#AZAudit Maricopa & Other Arizona County Election Audits - #CyberNinjas / Jovan Pulitzer / Fann / Birther Ken Bennett

[fierceredpanda]

That lawsuit...oh, dear.

[LM K]

Thanks to those who posted the AZ article!

[keith]

A British journalist visits Phoenix to cover the "audit".
...
The audit is taking place[/url] in a coliseum on McDowell Road here in Phoenix that used to be home to the Suns, the city’s basketball team (its nickname is the Madhouse on McDowell).

My opinion of Vets Memorial is that it is an absolute hellhole of a venue and has been from the beginning, not just since it deteriorated into decrepitude.

I've been to several concerts there, each time assuming that the experience will be better, cause it can't get any worse - but it did.

Its either freezing because there isn't any useful insolation between the ice rink floor and the seating floor and they have to ramp up the refrigeration to protect the ice. Or its humid and stale and hot because the air conditioning has broken down again (or possibly more likely its shut down on purpose to clean out the Legionaires bugs).

(EDIT: just be happy I didn't mention the 'toilets')

I do remember one absolutely entertaining event at VetsMem though. As I was in the queue to leave the car park after listening to the Moody Blues a Maricopa Sheriffs (I think) Motorcycle cop came blasting up the line of cars, probably doing at least 40mph. As he pulled up even with our car, the brakes on his front wheel locked up and he went ass-over-tit flying through the air and landed about 6 car lengths in front of me. As about a hundred people all jumped out of their car to figure out how much of the guy was gonna be in one piece for the ambulance to cart away, he stood up, shook his head, bent down to check his front wheel, accepted help from the first guy to get to him to pick up the bike, threw his leg over, started the engine, tested the brake lever a couple times, and took off down the road.

We all looked at each other with our mouths open and more than one guy asked me if he had been smoking too much weird stuff cause he couldn't believe what he had just seen.

[neeneko]

That lawsuit...oh, dear.

heh. So a reworked version of 'the judge has left the courtroom and abandoned ship, so I am judge now and dismiss my case!'

[woodworker]

I must be extremely slow this morning, but it seems to me that said lawsuit would have to strive to reach the level of cat vomit. And now I will have my bagel and cream cheese, with my vin ordenaire (Diet Dr. Pepper).

And what the fuck is with the redaction of the names -- this is not a sexual abuse/rape/etc. case, no minor children involved -- they might face ridicule, well boo fucking hoo. Such sensitive snowflakes.

[neeneko]

And what the fuck is with the redaction of the names -- this is not a sexual abuse/rape/etc. case, no minor children involved -- they might face ridicule, well boo fucking hoo. Such sensitive snowflakes.

Convicted felons hoping that the judge will agree with them and then it will be too late?

[LM K]

So:
Essentially no ballots were hand counted last week.

The Senate can't find people to hire for the hand count. Temp workers were supposed to show up on May 3rd.

Barnett is claiming that the audit will stop on May 14 and reopen the week later. Alas, no contract has been signed for the count to go beyond May 14.

Bamboo ballots, death threats and an ultimatum: What's next for Arizona GOP's election audit?

Here’s what happened last week and what lies ahead this week:

Recount Faces Week Off
The most visible piece of the audit -- the livestreamed hand recount of all 2.1 million Maricopa County ballots for president and U.S. Senate - is moving at a glacial pace.

At the end of this week, the recount will come to a temporary halt.

The Senate’s contract to use Veterans Memorial Coliseum for its hand count ends on Friday. The audit will have to clear out of the coliseum that day to make room for a week’s worth of Phoenix high school graduations.

As of Saturday, a new contract between the Senate and the Arizona State Fair, the coliseum’s operator, had not been signed.

Senate audit liaison Ken Bennett said Friday that the audit’s equipment would be moved out of the coliseum to an undisclosed location on the fairgrounds.

The 2.1 million ballots and county elections equipment will be stored somewhere in the coliseum, he said. The plan is to return everything to the coliseum once the graduations are done.

The State Fair has yet to confirm any of Bennett’s plans, beyond declaring the audit couldn’t remain in the building past May 14, because of the graduations.

Counting Will Go Into June
There are an estimated 1.9 million ballots left to count. Bennett has not been able to provide precise numbers since the hand count started.

At the current pace, the recount won’t be done for another three months.

But Bennett told audit pool reporter Ben Giles of KJZZ on Friday that the count would conclude at the coliseum in the middle of June.

