental difference between hand- custody of ballots and paper records is trustworthy.
marked paper ballots and ballot-marking devices Without such audits, optical-scan ballots (whether
is that, with hand-marked paper ballots, voters hand marked or machine marked) are neither con-
are responsible for catching and correcting their testable nor defensible.
own errors, while if BMDs are used, voters are
also responsible for catching machine errors, 22
bugs, and hacking. Voters are the only people Verified Voting Foundation, ‘‘The Verifier—Polling Place
Equipment—November 2020,’’ Verified Voting (2020)
who can detect such problems with BMDs—but, <https://www.verifiedvoting.org/verifier/> (fetched February
as explained above, if voters do find problems, 8, 2020).

Failure Study
We analyze the contestability/defensibility of workers and by credentialed challengers, and

hand-marked optical-scan ballots with respect to open to inspection by members of the public, be-
each of these threats, assuming a system of RLAs fore it is transported (with chain-of custody pro-
and compliance audits. tections) along with the ballot boxes to a secure
central location. The county clerk or registrar of
! Hacked generation of PDFs leading to fraudu- voters can (and in many counties, does) inspect
lently placed ovals. In this case, a change or these paper records to verify that they corre-
error in the computer software can change spond to the precinct-by-precinct machine-
the election outcome: on thousands of ballots, reported aggregation. Errors (or fraud) in
voters place a mark next to the name of candi- aggregation can be detected and corrected
date A, but (because the candidate name has without the need to inspect individual ballots:
been fraudulently misplaced on the paper), the system is contestable and defensible
the (unhacked) optical scanner records this as against this class of errors.
a vote for candidate B. But an RLA will correct
the outcome: a human, inspecting and inter-

preting this paper ballot, will interpret the END-TO-END VERIFIABLE
mark as a vote for candidate A, as the voter (E2E-V) SYSTEMS
intended. The RLA will, with high probability,
conclude that the computer-reported election In all BMD systems currently on the market, and
outcome cannot be confirmed, and a full re- in all BMD systems certified by the Election Assis-
count must occur. Thus the system is contest- tance Commission (EAC), the printed ballot or bal-
able: the RLA produces public evidence that lot summary is the only channel by which voters can
the (computer-reported) outcome is untrust- verify the correct recording of their ballots, inde-
worthy. This full recount (in the presence of pendently of the computers. The analysis in this ar-
witnesses, in view of the public) can provide ticle applies to all of those BMD systems.
convincing public evidence of its own correct- There is a class of voting systems called ‘‘end-to-
ness; that is, the system is defensible. end verifiable’’ (E2E-V), which provide an alternate
! Hacked optical-scan vote counter, reporting mechanism for voters to verify their votes (Benaloh
fraudulent vote totals. In this case, a change et al. 2014; Appel 2018b). The basic idea of an E2E-
or error in the computer software can change V system is that a cryptographic protocol encodes
the election outcome: on thousands of ballots, the vote; mathematical properties of the crypto-
voters place a mark next to the name of candi- graphic system allow the voters to verify (probabilis-
date A, but the (hacked) optical scanner re- tically) that their vote has been accurately counted,
cords this as a vote for candidate B. But an but does not compromise the secret ballot by allow-
RLA can detect the incorrect outcome (just ing voters to prove how they voted. E2E-V systems
as in the case above); the system is contestable. have not been adopted in public elections (except
And a full recount will produce a correct out- that Scantegrity was used for municipal elections
come with public evidence: the system is de- in Takoma Park, Maryland, in 2009 and 2011).
fensible. Each E2E-V system requires its own analysis of
! Hacked election-management system (EMS), contestability/defensibility.
fraudulently aggregating batches. A risk-limiting Scantegrity (Chaum et al. 2008) is a system of
audit can detect this problem, and a recount will preprinted optical-scan ballots, counted by conven-
correct it: the system is contestable and defensi- tional precinct-count optical scanners, but with an
ble. But actually, contestability and defensibility additional security feature: when the voter fills in
against this attack is even easier and simpler than an oval with a special pen, the oval is mostly dark-
RLAs and recounts. Most voting machines (in- ened (so it’s counted conventionally by the optical
cluding precinct-count optical scanners) print a scanner), but two-letter code is also revealed that
‘‘results tape’’ in the polling place, at the close the voter can (optionally) use in the cryptographic
of the polls (in addition to writing their results protocol. Scantegrity is contestable/defensible,
electronically to a removable memory card). but not because of its E2E-V properties: since it’s
This results tape is (typically) signed by poll- an add-on to a conventional optical-scan system

