DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

Statement of Work
This Statement of Work (the “Statement of Work”) is effective as of as of the 31 day of March, 2021 (the “Effective
Date”), between Cyber Ninjas Inc., a Florida Corporation, (“Contractor”), and Arizona State Senate (“Client”), and is
deemed to be incorporated into that certain Master Service Agreement dated March 31, 2021 (the “Master
Agreement”) by and between Contractor and Client (collectively, this Statement of Work and the Master Agreement are
referred to as the “Agreement”).

1 WHY CYBER NINJAS

Cyber Ninjas is a cyber security company with a focus on application security and ethical hacking. We perform work
across the financial services and government sectors. Our expertise allows us to both understand complex technology
systems, as well as understand how a malicious attacker could potentially abuse those systems to meet his or her own
agenda. This allows us to effectively enumerate the ways a system could be exploited, and with our partners to fully
review if that scenario did in fact occur. This is very different from the compliance focused way that election systems are
typically evaluated.

Both our company and our partners have extensive experience working specifically with Dominion Voting Systems. In
addition, our subcontractors and partners are adept at digital forensic acquisition, and on implementing ballot hand-
counting procedures. Two of our team members authored a hand-count ballot process that has been utilized in audits in
two states; and has further been perfected for transparency and consistency. This combination of skills, abilities, and
experience is what uniquely qualifies our team for the outlined work.

2 OUR TEAM
Cyber Ninjas will serve as the central point-of-contact and organizer of all work conducted over the course of this
agreement. However, there are different teams involved in each phase of the outlined work. Each of these teams have
specialities and experience within the outlined areas of their coverage. This expertise is highlighted below.

2.1 Registration and Votes Cast Team

The Registration and Votes Cast Team has worked together with a number of individuals to perform non-partisan
canvassing within Arizona related to the 2020 General election in order to statistically identify voter registrations that
did not make sense, and then knock on doors to confirm if valid voters actually lived at the stated address. This brought
forth a number of significant anomalies suggesting significant problems in the voter rolls.

They will be continuing this work as part of this effort to validate that individuals that show as having voted in the 2020
General election match those individuals who believe they have cast a vote.

COMPANY CONFIDENTIAL – NOT FOR PUBLIC DISTRIBUTION – Page 1 of 11

DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

2.2 Vote Count & Tally Team - Wake Technology Services

Members of the Wake Technology Services group have performed hand-count audits in Fulton County, PA and in New
Mexico as part of the 2020 General Election cycle. In addition, team members have been involved in investigating
election fraud issues, dating back to 1994. In that particular case in 1994, this team member worked closed with the FBI
during the investigation.

As part of these audits in 2020, the Wake Technology Services team has developed an in-depth counting process that
reduces opportunities for errors. This counting process has been expanded to make it more robust, and more
transparent. As a result, they will be leading all ballot hand-counting processes.

2.3 Electronic Voting System Team – CyFIR, Digital Discovery & Cyber Ninjas, Analysts
Digital Forensic Acquisition will be performed either by CyFIR or Digital Forensics, and the analysis work will be
performed by Cyber Ninjas, CyFIR and a number of additional analysts, the identities and qualifications of whom shall be
made available to Client upon request.

CyFIR is a digital security and forensics company and a subcontractor on the contract for DHS’s Hunt and Incident
Response Team (HIRT). As specialists for DHS, they are familiar with responding to nation-state cyber activity including
Advanced Persistent Threats (APT).

3 GENERAL PROVISIONS
3.1 Introduction. The terms and conditions that are specific to this Statement of Work are set forth herein. Any terms
and conditions that deviate from or conflict with the Master Agreement are set forth in the “Deviations from
Terms of the Master Agreement” Schedule hereto. In the event of a conflict between the provisions of this
Statement of Work and the Master Agreement, the provisions of Section 2.34 of the Master Agreement shall
control such conflict.
3.2 Services. Contractor will provide to the Client the Services in accordance with the Master Agreement (including
the Exhibits thereto) and this Statement of Work (including the Schedules hereto). The scope and composition of
the Services and the responsibilities of the Parties with respect to the Services described in this Statement of
Work are defined in the Master Agreement, this Statement of Work, and any Schedules attached hereto.