“There's another (event), I think it's a gun show or something, that starts in the first week of July,” Bennett said. “So I think we'll probably be done in the middle of June. But we have until the end of June to get the work done.”

The Crossroads of the West gun show usually books the coliseum in July.

Bennett had said last weekend that temporary workers would start showing up last Monday, to double the workforce. But as of Friday, they were barely in evidence in the Coliseum work area.

“They must be being selective,” Bennett said of the subcontractor hiring the temps, “because it's not growing as fast as I think they or we would like.”

The next court fight?
Last week ended with an ultimatum from Arizona Senate Republicans.

The question Monday is whether Senate President Karen Fann will follow through on that ultimatum - and possibly invite a new lawsuit that could derail the audit.

Here’s the back story:
Fann’s lawyer warned Maricopa County Friday morning that the five County Board supervisors and county elections director would be subpoenaed Monday for “live testimony” if they didn’t hand over certain election materials to the audit team.

The County Board’s lawyer’s response at the end of the day: We can’t do it.

At issue are the county’s computer network routers, as well as passwords to ballot tabulators used at vote centers. Both were among the long list of election materials subpoenaed in January by the chairman of the Senate Judiciary Committee.

Penzone argues that handing over the routers would expose private law-enforcement information.

The county’s lawyer says the security of all operations for the fourth-largest county in the country would be at risk if the routers were turned over.

Why does Senate GOP want routers?
Bennett, the audit liaison, says the routers are needed to test another conspiracy theory -- whether the county’s ballot tabulators are connected to the internet.

“Well, there are people that have always suspected something nefarious about elections being connected to the Internet," Bennett said Saturday to audit pool reporter Dan Zak of the Washington Post. "And so I think that's why the request was made.

An independent audit done for the county earlier this year found there were no connections to the internet.

As for the passwords, the county says it doesn’t have them.

If Fann pursues the routers, a court fight appears likely - either by the County Board or the sheriff.

Chris Krebs, the former director of the Cyber Security and Infrastructure Security Agency at the U.S. Department of Homeland Security, tweeted that if the demand for the routers isn't withdrawn, it will be a sign that the audit team is "seeking to disrupt ops & have no idea what they're doing."


Hobbs’ letter listed 13 failings of the Senate Republicans’ audit, as determined with the help of Hobbs’ observers at the audit site.

Hobbs concluded by urging Bennett: “Either do it right, or don’t do it at all.”

Bennett had 48 hours to respond, under terms of a court settlement.

He returned fire: “Your bias is being transmitted through the observers you send.”

As of Friday, Hobbs’ legal team was weighing its response.

The court settlement allows Hobbs to return to court to try to compel Bennett to make changes in audit procedures.

[Chilidog]

The AZ GOP have cluster fucked themselves into quite a predicament.

What is it about the Arizona sun that makes right-wingers so ripe for con men?


All we need is the map to the lost Dutchman mine and a Dennis Montgomery hard drive of Chinese pron to make this complete.

[LM K]

All five Maricopa County supervisors to be subpoenaed Monday over audit

Kory Langhofer, the attorney for the Senate, said he will be issuing subpoenas Monday, May 10, for all five Maricopa County supervisors, demanding they appear to explain why they won’t surrender certain equipment and information for review as part of the audit of the 2020 General Election returns. Langhofer also said the Senate wants to hear from Scott Jarrett, the county’s director of election day and emergency voting.

But that may just be part of it.

The Senate also may subpoena Maricopa County Sheriff Paul Penzone. That’s because it is Penzone who is telling the supervisors they shouldn’t surrender the county’s computer routers because it would result in “horrendous consequences” for law enforcement personnel.

A bigger fight, however, surrounds the routers. These are the devices the county uses to funnel computer traffic among its computers.

The routers themselves contain no information on what was transmitted or received.


But what they would show are the unique IP — for internet protocol — addresses of any traffic, both sent and received. And that could answer the allegation that someone, somehow, electronically injected extra votes for Joe Biden into the results.

[LM K]

The AZ GOP have cluster fucked themselves into quite a predicament.

What is it about the Arizona sun that makes right-wingers so ripe for con men?


All we need is the map to the lost Dutchman mine and a Dennis Montgomery hard drive of Chinese pron to make this complete.

There only goal now is to "show" that there is "fraud" because they can't get the routers.

"What are they hiding!"

[tek]

I hope there is a huge backlash over this amateur-hour production.

This is supposedly critical to the future of democracy in Arizona and the country, yet they showed all the technical and organizational skill of Homer Simpson. Maybe less.