Failure Study
442 APPEL ET AL.
with hand-marked paper ballots, RLAs and com- under review for certification, nor are any of the
pliance audits can render this system contestable/ five major voting-machine vendors offering such a
defensible. system for sale.23
Prêt-à-Voter (Ryan et al. 2009) is the system in
which the voter separates the candidate list from
the oval-target list after marking the ballot and be- PARALLEL TESTING OF BMDS
fore deposit into the optical scanner. This system
can be made contestable, with difficulty: the audit- Wallach (2019) has proposed (in response to ear-
ing procedure requires participation of the voters in lier drafts of this article) that contestability/defensibil-
an unintuitive cryptographic challenge. It is not ity failure of BMDs could be mitigated by parallel
clear that the system is defensible: if this crypto- testing, which he also calls ‘‘live auditing.’’ Stark
graphic challenge proves that the blank ballots (2019) has analyzed Wallach’s proposal in detail.
have been tampered with, then no recount can reli- Here we provide a summary of the proposal and the
ably reconstruct the true result with public evidence. analyses.
STAR-Vote (Benaloh et al. 2013) is a DRE+VV- One might like to test each BMD before the
PAT system with a smart ballot box. Voters interact election to make sure it’s not hacked. Unfortu-
with a device that captures their votes electronically nately, since the computer in a voting machine
and prints a paper record that voters can inspect, but (including BMDs) has a real-time clock, the soft-
the electronic votes are held ‘‘in limbo’’ until the ware (including fraudulent vote-stealing soft-
paper ballot is deposited in the smart ballot box. ware) knows whether it’s Election Day or not.
The ballot box does not read the votes from the bal- Fraudulent software can make sure not to cheat
lot; rather, depositing the ballot tells the system that except on Election Day.
it has permission to cast the votes it had already The idea of parallel testing is to have trained au-
recorded from the touchscreen. The claimed advan- ditors test the BMDs, at random times during an ac-
tage of STAR-Vote (and other systems that use the tual election: use the BMD to prepare a ballot,
‘‘Benaloh challenge’’) is that RLAs and ballot-box inspect that ballot to ensure it’s marked correctly,
chain-of-custody are not required in order to obtain then discard the ballot. The same BMDs in use dur-
software independence. To ensure that the E2E-V ing the polling will be selected, from time to time,
cryptographic protocol has correctly recorded each for such test, right there in the polling places.
vote, the voter can ‘‘challenge’’ the system to prove If the BMDs cheat with uniform random proba-
that the cryptographic encoding of the ballot records bility p, and if the BMD cannot distinguish an audi-
the vote actually printed on the paper ballot. To do tor from an ordinary voter, then after n random
so, the voter must discard (void) this ballot and audits the probability of detecting the malware is
vote a fresh ballot; this is because the challenge pro- 1 – (1 –p)n. If p = 5% and n = 240, then the probabil-
cess reveals the vote to the public, and a voting sys- ity of detection is 91%.
tem must preserve the secrecy of the (cast) ballots. Unfortunately, the attacker is not constrained to
Thus, the voter cannot ensure the correct encoding cheat with uniform random probability; or, to put
of their true ballot, but (since STAR-Vote must print it another way, BMD malware may indeed be able
the ballot before knowing whether the voter will chal- to distinguish auditors from ordinary voters. Stark
lenge), the voter can ensure it with any desired error (2019) discusses many ways in which the ‘‘signa-
probability. ture’’ of how auditors interact with the BMD may
STAR-Vote is software independent but it is not differ from ordinary voters, enough to give clues
contestable or defensible. The reason is that, while
the challenge can produce public evidence that a
23
machine did not accurately encrypt the plaintext Some vendors, notably Scytl, have sold systems advertised
as E2E-V in other countries. Those systems were not in fact
vote on the ballot, if the machine prints the wrong E2E-V. Moreover, serious security flaws have been found in
plaintext vote and a correct encryption of that incor- their implementations. See, e.g., S.J. Lewis, O. Pereira, and
rect vote, there is no evidence the voter can use to V. Teague, ‘‘Ceci N’est Pas une Preuve: The Use of Trapdoor
prove that to anyone else. Commitments in Bayer-Groth Proofs and the Implications for
the Verifiabilty of the Scytl-SwissPost Internet Voting Sys-
No E2E-V system is currently certified by the tem’’ (March 12, 2019), <https://people.eng.unimelb.edu.au/
EAC, nor to our knowledge is any such system vjteague/UniversalVerifiabilitySwissPost.pdf>.

Failure Study
to the malware about whether to cheat.24 Therefore, the auditors detect that the BMDs have mismarked
one cannot simply multiply (1 – p)n and calculate a a ballot—even once—the entire election must be
probability of detection. invalidated, and a do-over election must be held.
While auditors might try to build an accurate This is because the auditor will have detected evi-
model of voter behavior for live audits, that approach dence that the BMDs in this election have been
is doomed by privacy concerns and by the ‘‘curse of systematically mismarking ballots for some pro-
dimensionality’’: election officials would have to re- portion of all voters. No recount of the paper bal-
cord every nuance of voter behavior (preferences lots can correct this.
across contests; language settings, font settings, and In contrast, if optical scanners are hacked to
other UI settings; timing, including speed of voting cheat on hand-marked paper ballots, the correct out-
and hesitation; on-screen review; etc.) for millions come can be calculated by a full hand recount of the
of voters to accurately approximate voter behavior. paper ballots.25
There are many logistical problems with ‘‘live Wallach also suggests, instead of parallel testing,
auditing.’’ It would require additional voting ma- the use of spoiled-ballot rates as a measure of BMD
chines (because testing requires additional capacity), cheating. Suppose, when BMDs are not cheating,
staff, infrastructure, and other resources, on Election the baseline rate of spoiled ballots (i.e., voters ask-
Day when professional staff is most stretched. One ing for a ‘‘do-over’’ of their BMD marked ballot) is
must be prepared to perform the audits at the busiest 1%. Suppose the machines are cheating on 5% of
times of day; even that will cause lines of voters to the ballots, and 6% of voters notice this, and ask
lengthen, because otherwise the malware can simply for a do-over. Then the spoiled ballot rate increases
cheat only at the busy times. Live auditing must be to 1.3%. The election administrator is supposed to
done in view of the voters (one cannot carry the vot- act upon this discrepancy. But the only meaningful
ing machine into another room to do it), but some action the administrator could take is to invalidate
election officials are concerned that the creation of the entire election, and call for a do-over election.
test ballots in the polling place could be perceived This is impractical.
as a threat of ballot-box stuffing. Moreover, the underlying ‘‘natural’’ rate of spoil-
No state, to our knowledge, has implemented age will not be known exactly, and will vary from
parallel testing or live auditing of BMDs. election to election, even if the machines function
In any case, we can assess the contestability and flawlessly. The natural rate might depend on the
defensibility of parallel testing. number of contests on the ballot, the complexity
With a sufficiently high rate of parallel testing, of voting rules (e.g., instant-runoff voting [IRV] ver-
and a sufficiently sophisticated randomization of au- sus plurality), ballot layout, and many other factors.
ditor behavior, it may be possible to make BMDs For any rule, there will be a tradeoff between false
with parallel testing contestable: an audit could de- alarms and failures to detect problems.
tect and prove mismarking of paper ballots. To continue the previous hypothetical, suppose
But BMDs with parallel testing is not defensible. It that spoiled ballots follow a Poisson distribution
will be extremely difficult for an election official to (there is no reason to think that they do). Imagine
generate convincing public evidence that the audit that the theoretical rate is known to be 1% if the
would have detected mismarking, if mismarking
were occurring. To generate that public evidence,
24
the election official would have to reveal substantial For example, BMDs do ‘‘know’’ their own settings and other
detail about the parallel-testing protocol: how, ex- aspects of each voting session, so malware can use that infor-
mation to target sessions that use the audio interface, increase
actly, the random selection of times to test is made; the font size, use the sip-and-puff interface, set the language
how, exactly, the random selection is made of what to something other than English, or take much longer than av-
candidates to vote for in the tests. Revealing such de- erage to vote. (Voters who use those settings might be less likely
to be believed if they report that the equipment altered their
tails of the protocol allows the attacker to analyze the votes.) For parallel testing to have a good chance of detecting
protocol for clues about how and when to cheat with all outcome-changing problems, the tests must have a large
less chance of detection. chance of probing every combination of settings and voting pat-
Furthermore, parallel testing has a severe disad- terns that includes enough ballots to change any contest result.
It is not practical.
vantage in comparison with other contestable/ 25
Provided, of course, that secure chain of custody of the ballot
defensible paper-ballot-based voting systems: If boxes can be demonstrated.

