Cyber Ninjas Response - Maricopa County Analysis of Senate Report-2
Cyber Ninjas Response - Maricopa County Analysis of Senate Report-2
Maricopa County continues to purposely mislead Arizonans and the American public about the nature of audit findings,
and the impact they had on the 2020 General Election. Their response renames and redefines audit findings so the claim
can be made that the findings are false, includes logical sounding arguments that simply don’t add up, and is completely
devoid of any supporting evidence. The following response to their review continues to refute their baseless claims with
evidence and citations.
The lack of precision from the County’s response also leaves a lot in question. Our report provides in the appendixes a
full list of every voter ID affected, as well as details as to when and where that individual moved. The County’s response
doesn’t even confirm an exact number of records that were validated, nor the explanation for why the records they
validated were not an issue. The County expects that simply asserting that our claim is false makes it false, rather than
providing any documentation to validate their claims.
Furthermore, the County’s claim that voters can legally change their addresses after the voter registration period and
still legally vote is an extremely misleading statement. Our report was primarily1 based on the November 7th VM34 voter
roll file, and therefore any address changes should have been reflected in that version of the file. In addition, this is only
possibly applicable for individuals who move within Maricopa County (15,035) and would not apply to individuals who
moved outside of the County (12,772) and would therefore be required to re-register to vote. It would also be expected
that the County would be able to state exactly how many of the 15,035 changed their address, rather than making a
blanket statement and implying that it fully explains the finding. The fact the County chose not to do this raises more
questions.
It is also unclear why the analysis in the County’s response for this finding talks about double-voters. This finding has
nothing to do with double voters.
1
Please see page 20 of the Maricopa County Forensic Election Audit Volume III: Results Details report for additional details:
https://c692f527-da75-4c86-b5d1-8b3d5d4d5b43.filesusr.com/ugd/2f3470_d36cb5eaca56435d84171b4fe7ee6919.pdf
The 9,041 voter IDs that had more EV33 returned ballot entries than EV32 sent ballots, and the individual voted via mail
was provided to Dr. Shiva to see if there was any correlation between these voter IDs and the prevalence of more than
one scanned envelop. Only 2,138 of these voter IDs had more than one scanned ballot. If the County’s explanation
properly accounted for this issue, then there should be a one-for-one match with multiple scanned ballots for all 9,041
voter IDs. This simply cannot explain the issue when only 24% of the 9,041 had multiple envelop image scans.
Had the County taken this finding seriously their reply could have shown a good faith effort to validate the finding and
indicate the quantity validated and the reasons why they were not valid. Without any numbers or evidence, it can only
be assumed that the County completely dismissed this, as stated, as a “Faulty Claim”.
NOTE: The County renamed this finding in their response to take out the word “Potentially” so it could be listed as a
faulty claim, rather than recognized the validity of the finding.
Furthermore, the “detailed records” provided by the County for duplicate ballots were shown by the audit to be
incorrect and full of mislabeling and other errors as documented in the report. Detailed records are only useful if they’re
correctly recorded.
1.6.1 FALSE COUNTY CLAIM: THE SENATE NEEDED TO SUBPOENA BACKUPS OR ARCHIVES
The Senate did not need to subpoena backups or archives. All disputed items were clearly outlined within the Senate,
this is nothing more than an attempt to misdirect and mislead. The original subpoena3 item #4 clearly requests the
“November 2020 general election in Maricopa County, Arizona”, “Election Log Files” and “any other election files and
logs”, and it goes on to list “any other election files or logs” associated with the “Tabulators”, “Result Pair Resolution”,
“Result Files”, and “SQL Database Files”. DVD result files and SQL database files are among the list of items deleted.