4 SCOPE & SERVICES DESCRIPTION

This Statement of Work outlines the proposed methodology and scope for a full and complete audit of 100% of the
votes cast within the 2020 November General Election within Maricopa County, Arizona. This audit will attempt to
validate every area of the voting process to ensure the integrity of the vote. This includes auditing the registration and
votes cast, the vote counts and tallies, the electronic voting system, as well as auditing the reported results. The final
report will attempt to outline all the facts found throughout the investigation and attempt to represent those facts in an
unbiased and non-partisan way. The final report will not include factual statements unless the statements can be readily
substantiated with evidence, and such substantiation is cited, described, or appended to the report as appropriate.

The following sub-sections provides additional details of what will be conducted at each stage of the audit.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

4.1 Registration and Votes Cast Phase

During the Registration and Votes Cast Phase, it will be validated that Maricopa County properly registers who voted
during an election, and that this system properly prevents duplicate voting. This will be performed on a minimum of
three precincts.

Proposed scope of work:

• Review of Arizona’s SiteBook system for checking in and tracking voters;

• Complete audit of a minimum of 3 precincts, based on statistical anomalies and precinct size;
• Analysis of existing research and data validating the legitimacy of voter rolls; and/or
• Comparing results against known lists of invalid voters (e.g. deceased voters, non-citizens, etc.).

This phase may help detect:

• Problems that could result in voters being able to vote more than once;
• Voters that voted but do not show in the list of those who voted;
• Voters who likely did not vote but showed as having voted;
• Potential invalid voters who cast a vote in the 2020 general election; and/or
• Inconsistencies among vote tallies between the various phases.

This phase is NOT expected to detect:

• Individual ballots that are either wrong and/or invalid.

Anticipated artifacts for transparency and/or validation of results for the public:

• Final report outlining the discovered results; and/or

• Redacted spreadsheet of a list of those who voted in the target precincts.

4.2 Vote Count & Tally Phase

During the Vote Count & Tally Phase, the counts and tallies for votes and the voting machines will be validated. This will
include a hand-tally and examination of every paper ballot.

Proposed scope of work:

• Physically inspecting and hand-counting of ballots in Maricopa County;

• Counting of the total number of provisional ballots;
• Capture of video footage of the hand-counting of ballots; and/or
• Scanning of ballots in Maricopa County
o NOTE: Provisional ballots which still have signatures attached to them will be counted to be sure they
match the expected numbers but will not be scanned nor will the contents be visible in video.

This phase may help detect:

• Counts that do not match the expected results;

• Ballots that are visually different and possibly fraudulent; and/or
• Inconsistencies among vote tallies between the various phases.

This phase is NOT expected to detect:

• Destroyed or otherwise missing ballots

DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

Anticipated artifacts for transparency and/or validation of results for the public:

• Final report outlining the discovered results;

• Unedited camera footage of the counting of every ballot, provided that, absent express judicial approval, any
such footage cannot be streamed, recorded or broadcast in such a manner that the candidate or ballot
proposition selections on each ballot is visible or discernible; and/or
• Ballot images of every scanned ballot, provided that, absent express judicial approval, any such images cannot
be released or published to any third party.

4.3 Electronic Voting System Phase

During the Electronic Voting System Phase the results from the electronic voting machines will be validated to confirm
they were not tampered with. This will be done on all systems related to SiteBook with Maricopa data, as well as all
Election Management System related machines besides the Ballot Marking Devices (BMD)’s utilized for accessibility.