[SuzieC]

All five Maricopa County supervisors to be subpoenaed Monday over audit

Kory Langhofer, the attorney for the Senate, said he will be issuing subpoenas Monday, May 10, for all five Maricopa County supervisors, demanding they appear to explain why they won’t surrender certain equipment and information for review as part of the audit of the 2020 General Election returns. Langhofer also said the Senate wants to hear from Scott Jarrett, the county’s director of election day and emergency voting.

But that may just be part of it.

The Senate also may subpoena Maricopa County Sheriff Paul Penzone. That’s because it is Penzone who is telling the supervisors they shouldn’t surrender the county’s computer routers because it would result in “horrendous consequences” for law enforcement personnel.

A bigger fight, however, surrounds the routers. These are the devices the county uses to funnel computer traffic among its computers.

The routers themselves contain no information on what was transmitted or received.


But what they would show are the unique IP — for internet protocol — addresses of any traffic, both sent and received. And that could answer the allegation that someone, somehow, electronically injected extra votes for Joe Biden into the results.

Wow. It would look really great for the AZ Senate nutzo audit team to subpoena or sue the Maricopa Co. Sheriff. Proving once again that Republicans don't actually give a rat's ass about law enforcement, except when they pretend to be in favor of law and order to appeal to their racist base.

[northland10]

If the routers, or more specifically, the router logs (which I think could be gotten without the actual routers depending on the county/state retention requirements) showed any IP address from China, you know they would start screaming China fraud even if the hits had nothing to do with with the elections. I suspect they get a bunch of hits from China, Russia, etc. every day.

Not to mention that those China URLs may have only been proxies for American or Russian-based spammers.

[noblepa]

If the routers, or more specifically, the router logs (which I think could be gotten without the actual routers depending on the county/state retention requirements) showed any IP address from China, you know they would start screaming China fraud even if the hits had nothing to do with with the elections. I suspect they get a bunch of hits from China, Russia, etc. every day.

Not to mention that those China URLs may have only been proxies for American or Russian-based spammers.

I have a little experience with routers, particularly Cisco routers, which are the most common ones on the internet.

Router logs are typically not kept on the routers themselves. The data to be logged is sent to a server set up specifically for that purpose. Routers usually don't have hard drives. Everything, including the operating system is kept in memory. Its much faster that way. The logs usually don't contain complete records or every packet that passes through them. It is usually for specific addresses that you want to monitor and for unusual conditions or errors that occur. To log every single packet would result in tens, if not hundreds, of terabytes of information per day.

In my experience, routers logs are often not kept at all, or are only kept for a day or two, due to the enormous volume of data that is created. They are useful for debugging a problem in near-real time, but are not very useful after the problem is solved.

Routers may contain "rules" that can allow or block traffic from specific IP addresses, and can specify that traffic destined for certain addresses are routed via other specific routers. These rules, in and of themselves tell you very little about the content of the traffic. I suppose that if there were specific rules that called out certain IP addresses, and if those IP addresses could be identified, you might be able to infer something from that. The network they have almost certainly uses private IP addresses internally (10.xx.xx.xx or 192.168.xx.xx). These addresses simply won't work on the internet at large. If one of these addresses were to appear on one of the internet trunk routers, either as the origin or the destination of the packet, the trunk router would unceremoniously drop the packet.

Network admins usually like to keep the rules in the routers as simple as possible. They try to limit them to passing packets off to the next router as quickly as possible. Enforcing rules about who can and can not access certain things are more commonly contained in a firewall.

If the voting machines were connected to Arizona's private network, they would have such addresses. That doesn't mean that those devices couldn't communicate with the outside world. They would have to go through a process called Network Address Translation (NAT) to convert the addresses from private, non-routable addresses to public, routable addresses. Rules for that translation might appear in the routers, but it might not. The rules might simply say that any device inside the state's private network that wanted to communicate with the outside world would be randomly translated to a public address. This would probably not appear in the logs.

Even if you saw evidence of such translation, I'm sure that Arizona, or even just the agency doing the vote counting has thousands of devices on their internal network. You would need to be able to identify which internal addresses were assigned to voting machines and which were simply assigned to some staffer's desktop PC, a daunting task.

The rules in routers usually don't refer to any device by any name that is meaningful to a human who might be reading them. The rules almost exclusively deal with IP addresses or blocks of IP addresses.

I think that the Republicans really want the information contained in the firewalls. Firewalls are similar to routers, but they exist specifically to act as a semi-permeable membrane between the outside world and the internal network. That is where the rules that allow an outside computer to access an internal computer.