Failure Study
444 APPEL ET AL.
BMDs function correctly, and known to be 1.3% if ida, opscan ballot was badly designed: it violated
the BMDs malfunction. How many votes must be three separate guidelines from the EAC’s 2007 publi-
cast for it to be possible to limit the chance of a cation, ‘‘Effective Designs for the Administration of
false alarm to 1%, while ensuring a 99% chance Federal Elections, Section 3: Optical Scan Ballots’’
of detecting a real problem? The answer is 28,300 (U.S. Election Assistance Commission 2007) In
votes. If turnout is roughly 50%, jurisdictions (or both of these cases (touchscreens in 2006, hand-
contests) with fewer than 60,000 voters could not marked optical-scan in 2018), undervote rates were
in principle limit the chance of false positives and high. The solution is to follow standard, published
of false negatives to 1%—even under these optimis- ballot-design guidelines and other best practices,
tic assumptions and simplifications. Twenty-three both for touchscreens and for hand-marked ballots
of California’s 58 counties have fewer than 60,000 (Appel 2018c; Norden et al. 2008).
registered voters. Low-tech paper-ballot fraud. All paper ballots,
however they are marked, are vulnerable to loss,
ballot-box stuffing, alteration, and substitution be-
OTHER TRADEOFFS, BMDS VERSUS tween the time they are cast and the time they are
HAND-MARKED OPSCAN recounted. That’s why it is so important to make
sure that ballot boxes are always in multiple-person
Supporters of ballot-marking devices advance (preferably bipartisan) custody whenever they are
several other arguments for their use. handled, and that appropriate physical security mea-
Mark legibility. A common argument is that a sures are in place. Strong, verifiable chain-of-custody
properly functioning BMD will generate clean, protections are essential.
error-free, unambiguous marks, while hand-marked Hand-marked paper ballots are vulnerable to al-
paper ballots may contain mistakes and stray marks teration by anyone with a pen. Both hand-marked
that make it impossible to discern a voter’s intent. and BMD-marked paper ballots are vulnerable to
However appealing this argument seems at first substitution: anyone who has poorly supervised ac-
blush, the data are not nearly so compelling. Expe- cess to a legitimate BMD during election day can
rience with statewide recounts in Minnesota and create fraudulent ballots, not necessarily to deposit
elsewhere suggest that truly ambiguous handmade them in the ballot box immediately (in case the
marks are very rare.26 For instance, 2.9 million
hand-marked ballots were cast in the 2008 Minne-
26
sota race between Al Franken and Norm Coleman States do need clear and complete regulations for interpreting
for the U.S. Senate. In a manual recount, between voter marks.
27
‘‘During the recount, the Coleman and Franken campaigns
99.95% and 99.99% of ballots were unambiguously initially challenged a total of 6,655 ballot-interpretation deci-
marked.27,28 In addition, usability studies of hand- sions made by the human recounters. The State Canvassing
marked bubble ballots—the kind in most common Board asked the campaigns to voluntarily withdraw all but
their most serious challenges, and in the end approximately
use in U.S. elections—indicate a voter error rate 1,325 challenges remained. That is, approximately 5 ballots
of 0.6%, much lower than the 2.5%–3.7% error in 10,000 were ambiguous enough that one side or the other
rate for machine-marked ballots (Everett 2007).29 felt like arguing about it. The State Canvassing Board, in the
Thus, mark legibility is not a good reason to adopt end, classified all but 248 of these ballots as votes for one can-
didate or another. That is, approximately 1 ballot in 10,000 was
BMDs for all voters. ambiguous enough that the bipartisan recount board could not
Undervotes, overvotes. Another argument of- determine an intent to vote.’’ (Appel 2009; see also Office of
fered for BMDs is that the machines can alert voters the Minnesota Secretary of State 2009).
28
We have found that some local election officials consider
to undervotes and prevent overvotes. That is true, marks to be ambiguous if machines cannot read the marks.
but modern PCOS systems can also alert a voter That is a different issue from humans being unable to interpret
to overvotes and undervotes, allowing a voter to the marks. Errors in machine interpretation of voter intent can
be dealt with by manual audits: if the reported outcome is
eject the ballot and correct it. wrong because machines misinterpreted handmade marks, an
Bad ballot design. Ill-designed paper ballots, just RLA has a known, large chance of correcting the outcome.
29
like ill-designed touchscreen interfaces, may lead to Better designed user interfaces (UI) might reduce the error
unintentional undervotes (Norden et al. 2008). For in- rate for machine-marked ballots below the historical rate for
direct-recording electronic (DRE) voting machines; however,
stance, the 2006 Sarasota, Florida, touchscreen ballot UI improvements cannot keep BMDs from printing something
was badly designed. The 2018 Broward County, Flor- other than what the voter is shown on the screen.

