Coliseum Observer Notes 2021

Coliseum Observation Notes

Phase 2 of the effort to hand-count the 2.1 million ballots cast in Maricopa County during the 2020 Presidential Election resumed on May 24, 2021 after a weeklong pause. Observers on behalf of the Arizona Secretary of State's Office continued to note problematic practices, changing policies, and security threats that have plagued this exercise from the start. A more complete summary, including correspondence outlining observations from Phase 1, can be found in the Arizona Secretary of State Report on the Partisan Review of the 2020 General Election.

Security Concerns

Observation: On May 24, 2021, the external security gate was left unattended and partially open, allowing observers to walk in. It was later noted that the check-in process had changed but observers were not notified.

Observation: For several days, beginning on May 24, 2021 observers noted a copy of a Wake TSI procedure manual marked "confidential" was left out and sometimes unattended at the check-in counter.

Observation: On May 25, 2021, a black pen was brought onto the counting floor. Pens with black and blue ink, which can be read by tabulators, are prohibited from being near ballots to ensure they cannot be used to alter the ballots.

Observation: On May 24, 2021, Senate Liaison Ken Bennett brought a cell phone onto the counting floor. Previously, cell phones were not permitted on the floor as a security measure.

Observation: On May 27, 2021, observers noted State Senator Wendy Rogers was on the counting floor and was provided a black pen to take notes by Cyber Ninjas. Pens with black and blue ink, which can be read by tabulators, are prohibited from being near ballots to ensure they cannot be used to alter the ballots. She also was writing on the white note paper that was provided to her and carried her cell phone in her back pocket, both violations of their own security measures.

Observation: On May 29, 2021, observers confirmed that participants are allowed to bring firearms into the Coliseum and on the counting floor "as long as they are concealed."

Observation: On June 2, 2021, observers were informed that Cyber Ninjas employees planned to patch damaged boxes by taping a manila folder in the area where the boxes were tearing apart. According to Cyber Ninjas attorney Bryan Blehm, this is how they received the ballot boxes and have video evidence of that.

Observation: On June 2, 2021, Senate Liaison Ken Bennett removed ballots from the "Senate Cage," which is the ballot storage cage that only Ken Bennett and Audit Co-Chair Randy Pullen are supposed to access.

Observation: Only table managers (wearing black t-shirts) or runners (wearing purple t-shirts) were permitted to retrieve a ballot box for inspection. On June 7, 2021, observers noted that workers in any color t-shirt, working in any role on the floor, were both returning and bringing boxes of ballots for inspection. There were no authorization checks before ballots were moved around.

Observation: On June 7, 2021, Senate Liaison Ken Bennett allowed Cyber Ninjas to remove multiple ballot boxes from the "Senate Cage," a ballot storage area that only he and Audit Co-Chair Randy Pullen can access. Cyber Ninjas attorney Bryan Blehm told the observers that Ken Bennett was leaving for the night, and the ballots were removed from the more secure "Senate Cage" so inspections could continue without him.

Observation: Each day since June 7, 2021, Senate Liaison Ken Bennett has opened the "Senate Cage" to allow Cyber Ninjas to remove ballots from the "Senate Cage" and move the ballots to the other cages that people in any color t-shirt can access.

Observation: On June 17, 2021, observers saw that the Cyber Ninjas continue to use insecure cybersecurity practices. For example, a Paper Examination Table manager gave a StratTech employee, a list of shared passwords to log in to the system as he was attempting to correct an issue with the software being used at Paper Examination Table 13. After the StratTech completed his work at the station, he put the paper with the passwords into his pocket and walked away.

Observation: On June 19, 2021, observers watched Senate Liaison Ken Bennett get the remaining boxes of "Spoiled" ballots from the more secure "Senate" Cage, which contains sensitive information. The observers noticed that when Ken Bennett unlocked the cage, he set the lock on the floor outside the cage without resetting the access code. Observers noted the code on the lock, as it was clearly visible. When Ken Bennett turned the combination pad after replacing it on the cage and reconnecting it, observers were able to confirm that the code they saw was the correct access code. This is especially alarming because this is the area where the most sensitive information, including personal identifiable information, is stored.

Equipment Concerns

Observation: On May 24, 2021, Senate Liaison Ken Bennett confirmed that copies of voting system data was sent to a lab in Montana. He did not specify what security measures were in place, or what the lab in Montana will do with the data or how long it will be in possession of the copies.

Observation: On May 31, 2021, Cyber Ninjas implemented another software update on the paper examination "forensics" workstations. The software update created so many errors and problems during the first shift that they stated they were going to roll back to the old software during the afternoon shift.

Observation: On June 2, 2021, observers noted that all 28 paper examination tables were using the new software – after having to roll back to the old software due to the previous errors.

