Maricopa County Election Audit Cyber Ninjas Sow Executed 33121
Maricopa County Election Audit Cyber Ninjas Sow Executed 33121
Statement of Work
This Statement of Work (the “Statement of Work”) is effective as of as of the 31 day of March, 2021 (the “Effective
Date”), between Cyber Ninjas Inc., a Florida Corporation, (“Contractor”), and Arizona State Senate (“Client”), and is
deemed to be incorporated into that certain Master Service Agreement dated March 31, 2021 (the “Master
Agreement”) by and between Contractor and Client (collectively, this Statement of Work and the Master Agreement are
referred to as the “Agreement”).
Both our company and our partners have extensive experience working specifically with Dominion Voting Systems. In
addition, our subcontractors and partners are adept at digital forensic acquisition, and on implementing ballot hand-
counting procedures. Two of our team members authored a hand-count ballot process that has been utilized in audits in
two states; and has further been perfected for transparency and consistency. This combination of skills, abilities, and
experience is what uniquely qualifies our team for the outlined work.
2 OUR TEAM
Cyber Ninjas will serve as the central point-of-contact and organizer of all work conducted over the course of this
agreement. However, there are different teams involved in each phase of the outlined work. Each of these teams have
specialities and experience within the outlined areas of their coverage. This expertise is highlighted below.
They will be continuing this work as part of this effort to validate that individuals that show as having voted in the 2020
General election match those individuals who believe they have cast a vote.
As part of these audits in 2020, the Wake Technology Services team has developed an in-depth counting process that
reduces opportunities for errors. This counting process has been expanded to make it more robust, and more
transparent. As a result, they will be leading all ballot hand-counting processes.
2.3 Electronic Voting System Team – CyFIR, Digital Discovery & Cyber Ninjas, Analysts
Digital Forensic Acquisition will be performed either by CyFIR or Digital Forensics, and the analysis work will be
performed by Cyber Ninjas, CyFIR and a number of additional analysts, the identities and qualifications of whom shall be
made available to Client upon request.
CyFIR is a digital security and forensics company and a subcontractor on the contract for DHS’s Hunt and Incident
Response Team (HIRT). As specialists for DHS, they are familiar with responding to nation-state cyber activity including
Advanced Persistent Threats (APT).
3 GENERAL PROVISIONS
3.1 Introduction. The terms and conditions that are specific to this Statement of Work are set forth herein. Any terms
and conditions that deviate from or conflict with the Master Agreement are set forth in the “Deviations from
Terms of the Master Agreement” Schedule hereto. In the event of a conflict between the provisions of this
Statement of Work and the Master Agreement, the provisions of Section 2.34 of the Master Agreement shall
control such conflict.
3.2 Services. Contractor will provide to the Client the Services in accordance with the Master Agreement (including
the Exhibits thereto) and this Statement of Work (including the Schedules hereto). The scope and composition of
the Services and the responsibilities of the Parties with respect to the Services described in this Statement of
Work are defined in the Master Agreement, this Statement of Work, and any Schedules attached hereto.
The following sub-sections provides additional details of what will be conducted at each stage of the audit.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D
• Problems that could result in voters being able to vote more than once;
• Voters that voted but do not show in the list of those who voted;
• Voters who likely did not vote but showed as having voted;
• Potential invalid voters who cast a vote in the 2020 general election; and/or
• Inconsistencies among vote tallies between the various phases.
Anticipated artifacts for transparency and/or validation of results for the public:
Anticipated artifacts for transparency and/or validation of results for the public:
• Forensic Images of Arizona’s SiteBook System including the database server, as well as any client machines
associated with Maricopa County;
• Forensic images captured of the Election Management System main server, adjudication machines, and other
systems related to the Election Management System;
• Forensic images of all Compact Flash, USB drives, and related media;
• Inspection to identify usage of cellular modems, Wi-Fi cards, or other technologies that could be utilized to
connect systems to the internet or wider-area-network;
• Review of the Tabulator Paper Tally print-outs;
• Reviewing the exports from the EMS for “Audit File”, “Audit Images” and “CVR”;
• Reviewing ballot images captured by the tabulators
• Reviewing forensic images for possible altering of results or other issues; and/or
• Reviewing of tabulator and other logs.
Anticipated artifacts for transparency and/or validation of results for the public:
• Issues where result tallies were not properly transmitted to the official results; and/or
• Inconsistencies among vote tallies between the various phases.
Anticipated artifacts for transparency and/or validation of results for the public:
5 METHODOLOGY
The following section outlines the proposed methodology utilized in the various phases of the audit. When appropriate,
these sections may reference more detailed procedures. Such procedures are considered proprietary and the
intellectual property of Cyber Ninjas, our subcontractors or our Partners and can be made available for review but are
not explicitly part of this agreement.
6 RESPONSIBILITIES
The following section outlines the key responsibilities for the proper execution of the Agreement between the
Contractor and the Client for all outlined work within the scope.
• Provide the proper personnel to conduct the analysis of the data required to execute the scope of this phase.
Client Responsibilities
• Arrange for a database export of SiteBook to be provided to the Client which includes all fields normally found in
a publicly requested copy of the voter rolls, in addition to any other non-sensitive fields related to the data such
as modifications or other time-stamps, voter history, last user edited, IP address of edit; or anything similar.