https://recorder.maricopa.gov/justthefacts/courtcases/7%20Ward%20v.%20Jackson%20(AZ%20Supreme%20Court)/Ward%20v.%2
0Jackson%20APPEAL%20-%202020.12.08%20DECISION%20ORDER%20(Ward%20v.%20Jackson,%20Ariz.%20S.%20Ct.).pdf (pg. 4)
3
https://www.scribd.com/document/531671852/SUBPOENA-January-12-2021-NEW-Senate-Sub-to-Maricopa-County
Furthermore, the original subpoena4 item #7 clearly requests the “November 2020 general election in Maricopa County,
Arizona”, all “Windows Server & Desktop” “Windows event logs and Access logs”. The Security event logs were not
provided separately for any of the systems; even though this is the definition of what an “Access Log” is for a “Windows
Server & Desktop”. Since these logs were rolled over prior to us receiving the machine, they no longer covered the
subpoenaed period of time.
1.6.2 FALSE COUNTY CLAIM: STANDARD ARCHIVAL STEPS WERE TAKEN ON FEBRUARY 2ND.
The Results Tallying and Reporting (RTR) logs clearly show that all database data as well as files in the NAS directory
were purged and deleted on February 1st. The action was started at 5:14:47 pm and finished at 5:20:00 pm. If any
backups or archives were conducted on February 2nd, the data was already deleted.
If it was normal to purge data as can be seen in the finding in the audit report, it would be expected that this would be
true for every other election on the EMS Server. However, as can be seen in the screenshots below the data is still
present for other past elections. Since the drive had more than 2 terabytes of free space available there was no technical
reason to delete the data before the two audits hired by Maricopa County. In fact, it begs to question what the auditors
had to audit if there were no election results when ProV&V arrived on Feb 2nd.
4
https://www.scribd.com/document/531671852/SUBPOENA-January-12-2021-NEW-Senate-Sub-to-Maricopa-County
Figure 2 - All Results Still Exist for the 2020 Primary. These numbers match the Official Results.
Figure 3 - The last time an archive was created of the 2020 General Election was on 11/13 at 4:28pm.
1.6.3 FALSE COUNTY CLAIM: THE COUNTY RAN TWO FORENSIC AUDITS BY CERTIFIED COMPANIES
The procedures documented within the ProV&V report for the first Maricopa County audit did not follow any industry
recognized standard digital forensic processes, and the SLI report clearly documents that they could not forensically
image the EMS Server due to the RAID configuration. This is consistent with the fact that neither company is certified for
forensic examination of digital equipment, and this is not work either company regularly does. Both companies are
certified by the Election Assistance Commission for certifying election equipment, not for completing forensic audits.
Furthermore, since all election results were cleared from the Election Management System (EMS) Server before any of
these two audits were performed; the only thing these companies could do was run test cases against the election
equipment to see if it behaved properly. No results were audited by either of these two companies.
Furthermore, a review of the drive provided doesn’t include all pre-adjudicated images. The post-adjudicated images on
the drive show the expected 2,089,563 images, but the pre-adjudicated images only show 1,923,719 images. The
difference of 165,844 appears to be the number of ballots processed by the Election Day ImageCast Precinct 2 tabulators
based on the CVR, but it’s unclear why or how these images would be collected in a manner where these images were
missing. As a result, it creates further questions on the reliability of these images.
At this time, the drive of pre- and post-adjudicated images has not been validated to confirm that corrupt images do not
exist, but this aspect will be reviewed and be confirmed.
The actual report has a more extensive list of items that were missing from the subpoena, not all of which are addressed
within the County’s reply. However, to address the specific items listed in the County’s reply:
5
https://www.scribd.com/document/531671852/SUBPOENA-January-12-2021-NEW-Senate-Sub-to-Maricopa-County
6
https://www.scribd.com/document/531671852/SUBPOENA-January-12-2021-NEW-Senate-Sub-to-Maricopa-County
CyFIR utilized a tool called HstEx v4 from Digital Detective to review the hard drives of all the affected systems for
artifacts of internet activity. This tool both looks at the allocated space, which is the normal file structure you see on a
system, and the unallocated space, which is what shows up on your system as “free space”. When you delete a file on
your file system the space that file occupied is shown in the computer as “free space”; but the file itself is still fully intact
on the file system until the computer puts some other file in the space occupied prior by that file. In this way the tool
looks at both normal files and deleted files.