Observation: On June 2, 2021, observers noted that employees were attempting to determine if a ballot was marked by a "Human" (green button) or not "Human" (red button). A paper examination manager noticed that all ballots at one table were being incorrectly identified (by) the red button as having not human marks. The employees working the paper examination station were unaware that they were supposed to change the button within the software. The paper examination manager fixed it in the software, although a few dozen ballots remained mislabeled.

Observation: On June 3, 2021, at approximately 6:30 p.m., software taking photos of the ballots got out of synch, producing distorted images. A manager had to correct this issue, and it occurred again at approximately 6:45 p.m. This is the same issue that necessitated the software roll back previously. This issue is occurring frequently every day.

Observation: On June 4, 2021, observers noted the yellow pod and tables were removed to put in more paper examination stations. As of June 10, 2021, the new paper examination tables have not been set up or put into use. A Cyber Ninjas employee got excited that the cameras arrived on June 10, 2021, and told an observer, "Now all we need is computers."

On June 17, 2021, the observers noticed that the microscope cameras the Cyber Ninjas use are WiFi capable. There were boxes of Ankylin WiFi microscope cameras sitting out on a table in the center of the Coliseum. The observers verified that the model of microscope, in addition to having WiFi capable cameras, have an iOS and Android app the cameras can stream to. This means that the images could be sent or intercepted by unknown devices.

Communication Concerns

Observation: On May 26, 2021, Audit Co-chair Randy Pullen told an observer that the shirt he was required to wear on the floor made him "look like a transgender" because of the color of his shirt.

Observation: On May 29, 2021, observers confirmed that organizers require them to wear pink or fuchsia shirts and refer to them as "pinkies" or "pinkos" to either imply and/or assert that the observers are communists.

Observation: On June 2, 2021, observers saw six individuals huddled discussing how to fix an error in the aggregation. Despite attempts to make both the process and issue opaque, observers heard one person say, "it will take the rest of the audit" to correct and another say she didn't want to go through the trouble of pulling in all the data if it is incorrect.

Observation: On June 3, 2021, Cyber Ninjas CEO Doug Logan permitted an observer to use a monocular while on the floor. When the monocular was used for the first time, an employee notified Cyber Ninjas attorney Bryan Blehm, who began shouting at the observer and directed security to remove the observer. Doug Logan, who previously assured observers that the staff had been notified that the device was permitted, came to the floor, inspected the monocular to verify that it was not a camera, and again authorized its use. Approximately an hour after this incident, Bryan Blehm informed observers that the monocular was "scaring people" and a security person again inspected it to verify that it was not a camera.

Policy and/or Process Changes

Observation: On May 24, 2021, Senate Liaison Ken Bennett was unable to identify the new person or entity leading the process, contributing to general confusion.

Observation: On May 24, 2021, new people and processes in place at the check-in point added to general confusion.

Observation: On May 26, 2021, paper examination stations had only two people working, instead of three or four as before.

Observation: On May 26, 2021, observers noted that quality control practices to ensure data is entered correctly are still not in place rendering all of the data and findings unreliable.

Observation: On May 29, 2021, observers saw that at least three people who are not residents of Maricopa County rifling through thousands of military and overseas ballots. Observers had been previously told that only Maricopa County residents would be allowed to handle any ballots, yet all three people were not residents.

Observation: On June 1, 2021, observers attended the first night that included a third shift of ballot review. Observers noted there were only employees at four of the ballot counting tables and five of the paper examination tables. Observers also noted that two employees at different paper examination tables said they needed someone to show them what to do. Observers heard the following from the two employees:

"I don't know anything, so if you want me to do anything you'll have to show me."

"I have never done this. Can someone show me how to take a photo, where do I click [on the computer]?"

Observation: On June 1, 2021, observers heard a table manager overseeing the paper evaluation station tell another employee that there is a post-analysis process that would find any anomalies they missed. Employees asking if it was Jovan's [Pulitzer] software and the table manager said, "possibly."

Observation: On June 2, 2021, observers heard a Cyber Ninjas employee tell a team at a paper examination station that they were going to "pilot" something new at the station by adding a fourth, "low resolution camera" to take a picture of an area of the ballot not previously reviewed. Observers heard the person setting up the equipment say it was "just to see the color…don't pay attention to it." Approximately 2.5 hours after implementing the "pilot" using the fourth camera, observers noted Cyber Ninjas employees implementing it on all paper examination stations.

Observation: On June 4, 2021, observers noticed that employees are not following the published policies on suspicious ballot handling. This is a recurring issue. The policy states that they will be separated from their batch and put in a specific folder for separate review. Instead, employees kept them in their original boxes. Ballots that have been flagged for additional review are being mixed in with other ballots.