Failure Study
ballot box is well supervised on Election Day) but scenario for hand-marked paper ballots and ballot-on-
with the hope of substituting it later in the chain demand (BOD) printers—which can print unmarked
of custody.30 ballots as needed—the total lifecycle costs for
All those attacks (on hand-marked and on BMD- BMDs would be higher than the corresponding
marked paper ballots) are fairly low-tech. There are costs for hand-marked paper ballots.35
also higher-tech ways of producing ballots indistin- Vote centers. To run a vote center that serves
guishable from BMD-marked ballots for substitution many election districts with different ballot styles,
into the ballot box if there is inadequate chain-ofone must be able to provide each voter a ballot con-
custody protection. taining the contests that voter is eligible to vote in,
Accessible voting technology. When hand-marked possibly in a number of different languages. This
paper ballots are used with PCOS, there is (as re- is easy with BMDs, which can be programmed
quired by law) also an accessible voting technology with all the appropriate ballot definitions. With pre-
available in the polling place for voters unable to printed optical-scan ballots, the PCOS can be pro-
mark a paper ballot with a pen. This is typically a grammed to accept many different ballot styles,
BMD or a DRE. When the accessible voting technol- but the vote center must still maintain inventory of
ogy is not the same as what most voters vote on— many different ballots. BOD printers are another
when it is used by very few voters—it may happen economical alternative for vote centers.36
that the accessible technology is ill-maintained or Paper/storage. BMDs that print summary cards
even (in some polling places) not even properly set rather than full-face ballots can save paper and stor-
up by pollworkers. This is a real problem. One pro- age space. However, many BMDs print full-face
posed solution is to require all voters to use the ballots—so they do not save storage—while many
same BMD or all-in-one technology. But the failure
of some election officials to properly maintain their
accessible equipment is not a good reason to adopt 30
Some BMDs print a barcode indicating when and where the
BMDs for all voters. Among other things, it would ballot was produced, but that does not prevent such a substitu-
tion attack against currently Election Assistance Commission
expose all voters to the security flaws described (EAC)-certified, commercially available BMDs. We understand
above.31 Other advocates object to the idea that dis- that systems under development might make ballot-substitution
abled voters must use a different method of marking attacks against BMDs more difficult.
31
ballots, arguing that their rights are thereby violated. Also, some accessibility advocates argue that requiring dis-
abled voters to use BMDs compromises their privacy since
Both the Help America Vote Act (HAVA) and the hand-marked ballots are easily distinguishable from machine
Americans with Disabilities Act (ADA) require rea- marked ballots. That issue can be addressed without BMDs-
sonable accommodations for voters with physical for-all: Accessible BMDs are already available and in use
that mark ballots with marks that cannot easily be distinguished
and cognitive impairments, but neither law requires from hand-marked ballots.
that those accommodations must be used by all vot- 32
Single-sheet (one- or two-side) ballots cost 20–28 cents;
ers. To best enable and facilitate participation by all double-sheet ballots needed for elections with many contests
cost up to 50 cents.
voters, each voter should be provided with a means 33
Ballot cards for ES&S ExpressVote cost about 15 cents. New
of casting a vote best suited to their abilities. Hampshire’s (One4All/Prime III) BMDs used by sight-impaired
Ballot printing costs. Preprinted optical-scan bal- voters use plain paper that is less expensive.
34
lots cost 20–50 cents each.32 Blank cards for BMDs They include not only the cost of acquiring and implementing
systems but also the ongoing licensing, logistics, and operating
cost up to 15 cents each, depending on the make (purchasing paper stock, printing, and inventory management)
and model of BMD.33 But optical-scan ballots must costs.
35
be preprinted for as many voters as might show up, Ballot-on-demand (BOD) printers currently on the market ar-
guably are best suited for vote centers, but less expensive op-
whereas blank BMD cards are consumed in propor- tions suited for polling places could be developed. Indeed,
tion to how many voters do show up. The Open BMDs that print full-face ballots could be re-purposed as
Source Election Technology Institute (OSET) con- BOD printers for polling place use, with modest changes to
the programming.
ducted an independent study of total life cycle 36
Ballot-on-demand printers may require maintenance such as
costs34 for hand-marked paper ballots and BMDs in replacement of toner cartridges. This is readily accomplished
conjunction with the 2019 Georgia legislative debate at a vote center with a professional staff. Ballot-on-demand
regarding BMDs (Perez 2019). OSET concluded that, printers may be a less attractive option for many small precincts
on Election Day, where there is no professional staff—but on
even in the most optimistic (i.e., lowest cost) scenario the other hand, they are less necessary, since far fewer ballot
for BMDs and the most pessimistic (i.e., highest cost) styles will be needed in any one precinct.