HstEX v4 identified and extracted all internet history into a .hstx file that was analyzed using the Digital Detective
NetAnalysis v2 tool. In addition to the URL that was navigated to, this data includes a visits column. Per the tool
documentation9 and basic forensic analysis, the visits field is ONLY populated when a URL is actually visited and does not
populate when a web page cannot be resolved. This visits column can be seen in all of the following screenshots of the
tool output, and clearly refutes the claim that the machines never had a pathway to the internet.
7
https://www.scribd.com/document/531671852/SUBPOENA-January-12-2021-NEW-Senate-Sub-to-Maricopa-County
8
https://www.scribd.com/document/531671852/SUBPOENA-January-12-2021-NEW-Senate-Sub-to-Maricopa-County
9
https://www.digital-detective.net/Documents/NetAnalysis%20v2%20User%20Guide.pdf
The EAC clearly has a process for “de minimis changes”10 to account for Operating System level patches and changes to
trusted builds, and advocates those critical patches be applied11. This advice is further enforced by the Cybersecurity &
Infrastructure Security Agency12 (CISA), and the Center for Internet Security13 (CIS). Nowhere in any documentation is
there any indication that virus scans update would somehow negate the certification, yet those were also not applied.
The fact that the County failed to recognize the risk of having out-of-date software and never requested the voting
machine vendor to go through the simple process to get patches approved, as is required by the “Warranty” section of
the County’s contract14, nor did they choose to move to a later version of the voting system software that has later
approved patches; does not somehow make their system secure. The County failed to implement basic Cybersecurity
hygiene. This should be acknowledged, and policies put in place to make sure this never happens again.
To be more specific, the credential management finding is specific to the username and passwords required to access
the EMS server, the EMS workstations, the Adjudication workstations, the HiPro scanners and the ImageCast (ICC)
Workstations. Accessing these systems did not require anything but a typical computer username and password
combination. The usernames/accounts of these systems were not assigned to specific individuals, but rather were
shared between various people. The passwords for these accounts were created during the installation of the Dominion
software on 8/6/2019 and were never changed up to the point where these systems were delivered for the audit.
Furthermore, in complete disregard to all standard security practices, the same password was used for ALL user
accounts on ALL of the EMS, EMS Client, ICC, HiPro, and Adjudication systems. To be clear, if someone knew the
password to a single user account on one of these systems that individual would know the password to the admin
account on any of these systems.
10
https://www.eac.gov/sites/default/files/voting_equipment/NOC19.01_SoftwareDeMinimisChanges_11-15-2019.pdf
11
https://www.eac.gov/windows-critical-update-faq
12
https://us-cert.cisa.gov/ncas/tips/ST19-002
13
https://www.cisecurity.org/spotlight/ei-isac-cybersecurity-spotlight-patching/
14
https://www.scribd.com/document/533751776/Maricopa-County-Elections-Tabulation-System-Contract (Page 34)
1.9.4.2 INTENTIONAL EXECUTION OF SCRIPTS TO DELIBERATELY ENSURE THAT LOG ENTRIES WERE NOT RETAINED
The response by Maricopa County does not address the fact that a user leveraging the emsadmin account deliberately
and purposely executed a script that checked the accounts for duplicate passwords 38,478 times. This deliberate
execution of the script occurred over three days, specifically on 2/11/2021 there were 462 log entries overwritten, on
3/3/2021 there were 37,686 log entries overwritten, and on 4/12/2021 there were 330 log entries overwritten. Given
that the Maricopa County knew that the setting on the log retention was limited to 20MB, the act of executing these
scripts had the effect of deliberated ensuring that the Windows security logs covering the dates of the general election
would not be available for review.