Proposed scope of work:

• Forensic Images of Arizona’s SiteBook System including the database server, as well as any client machines
associated with Maricopa County;
• Forensic images captured of the Election Management System main server, adjudication machines, and other
systems related to the Election Management System;
• Forensic images of all Compact Flash, USB drives, and related media;
• Inspection to identify usage of cellular modems, Wi-Fi cards, or other technologies that could be utilized to
connect systems to the internet or wider-area-network;
• Review of the Tabulator Paper Tally print-outs;
• Reviewing the exports from the EMS for “Audit File”, “Audit Images” and “CVR”;
• Reviewing ballot images captured by the tabulators
• Reviewing forensic images for possible altering of results or other issues; and/or
• Reviewing of tabulator and other logs.

This phase may help detect:

• Problems where the tabulator incorrectly tabulated results;

• Problems where the tabulator rejected results;
• Issues where results may have been manipulated in the software;
• Issues with the improper adjudication of ballots; and/or
• Inconsistencies among vote tallies between the various phases.

Anticipated artifacts for transparency and/or validation of results for the public:

• Final report outlining the discovered results;

• Ballot images and AuditMark images showing how the tabulator interpreted the ballot for counting, provided
that, absent express judicial approval, such images cannot be released or published to any third party;
• CVR Report as generated from the software; and/or
• Log Files from the Tabulators (Redacted if Dominion Desires).
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

4.4 Reported Results Phase

During the Reported Results Phase, results from all phases are compared against those expected results and those
results which were publicly totalled as the official results to identify any inconsistencies.

Proposed scope of work:

• Results from various phases will be reviewed and tallied; and

• Results will be compared against the official, certified results.

This phase may help detect:

• Issues where result tallies were not properly transmitted to the official results; and/or
• Inconsistencies among vote tallies between the various phases.

Anticipated artifacts for transparency and/or validation of results for the public:

• Final report outlining the discovered results

5 METHODOLOGY
The following section outlines the proposed methodology utilized in the various phases of the audit. When appropriate,
these sections may reference more detailed procedures. Such procedures are considered proprietary and the
intellectual property of Cyber Ninjas, our subcontractors or our Partners and can be made available for review but are
not explicitly part of this agreement.

5.1 Registration and Votes Cast Phase

During the “Registration and Votes Cast Phase”, Contractor may utilize precincts that have a high number of anomalies
based on publicly available voting data and data from prior canvassing efforts to select a minimum of three precincts to
conduct an audit of voting history related to all members of the voter rolls. A combination of phone calls and physical
canvassing may be utilized to collect information of whether the individual voted in the election. No voters will be asked
to identify any candidate(s) for whom s/he voted. This data will then be compared with data provided from Maricopa
County Board of Elections.

5.2 Vote Count & Tally Phase

The goal of the “Vote Count & Tally Phase” is to attempt to, in a transparent and consistent manner, count all ballots to
determine the accuracy of all federal races, and to identify any ballots that are suspicious and potentially counterfeit.
Ballots will be counted in a manner designed to be accurate, all actions are transparent, and the chain of custody is
maintained.

5.2.1 Counting Personnel

Non-partisan counters will be utilized that are drawn from a pool of primarily former law enforcement, veterans, and
retired individuals. These individuals will undergo background checks and will be validated to not have worked for any
political campaigns nor having worked for any vendor involved in the voting process. These individuals will also be
prevented from bringing any objects other than clothing items worn on their persons into the counting area or taking
any objects out of the counting area.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

5.2.2 Accurate Counting

Counting will be done in groups with three individuals independently counting each batch of ballots, and an individual
supervising the table. All counts will be marked on a sheet of paper as they are tallied. If, at the end of the hand count,
the discrepancies between counting personnel aggregate to a number that is greater than the margin separating the
first and second place candidates for any audited office, the ballots with discrepant total from the Contractor’s counting
personnel will be re-reviewed until the aggregate discrepancies within the hand count are less than the margin
separating the first and second place candidates.