Failure Study
446 APPEL ET AL.
BMDs that print summary cards (which could save that encode more complex patterns and information.
storage) use thermal printers and paper that is frag- BMDs print barcodes on the same paper ballot that
ile and can fade in a few months.37 contains human-readable ballot choices. Voters
Advocates of hand-marked paper ballot systems using BMDs are expected to verify the human-
advance these additional arguments. readable printing on the paper ballot card, but the
Cost. Using BMDs for all voters substantially in- presence of barcodes with human-readable text
creases the cost of acquiring, configuring, and main- poses some significant problems.
taining the voting system. One PCOS can serve 1,200 Barcodes are not human readable. The whole pur-
voters in a day, while one BMD can serve only about pose of a paper ballot is to be able to recount (or
260 (Election Systems and Software 2018)—though audit) the voters’ votes in a way independent of any
both these numbers vary greatly depending on the (possibly hacked or buggy) computers. If the official
length of the ballot and the length of the day. vote on the ballot card is the barcode, then it is impos-
OSET analyzed the relative costs of acquiring sible for the voters to verify that the official vote they
BMDs for Georgia’s nearly seven million registered cast is the vote they expressed. Therefore, before a
voters versus a system of hand-marked paper bal- state even considers using BMDs that print barcodes
lots, scanners, and BOD printers (Perez 2019). A (and we do not recommend doing so), the state must
BMD solution for Georgia would cost taxpayers be- ensure by statute that recounts and audits are based
tween three and five times more than a system based only on the human-readable portion of the paper bal-
on hand-marked paper ballots. Open-source sys- lot. Even so, audits based on untrustworthy paper
tems might eventually shift the economics, but cur- trails suffer from the verifiability the problems out-
rent commercial universal-use BMD systems are lined above.
more expensive than systems that use hand-marked Ballot cards with barcodes contain two differ-
paper ballots for most voters. ent votes. Suppose a state does ensure by statute
Mechanical reliability and capacity. Pens are that recounts and audits are based on the human-
likely to have less downtime than BMDs. It is easy readable portion of the paper ballot. Now a
and inexpensive to get more pens and privacy screens BMD-marked ballot card with both barcodes and
when additional capacity is needed. If a precinct- human-readable text contains two different votes
count scanner goes down, people can still mark bal- in each contest: the barcode (used for electronic
lots with a pen; if the BMD goes down, voting tabulation), and the human-readable selection
stops. Thermal printers used in DREs with VVPAT printout (official for audits and recounts). In few
are prone to jams; those in BMDs might have similar (if any) states has there even been a discussion
flaws. of the legal issues raised when the official mark-
These secondary pros and cons of BMDs do not ings to be counted differ between the original
outweigh the primary security and accuracy con- count and a recount.
cern: BMDs, if hacked or erroneously programmed, Barcodes pose technical risks. Any coded input
can change votes in a way that is not correctable. into a computer system—including wired network
BMD voting systems are not contestable or defensi- packets, Wi-Fi, USB thumbdrives, and barcodes—
ble. Audits that rely on BMD printout cannot make pose the risk that the input-processing software can
up for this defect in the paper trail: they cannot re- be vulnerable to attack via deliberately ill-formed
liably detect or correct problems that altered elec- input. Over the past two decades, many such vulner-
tion outcomes. abilities have been documented on each of these chan-
nels (including barcode readers) that, in the worst case,
Barcodes
37
A controversial feature of some BMDs allows The California Top-To-Bottom Review (TTBR) of voting sys-
them to print one-dimensional or two-dimensional tems found that thermal paper can also be covertly spoiled
wholesale using common household chemicals. <https://
barcodes on the paper ballots. A one-dimensional votingsystems.cdn.sos.ca.gov/oversight/ttbr/red-diebold.pdf>
barcode resembles the pattern of vertical lines (last visited April 8, 2019; Matt Bishop, Principal Investigator).
used to identify products by their universal product The fact that thermal paper printing can fade or deteriorate
rapidly might mean it does not satisfy the federal requirement to
codes. A two-dimensional barcode or QR code is a preserve voting materials for 22 months (U.S. Code Title 52,
rectangular area covered in coded image modules Chapter 207, Sec. 20701, as of April 2020).

Failure Study
give the attacker complete control of a system.38 If an ballot, which the voting machine ejects through
attacker were able to compromise a BMD, the barco- a slot for review; then the voter redeposits the
des are an attack vector for the attacker to take over an ballot into the slot, where it is scanned and drop-
optical scanner (PCOS or CCOS), too. Since it is good ped into the ballot box.
practice to close down all such unneeded attack vec-
tors into PCOS or CCOS voting machines (e.g., In all three of these machines, the ballot-marking
don’t connect your PCOS to the Internet!), it is also printer is in the same paper path as the mechanism
good practice to avoid unnecessary attack channels to deposit marked ballots into an attached ballot
such as barcodes. box. This opens up a very serious security vulnerabil-
ity: the voting machine can mark the paper ballot (to
add votes or spoil already-cast votes) after the last
INSECURITY OF ALL-IN-ONE BMDS time the voter sees the paper, and then deposit that
marked ballot into the ballot box without the possibil-
Some voting machines incorporate a BMD inter- ity of detection.
face, printer, and optical scanner into the same cabinet. Vote-stealing software could easily be con-
Other DRE+VVPAT voting machines incorporate structed that looks for undervotes on the ballot,
ballot-marking, tabulation, and paper-printout reten- and marks those unvoted spaces for the candidate
tion, but without scanning. These are often called of the hacker’s choice. This is very straightforward
‘‘all-in-one’’ voting machines. To use an all-in-one ma- to do on optical-scan bubble ballots (as on the
chine, the voter makes choices on a touchscreen or Dominion ICE) where undervotes are indicated by
through a different accessible interface. When the se- no mark at all. On machines such as the Express-
lections are complete, the BMD prints the completed Vote and ExpressVoteXL, the normal software indi-
ballot for the voter to review and verify, before depos- cates an undervote with the words ‘‘no selection
iting the ballot in a ballot box attached to the machine. made’’ on the ballot summary card. Hacked soft-
Such machines are especially unsafe: like any ware could simply leave a blank space there (most
BMD described in Section 3, ‘‘(Non)Contestabil- voters wouldn’t notice the difference), and then
ity/Defensibility of BMDs,’’ they are not contest- fill in that space and add a matching bar code
able or defensible, but in addition, if hacked they after the voter has clicked ‘‘cast this ballot.’’
can print votes onto the ballot after the voter last in- An even worse feature of the ES&S Express-
spects the ballot. Vote and the Dominion ICE is the auto-cast con-
figuration setting (in the manufacturer’s standard
! The ES&S ExpressVote (in all-in-one mode) al- software) that allows the voter to indicate, ‘‘don’t
lows the voter to mark a ballot by touchscreen or eject the ballot for my review, just print it and cast
audio interface, then prints a paper ballot card it without me looking at it.’’ If fraudulent software
and ejects it from a slot. The voter has the oppor- were installed in the ExpressVote, it could change
tunity to review the ballot, then the voter redepo- all the votes of any voter who selected this option,
sits the ballot into the same slot, where it is because the voting machine software would know
scanned and deposited into a ballot box. in advance of printing that the voter had waived the
! The ES&S ExpressVoteXL allows the voter to opportunity to inspect the printed ballot. We call
mark a ballot by touchscreen or audio interface, this auto-cast feature ‘‘permission to cheat’’ (Appel
then prints a paper ballot and displays it under 2018a).
glass. The voter has the opportunity to review Regarding these all-in-one machines, we con-
the ballot, then the voter touches the screen to include:
dicate ‘‘OK,’’ and the machine pulls paper ballot
up (still under glass) and into the integrated bal-
lot box. 38
An example of a barcode attack is based on the fact that many
! The Dominion ImageCast Evolution (ICE) al- commercial barcode-scanner components (which system inte-
lows the voter to deposit a hand-marked paper grators use to build cash registers or voting machines) treat
ballot, which it scans and drops into the attached the barcode scanner using the same operating-system interface
as if it were a keyboard device; and then some operating sys-
ballot box. Or, a voter can use a touchscreen or tems allow ‘‘keyboard escapes’’ or ‘‘keyboard function keys’’
audio interface to direct the marking of a paper to perform unexpected operations.