• Provide the proper personnel and equipment to execute all aspects of the phase including scanning, counting,
the setup of equipment for recording of the counting, and the supervision of activities.
• Ensure that all onsite personnel follow any in-place COVID requirements.
Client Responsibilities
• Provide security of the building during the course of the engagement. This includes having sufficient security to
prevent access to the building 24/7 during the entire time, including ensuring that safe working conditions can
exist during the entirety of the audit;
• Provide electricity and access to the facilities and tables necessary for up to 120 people at a time following any
current COVID requirements. This is estimated to be about 7,200 square feet;
• Provide access to all paper ballots from the November 2020 General Election within Maricopa County. This
includes early voting, election day ballots, provisional ballots, spoiled ballots, printed unused ballots and any
other ballot categories that are part of the 2020 General Election. For all ballots this should include the original
hard copies of the ballots that were electronically adjudicated ballots.
• Provide a mechanism to allow for the proper equipment to be brought into the facility where the counting will
take place.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D
• Full chain of custody documentation for all ballots from the point they were cast to the point where we gain
access to the ballots, to the extent such documentation is in Client’s possession.
• Purchase orders for all purchased ballots, or ballot paper, including counts of each, as well as delivery receipts of
the quantity of ballots received, to the extent such documentation is in Client’s possession.
• Full counts from any ballots printed on demand, as well as the location for which they were printed, to the
extent such documentation is in Client’s possession.
• Provide wired access to internet to be able to stream the counting video capture, provided that any such video
footage must be streamed, recorded or broadcast in such a manner that the candidate or ballot proposition
selections on each ballot shall not be visible or discernible.
• Provide the proper personnel to execute all aspects of the phase including the capture of forensic digital images
of all systems related to the Election Management System; and
• Ensure that all onsite personnel during the forensic capture follow any in-place COVID requirements.
Client Responsibilities
• Provide physical access to the EMS Server, Adjudication machines, ImageCast Central, ImageCast Precinct,
ImageCast Ballot Marking Devices, SiteBook, NOVUS systems, and any other Election Management System
equipment or systems utilized in the November 2020 General Election to the forensic capture team;
• Provide access to Compact Flash Cards, USB Drives, and any other media utilized in the November 2020 General
Election for the forensic capture team to image;
• Provide electricity and sufficient access to the machines in scope in order to provide a team of up to 15 forensic
capture individuals to work and boot up the systems;
• Provide any needed credentials for decrypting media, decrypting computer hard drives, the EMS machines, or
other systems that may be required for a proper forensic capture of the machines;
• Provide the output of the “Audit File,” “Audit Images,” and CVR exports from the Dominion machines which
includes all ballot images and AuditMark images of every ballot processed by the machines; and
o NOTE: The above may be able to be captured from the forensic images; but Maricopa County assistance
could be needed in identifying where the AuditMark files are located.
• Provide any needed technical assistance allowing all the above to be successfully captured.
• Provide the proper personnel to conduct the analysis of the data required to execute the scope of this phase.
Client Responsibilities
• Provide the official results per precinct for all counts associated with the November 2020 General Election.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D
7 DELIVERABLE MATERIALS
The primary deliverable for the Election Audit will be a report detailing all findings discovered during the assessment.
The parties agree that the report is provided AS IS, without any promise for any expected results. Additional artifacts as
collected during the work will also be provided, as outlined within the scoping details.
• An executive summary outlining the overall results of the audit from the various phases;
• A methodology section outlining in detail the methodology and techniques utilized to capture and validate the
results;
• Tables, charts, and other data representing the findings of the data;
• Appendices or attached files demonstrating all evidence utilized to come to the outlined conclusions (if
applicable); and
• Recommendations on how to prevent any detected weaknesses from being a problem in future elections (if
applicable).
In addition to the report, various anticipated artifacts for public consumption will be generated over the course of this
work, as outlined under the “Scope of Work.” Client will determine in its sole and unlimited discretion whether, when,
and how the Contractor should release those resources to the public. This will include all videos, ballot images, and
other data.
8 COMPLETION CRITERIA
Contractor shall have fulfilled its obligations when any one of the following first occurs:
• Contractor accomplishes the Contractor activities described within this Statement of Work, including delivery to
Client of the materials listed in the Section entitled “Deliverable Materials,” and Client accepts such activities
and materials without unreasonable objections; or
• If Client does not object or does not respond to Contractor within seven (7) business days from the date that the
deliverables have been delivered by Contractor to Client, such failure to respond shall be deemed acceptance by
Client.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D
Each phase outlined below can be conducted simultaneously, with the exception of the Reported Results phase which
must be completed at the end. Roughly an additional week of time at the conclusion of all phases is needed to complete
and finalize reporting. Lead times before a phase can start as well as their duration can be found below. Faster lead
times can potentially be accommodated on a case-by-case basis.
IN WITNESS WHEREOF, the parties hereto have caused this Statement of Work to be effective as of the day, month and
year written above.
Accepted by:
By:________________________________________
________________________________________
Karen Fann, President
Title:_______________________________________
Accepted by:
By:________________________________________
Douglas Logan