5.2.3 Transparent Counting

All activity in the counting facility will be videotaped 24 hours a day, from the time that Maricopa County delivers ballots
and other materials until the time that the hand count is complete and all materials have been returned to the custody
of Maricopa County. Such videotaping shall include 24-hour video monitoring of all entrances and exits, as well as
activity at the counting tables.

5.2.4 Chain of Custody

All movement with ballots, cutting of seals, application of seals, and similar actions will be appropriately documented
and logged, as well as captured under video to be sure the custody of ballots is maintained at all times. Access to the
counting area will be restricted to duly authorized and credentialed individuals who have passed a comprehensive
background check, with mandatory security searches and ingress/egress logs whenever entering or exiting the counting
area.

5.3 Electronic Voting System Phase

The proposed scope of the “Electronic Voting System Phase” is to confirm that the system accurately tallied and
reported the votes as they were entered into the system and that remote access was not possible. All systems related to
the voting will be forensically imaged, these machines will be booted up and checked for wireless signal usage, and the
images will be reviewed to determine the accuracy of results and any indication of tampering.

5.3.1 Forensic Images

A digital forensics capture team will forensically capture all data on in-scope systems, utilizing industry best practices.
This will create a digital copy of every single machine, Compact Flash Card, and USB drive in scope without altering the
contents of the machines. Chain-of-custody documentation will be created to preserve these images in a manner
sufficient to be utilized in a court-of-law.

5.3.2 Physical Analysis

The Election Management System equipment will be turned on and scanned with a wireless spectrum analysis tool to
determine if the device is emitting any signals consistent with a known wireless frequency such as cellular, Bluetooth,
WiFi or similar. Devices that show signs of emitting signals will be flagged and documented, and when possible without
damaging the equipment; they will be physically inspected to determine the source of any detected signals.

5.3.3 Digital Analysis

The forensic images will be reviewed to validate reported totals from the tabulators, results stored within the Election
Management System (EMS) Results Tally and Reporting software. These will be compared against the tabulator print-
outs; and the machine will be checked for physical or digital tampering and any known ways of remote access to the
machines.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

5.3.4 Opportunity for Observation

Before commencing the imaging or analysis steps described above (except for the Digital Analysis process), the
Contractor will work with Maricopa County to provide at least five (5) days advance notice to any vendors of Maricopa
County whose products will be the subject of imaging, inspection, or analysis. Such vendors will be permitted the
opportunity to attend and observe the Contractor’s imaging or inspection of the vendors’ products. The vendor will not
be allowed to be present for the analysis of the captured images. Such vendors are third party beneficiaries of this
provision and will have standing to challenge and secure injunctive relief against any denial of their right to observe the
inspection of their products.

5.4 Reported Results Phase

During the Reported Results phase, results from all phases are compared to find differences between tallies or other
anomalies. These results are then compared against data at the Secretary of State and Maricopa Board of Elections
layers. Any inconsistencies will be reported and highlighted.

6 RESPONSIBILITIES
The following section outlines the key responsibilities for the proper execution of the Agreement between the
Contractor and the Client for all outlined work within the scope.

6.1 Registration and Votes Cast Phase

Contractor Responsibilities

• Provide the proper personnel to conduct the analysis of the data required to execute the scope of this phase.

Client Responsibilities

• Arrange for a database export of SiteBook to be provided to the Client which includes all fields normally found in
a publicly requested copy of the voter rolls, in addition to any other non-sensitive fields related to the data such
as modifications or other time-stamps, voter history, last user edited, IP address of edit; or anything similar.

6.2 Vote Count & Tally Phase

Contractor Responsibilities

• Provide the proper personnel and equipment to execute all aspects of the phase including scanning, counting,
the setup of equipment for recording of the counting, and the supervision of activities.
• Ensure that all onsite personnel follow any in-place COVID requirements.