Failure Study
448 APPEL ET AL.
! Any machine with ballot printing in the same cally. Because outcome-changing errors in BMD
paper path with ballot deposit is not software printout do not produce public evidence, BMD
independent; it is not the case that ‘‘an error systems are not contestable. Because there is no
or fault in the voting system software or hard- way to generate convincing public evidence that
ware cannot cause an undetectable change in reported outcomes are correct despite any BMD
election results.’’ Therefore such all-in-one malfunctions that might have occurred, BMD sys-
machines do not comply with the VVSG tems are not defensible. Therefore, BMDs should
2.0 (the Election Assistance Commission’s not be used by voters who can hand mark paper
Voluntary Voting Systems Guidelines). Such ballots.
machines are not contestable or defensible, All-in-one voting machines, which combine ballot-
either. marking and ballot-box-deposit into the same paper
! All-in-one machines on which all voters use path, are even worse. They have all the disadvantages
the BMD interface to mark their ballots (such of BMDs (they are not contestable or defensible), and
as the ExpressVote and ExpressVoteXL) also they can mark the ballot after the voter has inspected
suffer from the same serious problem as ordi- it. Therefore they are not even software independent,
nary BMDs: most voters do not review their and should not be used by those voters who are capa-
ballots effectively, and elections on these ma- ble of marking, handling, and visually inspecting a
chines are not contestable or defensible. paper ballot.
! The auto-cast option for a voter to allow the When computers are used to record votes, the
paper ballot to be cast without human inspec- original transaction (the voter’s expression of the
tion is particularly dangerous, and states must votes) is not documented in a verifiable way.39
insist that vendors disable or eliminate this When pen and paper are used to record the vote,
mode from the software. However, even dis- the original expression of the vote is documented
abling the auto-cast feature does not eliminate in a verifiable way (if demonstrably secure chain
the risk of undetected vote manipulation. of custody of the paper ballots is maintained).
Audits of elections conducted with hand-marked
Remark paper ballots, counted by optical scanners, can en-
sure that reported election outcomes are correct.
The Dominion ImageCast Precinct ICP320 is a Audits of elections conducted with BMDs cannot
precinct-count optical scanner (PCOS) that also ensure that reported outcomes are correct.
contains an audio+buttons ballot-marking inter-
face for disabled voters. This machine can be con-
figured to cast electronic-only ballots from the
BMD interface, or an external printer can be at- REFERENCES
tached to print paper optical-scan ballots from
the BMD interface. When the external printer is Appel, A.W. 2009. ‘‘Optical-Scan Voting Extremely Accurate in
Minnesota.’’ Freedom to Tinker. January. <https://freedom-
used, that printer’s paper path is not connected to to-tinker.com/2009/01/21/optical-scan-voting-extremely-
the scanner+ballot-box paper path (a person must accurate-minnesota/>.
take the ballot from the printer and deposit it Appel, A.W. 2018a. ‘‘Serious Design Flaw in ESS ExpressVote
into the scanner slot). Therefore this machine is Touch-Screen: ‘‘Permission to Cheat.’’’’ Freedom to Tinker.
as safe to use as any PCOS with a separate external September. <https://freedom-to-tinker.com/2018/09/14/
serious-design-flaw-in-ess-expressvote-touchscreen-permis
BMD.
sion-to-cheat/>.
CONCLUSION
39
It is conceivable that cryptographic protocols like those used
Ballot-marking devices produce ballots that do in E2E-V systems could be used to create BMD-based systems
not necessarily record the vote expressed by the that are contestable and defensible, but no such system exists,
voter when they enter their selections on the nor, to our knowledge, has such a design been worked out in
touchscreen: hacking, bugs, and configuration er- principle. Existing E2E-V systems that use a computer to
print (encrypted) selections are neither contestable nor defensi-
rors can cause the BMDs to print votes that differ ble, as explained in Section 1, ‘‘Introduction: Criteria for Voting
from what the voter entered and verified electroni- Systems.’’