I say semi-permeable because they often are set up to allow unfettered outbound access, but very restrictive and predefined inbound traffic.

I don't think that the routers would show them anything even remotely useful to their cause. It would only disrupt the normal business of the state's network. Its kind of like the police investigating possible corruption by state officials asking that the capital building unplug its telephone hardware and deliver it for examination. No one in the capital building would be able to make or receive a phone call.

I have no idea how Arizona's network is structured, but it is easy to imagine that physically removing those routers could bring much of the day-to-day business of the state government to a complete standstill. It might even cause legal problems for the state. Payments to suppliers, payroll deposits, receipts of state income taxes, family assistance payments, unemployment insurance payments, etc. are largely done electronically these days. Remove the routers and all of that stops.

[SlimSloSlider]

If the routers, or more specifically, the router logs (which I think could be gotten without the actual routers depending on the county/state retention requirements) showed any IP address from China, you know they would start screaming China fraud even if the hits had nothing to do with with the elections. I suspect they get a bunch of hits from China, Russia, etc. every day.

Not to mention that those China URLs may have only been proxies for American or Russian-based spammers.

Given how many people are constantly attempting to penetrate networks, firewalls and front-end routers will log attempted connections from all over the planet. That has no meaning in any case as any sophisticated attempt would never come directly but rather through already compromised boxes.
The fact that the machines were not connected to the internet reveals the paucity of know-how the Cyber-Nincompoops actually have.

[northland10]

If the routers, or more specifically, the router logs (which I think could be gotten without the actual routers depending on the county/state retention requirements) showed any IP address from China, you know they would start screaming China fraud even if the hits had nothing to do with with the elections. I suspect they get a bunch of hits from China, Russia, etc. every day.

Not to mention that those China URLs may have only been proxies for American or Russian-based spammers.

Given how many people are constantly attempting to penetrate networks, firewalls and front-end routers will log attempted connections from all over the planet. That has no meaning in any case as any sophisticated attempt would never come directly but rather through already compromised boxes.
The fact that the machines were not connected to the internet reveals the paucity of know-how the Cyber-Nincompoops actually have.

Cyber Ninjas may or may not understand but that is not the important part for them. Only the understanding of their client matters and since their clients are clueless (and actually are more into PR than audits), CN can say near about anything,

[woodworker]

If the routers, or more specifically, the router logs (which I think could be gotten without the actual routers depending on the county/state retention requirements) showed any IP address from China, you know they would start screaming China fraud even if the hits had nothing to do with with the elections. I suspect they get a bunch of hits from China, Russia, etc. every day.

Not to mention that those China URLs may have only been proxies for American or Russian-based spammers.

I have a little experience with routers, particularly Cisco routers, which are the most common ones on the internet.

Router logs are typically not kept on the routers themselves. The data to be logged is sent to a server set up specifically for that purpose. Routers usually don't have hard drives. Everything, including the operating system is kept in memory. Its much faster that way. The logs usually don't contain complete records or every packet that passes through them. It is usually for specific addresses that you want to monitor and for unusual conditions or errors that occur. To log every single packet would result in tens, if not hundreds, of terabytes of information per day.

In my experience, routers logs are often not kept at all, or are only kept for a day or two, due to the enormous volume of data that is created. They are useful for debugging a problem in near-real time, but are not very useful after the problem is solved.

Routers may contain "rules" that can allow or block traffic from specific IP addresses, and can specify that traffic destined for certain addresses are routed via other specific routers. These rules, in and of themselves tell you very little about the content of the traffic. I suppose that if there were specific rules that called out certain IP addresses, and if those IP addresses could be identified, you might be able to infer something from that. The network they have almost certainly uses private IP addresses internally (10.xx.xx.xx or 192.168.xx.xx). These addresses simply won't work on the internet at large. If one of these addresses were to appear on one of the internet trunk routers, either as the origin or the destination of the packet, the trunk router would unceremoniously drop the packet.

Network admins usually like to keep the rules in the routers as simple as possible. They try to limit them to passing packets off to the next router as quickly as possible. Enforcing rules about who can and can not access certain things are more commonly contained in a firewall.

If the voting machines were connected to Arizona's private network, they would have such addresses. That doesn't mean that those devices couldn't communicate with the outside world. They would have to go through a process called Network Address Translation (NAT) to convert the addresses from private, non-routable addresses to public, routable addresses. Rules for that translation might appear in the routers, but it might not. The rules might simply say that any device inside the state's private network that wanted to communicate with the outside world would be randomly translated to a public address. This would probably not appear in the logs.