Observation: On June 8, 2021, observers noted a document called "Retrospective Phase 1 Quality Control" containing procedures on how employees would perform quality checks on the tally data entered into the spreadsheets during "Phase 1," from the first day of the review through May 14, 2021, when the review was stopped because the Coliseum was reserved for high school graduation ceremonies. Observers were told that the procedures, although being implemented, were still in draft form so they would not share the contents.

Observation: On June 9, 2021, observers saw the "draft" procedures being used to input data into a spreadsheet. Observers noted that the procedures being followed were not standard quality control procedures. Employees were re-entering the data from the tally sheets employees used during the initial review. The new spreadsheet was set up to flag any numbers that did not match. Instead of validating the original data, mismatched numbers were altered to match. This alarmed observers because tally sheets are marked using red or green pens. Access to both red and green pens and to tally sheets is readily available, creating opportunities for tally sheets to be altered after the initial review. This makes the "Retrospective Phase 1 Quality Control" unreliable.

Observation: On June 14, 2021, Observers noted a new process being referred to as "quality control." This process has three phases: QCC, QCT, and QCTR. Observers believe these initials stand for Quality Control Count, Quality Control Tally, and Quality Control Tally Retrospective. On June 19, 2021, Cyber Ninjas' attorney Bryan Blehm did confirm that QCT did stand for Quality Control Tally.

Observers additionally noted that:

• The QCC or Quality Control Count process appears to be an attempt to count the number of ballots in a given batch and in an entire box and compare it to the tally Maricopa County recorded on the batch sheet.
• The QCT or Quality Control Tally process required participants to spin the ballots on the carousel again, to get a new tally of the entire box of ballots.
• The Quality Control Tally Retrospective process was added on June 19, 2021. Observers were unable to ascertain what the process entailed.

Overall, there was no information available about how tally differences would be reconciled, recorded or which of the tallies would be considered correct. This provides another opportunity for the results of the tally to be altered.

Observation: On June 17, 2021, observers saw many of the paper examination stations experiencing significant delays because the software used was "paus[ing]" regularly.

Observation: On June 17, 2021, Paper Examination Table 13 was having so much trouble with the software, participants asked StratTech employees fix it because participants were receiving an error message. The StratTech employees dismissed the message but were not able to correct the "pause" that continued to occur. Another StratTech employee rebooted the software four times without success, then rebooted the entire system. Neither of these attempts corrected the issue.

Observation: On June 18, 2021, observers witnessed participants at a Quality Control Tally table count 24 ballots, which conflicted with another count, which showed 25 ballots. In a credible audit, the batch would have been recounted. Instead, the table manager said she thought she found the 25th ballot stuck to another ballot and proceeded without recounting the batch.

Observation: On June 19, 2021, observers noticed the Cyber Ninjas were documenting information about the "Spoiled" ballots. In the initial batch the observers saw, ballots were in an envelope entitled "Arrowhead Towne Center." It contained a ballot-return envelope, which included personal identifiable information. Observers saw that table manager put the envelope in a clear bag and place it near other participants reviewing ballots. The table manger handed the bag to Cyber Ninjas' attorney Bryan Blehm when he walked near the table, who folded it and carried it around the floor until Co-Chair Randy Pullen arrived to open the "Senate" Cage, which contains boxes of data with personal identifiable information. The "Senate" Cage is supposed to be more secure with access limited to Senate Liaison Ken Bennett and Co-chair Randy Pullen. When Randy Pullen opened that cage, Bryan Blehm set the bag with the ballot-return envelope in a box entitled "Arizona Veterans Memorial Coliseum." While this may have been the correct box, the envelope was not placed in the correct batch within the box, so it was not associated with the "Arrowhead Towne Center."

Observation: On June 19, 2021, observers saw Cyber Ninjas attorney Bryan Blehm drop data on the floor from a "Spoiled" ballot envelope that was labeled "Reprinted – Jam – See Other Side." Bryan Blehm and Ken Bennett continued to process several batches during the seven minutes it took Bryan Blehm to notice the data on the floor. Observers were not able to confirm that data/ballot was returned to the correct envelope. Three minutes later, the observers brought it to the attention of Bryan Blehm and Senate Liaison Ken Bennett, who both said that the data was placed in the correct bag. Observers inquired further, because the data/ballot was dropped approximately 10 minutes earlier. Observers did not receive an answer.

Observation: On June 19, 2021, observers witnessed Senate Liaison Ken Bennett defacing Maricopa County's original labels on the ballot boxes and the envelopes contained within. Ken Bennett wrote directly on the ballot boxes and the Cyber Ninjas covered it up with a piece of tape and wrote the same information on the tape, attempting to hide the writing that was directly on the original label. This violates the agreements and questions the reliability and integrity of all the county records; if they are willing to deface this information, what else have they manipulated when the observers were not around?