Failure Study
Appel, A.W. 2018b. ‘‘End-to-End Verifiable Elections.’’ Free- Everett, S.P. 2007. ‘‘The Usability of Electronic Voting Machines
dom to Tinker. November. <https://freedom-to-tinker.com/ and How Votes Can Be Changed Without Detection.’’ PhD
2018/11/05/end-to-end-verifiable-elections/>. thesis. Rice University.
Appel, A.W. 2018c. ‘‘Florida Is the Florida of Ballot-Design Feldman, A.J., J.A. Halderman, and E.W. Felten. 2007. ‘‘Secur-
Mistakes.’’ Freedom to Tinker. November 2018. <https:// ity Analysis of the Diebold AccuVote-TS Voting Machine.’’
freedom-to-tinker.com/2018/11/14/florida-is-the-florida-of- In 2007 USENIX/ACCURATE Electronic Voting Technol-
ballot-design-mistakes/>. ogy Workshop (EVT 2007). August.
Bell, S., J. Benaloh, M.D. Byrne, D. DeBeauvoir, B. Eakin, Johansson, P., L. Hall, and S. Sikstrom. 2008. ‘‘From Change
G. Fisher, P. Kortum, N. McBurnett, J. Montoya, M. Parker, Blindness to Choice Blindness.’’ Psychologia 51(2): 142–155.
O. Pereira, P.B. Stark, D.S. Wallach, and M. Winn. 2013. Kahnemann, D. 2011. Thinking, Fast and Slow. New York, NY:
‘‘STAR-Vote: A Secure, Transparent, Auditable, and Reli- Farrar, Straus and Giroux.
able Voting System.’’ USENIX Journal of Election Technol- Lindeman, M. and P.B. Stark. 2012. ‘‘A Gentle Introduction to
ogy and Systems (JETS) 1(1): 18–37. Risk-Limiting Audits.’’ IEEE Security and Privacy 10(5):
Benaloh, J., D. Jones, E. Lazarus, M. Lindeman, and P.B. Stark. 42–49.
2011. ‘‘SOBA: Secrecy-Preserving Observable Ballot- National Academies of Sciences, Engineering, and Medicine.
Level Audits.’’ In Proceedings of the 2011 Electronic Vot- 2018. Securing the Vote: Protecting American Democ-
ing Technology Workshop / Workshop on Trustworthy racy. Washington, DC: National Academies Press. Sep-
Elections (EVT/WOTE ‘11). USENIX. tember.

Benaloh, Josh, Ronald L. Rivest, Peter Y.A. Ryan, Philip B. Stark, Norden, L., M. Chen, D. Kimball, and W. Quesenbery.
Vanessa Teague, and Poorvi L. Vora. 2014. ‘‘End-to-End Ver- 2008. ‘‘Better Ballots.’’ Brennan Center for Justice. July
ifiability.’’ ArXiv.org. February 2. <https://arxiv.org/ftp/arxiv/ 21. <http://www.brennancenter.org/publication/better-
papers/1504/1504.03778.pdf>. ballots>.
Bernhard, Matthew, Allison McDonald, Henry Meng, Jensen Office of the Minnesota Secretary of State. 2009. ‘‘Minnesota’s
Hwa, Nakul Bajaj, Kevin Chang, and J. Alex Halderman. Historic 2008 Election.’’ In Minnesota Legislative Manual
2020. ‘‘Can Voters Detect Malicious Manipulation of Ballot (Blue Book), 2009–2010 ed. Saint Paul, MN: Office
Marking Devices?’’ In 41st IEEE Symposium on Security of the Minnesota Secretary of State. <https://www.sos
and Privacy. IEEE. .state.mn.us/media/3078/minnesotas-historic-2008-elec
Bothwell, R.K., K.A. Deffenbacher, and J.C. Brigham. 1987. tion.pdf>.
‘‘Correlation of Eyewitness Accuracy and Confidence: Perez, E. 2019. ‘‘Georgia State Election Technology Acquisi-
Optimality Hypothesis Revisited.’’ Journal of Applied Psy- tion: A Reality Check.’’ OSET Institute Briefing. March.
chology 72(4): 691–695. <https://trustthevote.org/wp-content/uploads/2019/03/06Mar
Chaum, D., A. Essex, R.T. Carback III, J. Clark, S. Popoveniuc, 19-OSETBriefing_GeorgiaSystemsCostAnalysis.pdf>.
A.T. Sherman, and P. Vora. 2008. ‘‘Scantegrity: End-to-End Rayner, K. 2009. ‘‘Eye Movements and Attention in Reading,
Voter Verifiable Optical-Scan Voting.’’ IEEE Security & Scene Perception, and Visual Search.’’ Quarterly Journal
Privacy 6(3): 40–46. of Experimental Psychology 62(8): 1457–1506.
Contag, Moritz, Guo Li, Andre Pawlowski, Felix Domke, Kirill Reason, J. 2009. Human Error (20th Printing). New York, NY:
Levchenko, Thorsten Holz, and Stefan Savage. 2017. ‘‘How Cambridge University Press.
They Did It: An Analysis of Emission Defeat Devices in Rivest, R.L., and J.P. Wack. 2006. ‘‘On the Notion of ‘Software
Modern Automobiles.’’ In 2017 IEEE Symposium on Secur- Independence’ in Voting Systems.’’ White paper. July. <https://
ity and Privacy, 231–250. San Jose, CA: IEEE. www.nist.gov/system/files/si-in-voting.pdf>.
Deffenbacher, K. 1980. ‘‘Eyewitness Accuracy and Confidence: Rivest, Ronald L. 2008. ‘‘On the Notion of ‘Software Independ-
Can We Infer Anything About Their Relation?’’ Law and ence’ in Voting Systems.’’ Philosophical Transactions of
Human Behavior 4: 243–260. the Royal Society A: Mathematical, Physical and Engineer-
DeMillo, R., R. Kadel, and M. Marks. 2018. ‘‘What Voters Are ing Sciences 366(1881): 3759–3767.
Asked to Verify Affects Ballot Verification: A Quantitative Rivest, Ronald L., and Madars Virza. 2016. ‘‘Software Inde-
Analysis of Voters’ Memories of Their Ballots.’’ SSRN. No- pendence Revisited.’’ In Real-World Electronic Voting,
vember. <https://ssrn.com/abstract=3292208>. eds. Feng Hao and Peter Y.A. Ryan, 19–34. Boca Raton,
Desmarais, S.L., T.L. Nicholls, J. D. Read, and J. Brink. 2010. FL: Auerbach Publications.
‘‘Confidence and Accuracy in Assessments of Short-Term Ryan, P.Y.A., D. Bismark, J. Heather, S. Schneider, and Z. Xia.
Risks Presented by Forensic Psychiatric Patients.’’ Journal 2009. ‘‘Prêt à Voter: A Voter- Verifiable Voting System.’’
of Forensic Psychiatry & Psychology 21(1): 1–22. IEEE Transactions on Information Forensics and Security
Dunning, D., D.W. Griffin, J.D. Milojkovic, and L. Ross. 1990. 4(4): 662–673.
‘‘The Overconfidence Effect in Social Prediction.’’ Journal Stark, P.B. 2008. ‘‘Conservative Statistical Post-Election
of Personality and Social Psychology 58: 568–581. Audits.’’ Annals of Applied Statistics 2(2): 550–581.
Election Systems and Software. 2018. State of Georgia Electronic Stark, P.B. 2009. ‘‘Risk-Limiting Postelection Audits: Conser-
Request for Information New Voting System. Event Number: vative P-values from Common Probability Inequalities.’’
47800-SOS0000035. August 24. <http://sos.ga.gov/admin/ IEEE Transactions on Information Forensics and Security
files/ESS%20RFI%20-%20Final%20-%20Redacted.pdf>. 4(4): 1005–1014.