Even if you saw evidence of such translation, I'm sure that Arizona, or even just the agency doing the vote counting has thousands of devices on their internal network. You would need to be able to identify which internal addresses were assigned to voting machines and which were simply assigned to some staffer's desktop PC, a daunting task.

The rules in routers usually don't refer to any device by any name that is meaningful to a human who might be reading them. The rules almost exclusively deal with IP addresses or blocks of IP addresses.

I think that the Republicans really want the information contained in the firewalls. Firewalls are similar to routers, but they exist specifically to act as a semi-permeable membrane between the outside world and the internal network. That is where the rules that allow an outside computer to access an internal computer.

I say semi-permeable because they often are set up to allow unfettered outbound access, but very restrictive and predefined inbound traffic.

I don't think that the routers would show them anything even remotely useful to their cause. It would only disrupt the normal business of the state's network. Its kind of like the police investigating possible corruption by state officials asking that the capital building unplug its telephone hardware and deliver it for examination. No one in the capital building would be able to make or receive a phone call.

I have no idea how Arizona's network is structured, but it is easy to imagine that physically removing those routers could bring much of the day-to-day business of the state government to a complete standstill. It might even cause legal problems for the state. Payments to suppliers, payroll deposits, receipts of state income taxes, family assistance payments, unemployment insurance payments, etc. are largely done electronically these days. Remove the routers and all of that stops.

Now you've done it. The nunjuks are now going to use your description as a template for the next round of subpoenas. So please, make sure any further technical descriptions will lead them through the looking glass, as if they are not there already.

[SlimSloSlider]

Now you've done it. The nunjuks are now going to use your description as a template for the next round of subpoenas. So please, make sure any further technical descriptions will lead them through the looking glass, as if they are not there already.

Nah, to follow this means they understand that there is nothing the routers can give them.
Nothing, nada, niente.
Routers’ job is to direct traffic, no more.
If they ask for the firewalls, their intent is to be obstreperous, not to verify election results.
I have cacti that are smarter.

[neonzx]

OMGosh, so now it's the "routers", eh? Hey, let's talk about 5G too while were at it.

[LM K]

OMGosh, so now it's the "routers", eh? Hey, let's talk about 5G too while were at it.

[SlimSloSlider]

OMGosh, so now it's the "routers", eh? Hey, let's talk about 5G too while were at it.

Let’s not forget IP v.6 and throw in some Tesla “free energy” while we put selfies at the Capitol online.

[LM K]

The Senate wants to see the router's IP numbers.

Bennett already admitted that the machines weren't connected to the internet.

[tek]

I have no idea what the rules are on AZ Senate subpoenas, but this seems like "we just want to nose around"..

IANAL, but I'd think in a real legal case this ought to be able to be limited or quashed based on being overly broad. Of course, this is not a legal case..

[neeneko]

If the voting machines were connected to Arizona's private network, they would have such addresses. That doesn't mean that those devices couldn't communicate with the outside world. They would have to go through a process called Network Address Translation (NAT) to convert the addresses from private, non-routable addresses to public, routable addresses. Rules for that translation might appear in the routers, but it might not. The rules might simply say that any device inside the state's private network that wanted to communicate with the outside world would be randomly translated to a public address. This would probably not appear in the logs.

If they looked at the routers while they were in use rather than unplugged and sent in, they MIGHT have the information sitting in their NAT table,but I would be surprised it it was stored anywhere other than RAM and thus is probably long gone.

Now, one possibility is that if the router is also acting as a DHCP server, it might remember the mac addresses (along with the client self identification information) since those are sometimes kept around. I know my pfSense box recalls mac addresses that requested IP addresses through reboots and they can stick around a surprising amount of time. I think some of my linksys stuff does the same, but I haven't poked around in that nearly as much.

What they are probably hoping to find, assuming they have even really thought about it, is something like some static routes between the network an 'china', or maybe even a vpn setup.

Though I suspect that this all came from something dumb like someone looking at their home router, noticing that it had its DHCP list including all the device macs and identifiers that connected to it and are hoping these routers (which are probably not the ones servering IPs anyway) have that same kind of easily digestible table.

[neonzx]

The Senate wants to see the router's IP numbers.

Bennett already admitted that the machines weren't connected to the internet.

These asshats have no idea how these closed systems work.You can rip the lead coax inet feed from of your home network and all your devices will still work (just no Netflix and chill). They are private IP addresses CLOSED SYSTEM. The machines were not on the open internet.