Client Responsibilities

• Provide security of the building during the course of the engagement. This includes having sufficient security to
prevent access to the building 24/7 during the entire time, including ensuring that safe working conditions can
exist during the entirety of the audit;
• Provide electricity and access to the facilities and tables necessary for up to 120 people at a time following any
current COVID requirements. This is estimated to be about 7,200 square feet;
• Provide access to all paper ballots from the November 2020 General Election within Maricopa County. This
includes early voting, election day ballots, provisional ballots, spoiled ballots, printed unused ballots and any
other ballot categories that are part of the 2020 General Election. For all ballots this should include the original
hard copies of the ballots that were electronically adjudicated ballots.
• Provide a mechanism to allow for the proper equipment to be brought into the facility where the counting will
take place.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

• Full chain of custody documentation for all ballots from the point they were cast to the point where we gain
access to the ballots, to the extent such documentation is in Client’s possession.
• Purchase orders for all purchased ballots, or ballot paper, including counts of each, as well as delivery receipts of
the quantity of ballots received, to the extent such documentation is in Client’s possession.
• Full counts from any ballots printed on demand, as well as the location for which they were printed, to the
extent such documentation is in Client’s possession.
• Provide wired access to internet to be able to stream the counting video capture, provided that any such video
footage must be streamed, recorded or broadcast in such a manner that the candidate or ballot proposition
selections on each ballot shall not be visible or discernible.

6.3 Electronic Voting System Phase

Contractor Responsibilities

• Provide the proper personnel to execute all aspects of the phase including the capture of forensic digital images
of all systems related to the Election Management System; and
• Ensure that all onsite personnel during the forensic capture follow any in-place COVID requirements.

Client Responsibilities

• Provide physical access to the EMS Server, Adjudication machines, ImageCast Central, ImageCast Precinct,
ImageCast Ballot Marking Devices, SiteBook, NOVUS systems, and any other Election Management System
equipment or systems utilized in the November 2020 General Election to the forensic capture team;
• Provide access to Compact Flash Cards, USB Drives, and any other media utilized in the November 2020 General
Election for the forensic capture team to image;
• Provide electricity and sufficient access to the machines in scope in order to provide a team of up to 15 forensic
capture individuals to work and boot up the systems;
• Provide any needed credentials for decrypting media, decrypting computer hard drives, the EMS machines, or
other systems that may be required for a proper forensic capture of the machines;
• Provide the output of the “Audit File,” “Audit Images,” and CVR exports from the Dominion machines which
includes all ballot images and AuditMark images of every ballot processed by the machines; and
o NOTE: The above may be able to be captured from the forensic images; but Maricopa County assistance
could be needed in identifying where the AuditMark files are located.
• Provide any needed technical assistance allowing all the above to be successfully captured.

6.4 Reported Results Phase

Contractor Responsibilities

• Provide the proper personnel to conduct the analysis of the data required to execute the scope of this phase.

Client Responsibilities

• Provide the official results per precinct for all counts associated with the November 2020 General Election.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

7 DELIVERABLE MATERIALS
The primary deliverable for the Election Audit will be a report detailing all findings discovered during the assessment.
The parties agree that the report is provided AS IS, without any promise for any expected results. Additional artifacts as
collected during the work will also be provided, as outlined within the scoping details.

This final report will include:

• An executive summary outlining the overall results of the audit from the various phases;
• A methodology section outlining in detail the methodology and techniques utilized to capture and validate the
results;
• Tables, charts, and other data representing the findings of the data;
• Appendices or attached files demonstrating all evidence utilized to come to the outlined conclusions (if
applicable); and
• Recommendations on how to prevent any detected weaknesses from being a problem in future elections (if
applicable).

In addition to the report, various anticipated artifacts for public consumption will be generated over the course of this
work, as outlined under the “Scope of Work.” Client will determine in its sole and unlimited discretion whether, when,
and how the Contractor should release those resources to the public. This will include all videos, ballot images, and
other data.