Failure Study
450 APPEL ET AL.
Stark, P.B. 2018. ‘‘An Introduction to Risk-Limiting Audits and Wallach, Dan S. 2019. ‘‘On the Security of Ballot Marking
Evidence-Based Elections.’’ Testimony prepared for the Devices.’’ ArXiv.org. December. <https://arxiv.org/abs/
California Little Hoover Commission. July 2. <https:// 1908.01897>.
www.stat.berkeley.edu/~stark/Preprints/lhc18.pdf>. Wixted, J.T., and G.L. Wells. 2017. ‘‘The Relationship Between
Stark, P.B. 2019. ‘‘There Is No Reliable Way to Detect Eyewitness Confidence and Identification Accuracy: A
Hacked Ballot-Marking Devices.’’ ArXiv.org. August. New Synthesis.’’ Psychological Science in the Public Inter-
<https://arxiv.org/abs/1908.08144>. est 18(1): 10–65.
Stark, P.B., and D.A. Wagner. 2012. ‘‘Evidence-Based Elec-
tions.’’ IEEE Security and Privacy 10(5): 33–41.
U. S. Election Assistance Commission. 2007. Effective Designs Address correspondence to:
for the Administration of Federal Elections. June. <https:// Andrew W. Appel
www.eac.gov/sites/default/files/event_document/files/EAC_ Department of Computer Science
Effective_Election_Design.pdf>. Princeton University
U.S. Election Assistance Commission. 2017. Voluntary 35 Olden Street
Voting Systems Guidelines 2.0. September. <https://www
.eac.gov/sites/default/files/TestingCertification/2020_02_29_
Princeton, NJ 08540
vvsg_2_draft_requirements.pdf>. USA
Verified Voting Foundation. 2018. ‘‘The Verifier—Polling

E-mail: [email protected]
Place Equipment—November 2018.’’ Verified Voting. No-
vember. <https://www.verifiedvoting.org/verifier/>.
Verified Voting Foundation. 2020. ‘‘The Verifier—Polling Place Received for publication December 27, 2019; re-
Equipment—November 2020.’’ Verified Voting. February 8 ceived in revised form February 14, 2019; accepted
(retrieved). <https://www.verifiedvoting.org/verifier/>. April 4, 2020; published online June 17, 2020.

Failure Study
Ex. R to TRO Motion:

Moore Affidavit

Moore Affidavit

Moore Affidavit
Ex. T to TRO Motion:

R. Hall Affidavit

R. Hall Affidavit

R. Hall Affidavit

R. Hall Affidavit

R. Hall Affidavit

R. Hall Affidavit
Ex. U to TRO Motion:

Hartman Affidavit

Hartman Affidavit

Hartman Affidavit

Hartman Affidavit

2020-11-17 TRO Motion With Exhibits

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

2020-11-17 TRO Motion With Exhibits

Uploaded by

Copyright:

Available Formats

Case 1:20-cv-04651-SDG Document 6 Filed 11/17/20 Page 1 of 29

Case 1:20-cv-04651-SDG Document 6 Filed 11/17/20 Page 2 of 29

Democratic Party of Georgia, et al. v.

Ex. A to TRO Motion:

Ex. A to TRO Motion:

Ex. A to TRO Motion:

Ex. A to TRO Motion:

Ex. A to TRO Motion:

/s/ Bruce V. Spiva /s/ Vincent R. Russo

*Admitted Pro Hac Vice

Counsel for State Defendants

Counsel for Plaintiffs

Ex. A to TRO Motion:

Ex. B to TRO Motion:

Ex. B to TRO Motion:

Ex. B to TRO Motion:

Ex. B to TRO Motion:

Ex. C to TRO Motion:

Ex. C to TRO Motion:

Ex. C to TRO Motion:

Ex. C to TRO Motion:

Ex. C to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. D to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

Ex. E to TRO Motion:

UNITED STATES DISTRICT COURT

Plaintiff, CIVIL ACTION FILE NO.

BRAD RAFFENSPERGER,in his official

AFFIDAVIT OF MAYRA ROMERA IN SUPPORT OF PLAINTIFF'S

Ex. F to TRO Motion:

personal knowledge ofthe matters stated herein.

2.1 am a Florida Bar licensed paralegal.

3.1 am a registered Democrat.

observer in the Georgia recount process.

5. On Monday, November 16, 2020, I presented myself to Cobb County Poll