8 COMPLETION CRITERIA
Contractor shall have fulfilled its obligations when any one of the following first occurs:

• Contractor accomplishes the Contractor activities described within this Statement of Work, including delivery to
Client of the materials listed in the Section entitled “Deliverable Materials,” and Client accepts such activities
and materials without unreasonable objections; or
• If Client does not object or does not respond to Contractor within seven (7) business days from the date that the
deliverables have been delivered by Contractor to Client, such failure to respond shall be deemed acceptance by
Client.
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

9 TERM / PROJECT SCHEDULE / LOCATION

The following table outlines the expected duration of the various proposed work outlined within the Agreement. Work
will commence on a date mutually agreeable to both Contractor and Client according to a schedule which is outlined via
email.

Each phase outlined below can be conducted simultaneously, with the exception of the Reported Results phase which
must be completed at the end. Roughly an additional week of time at the conclusion of all phases is needed to complete
and finalize reporting. Lead times before a phase can start as well as their duration can be found below. Faster lead
times can potentially be accommodated on a case-by-case basis.

Required Notice / Est. Duration in

Service Name Additional Details / Location
Lead Time Days
Registration and Votes Cast Phase 1 Week 20 This work will be done remotely.
The entire time will be onsite at the location
designated by the Client.

Access will be required 4 days before the

Vote Count & Tally Phase 2-3 Weeks 20* start to setup the space.

*Race recounts as outlined in 5.2.2 may

require the timeline to be extended beyond
the listed days.
It is estimated that 15 will be onsite. The
remainder of the time will be remote.
Electronic Voting System Phase 1-2 Weeks 35
Review of location setup is requested the
week prior to ensure proper workspace.
This phase will be completed offsite.
Completion of Other
Reported Results Phase 5
Phases Final Report Delivered 1 Week After
Completion
DocuSign Envelope ID: 1A83BC62-6842-4A76-8E3C-721AC61EEA3D

10 FEES / TERMS OF PAYMENT

The following table outlines the costs associated with the proposed work. A third of the fees will be due at the execution
of the contract. The remaining balance will be payable within 30 days from the completion of the audit.

Selected Name Price Each Total

1 Maricopa County – Full Audit $150,000 $150,000.00
Total: $150,000.00

11 SIGNATURE & ACKNOWLEDGEMENT

THE PARTIES ACKNOWLEDGE THAT THEY HAVE READ THIS STATEMENT OF WORK, UNDERSTAND IT, AND AGREE TO BE
BOUND BY ITS TERMS AND CONDITIONS. FURTHER, THE PARTIES AGREE THAT THE COMPLETE AND EXCLUSIVE
STATEMENT OF THE AGREEMENT BETWEEN THE PARTIES RELATING TO THIS SUBJECT SHALL CONSIST OF 1) THIS
STATEMENT OF WORK, 2) ITS SCHEDULES, AND 3) THE AGREEMENT (INCLUDING THE EXHIBITS THERETO), INCLUDING
THOSE AMENDMENTS MADE EFFECTIVE BY THE PARTIES IN THE FUTURE. THIS STATEMENT OF THE AGREEMENT
BETWEEN THE PARTIES SUPERSEDES ALL PROPOSALS OR OTHER PRIOR AGREEMENTS, ORAL OR WRITTEN, AND ALL
OTHER COMMUNICATIONS BETWEEN THE PARTIES RELATING TO THE SUBJECT DESCRIBED HEREIN.

IN WITNESS WHEREOF, the parties hereto have caused this Statement of Work to be effective as of the day, month and
year written above.

Accepted by:

Client: Arizona State Senate

By:________________________________________

________________________________________
Karen Fann, President
Title:_______________________________________

Accepted by:

Contractor: Cyber Ninjas, Inc.

By:________________________________________

Douglas Logan

Title: CEO & Principal Consultant