Fogbow

The Arizona Senate gave contractors unfettered and unmonitored access to Maricopa County's vote-counting machines for an audit of the county's general election results, raising the question of whether the equipment is safe to use for future elections.

It could take a lot of time and money to determine that, due to strict federal and state laws along with local rules for certifying and protecting election equipment.

For now, county officials are promising voters they will use only certified equipment for elections and not equipment "that could pose a risk to free and fair elections," said Megan Gilbertson, spokesperson for the county's Elections Department.

Private companies and individuals having access to government-used voting machines are unprecedented in Arizona.

The Senate's contractors, including Florida-based cybersecurity firm Cyber Ninjas and others who the Senate and Cyber Ninjas have refused to name, got the equipment last month only after a court ruled that the county had to turn it over in response to Senate-issued subpoenas.

Now that much of the equipment is back, county officials are "working with our attorneys on next steps, costs and what will be needed to ensure only certified equipment is used in Maricopa County," Gilbertson said.

The U.S. Election Assistance Commission, the federal agency that certifies all voting systems used in U.S. elections, recommends that any time the rules or procedures for maintaining and securing voting systems — known as the chain of custody — are broken or could have been broken, that the equipment is completely retested under state and county rules, said Mona Harrington, executive director of the commission.

Harrington did not say whether the chain of custody was broken in this instance.

Matt Masterson, a former leader of election security at the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, told The Arizona Republic that this kind of review can take weeks to months and cost $100,000 or more, depending on what processes are used.

Considering this, Masterson said it might not be worth it for the county to use the machines again.

"It's a really hard call for the county," he said. "It's a tough situation."

The county leases its voting machines through a three-year, $6.1 million contract with Dominion Voting Systems. It's unclear if the county can break that contract if needed, and how much it would cost to replace the machines.

Senate received hundreds of machines
Maricopa County gave the Senate its election equipment, 2.1 million ballots, voter rolls and other election information in response to subpoenas Senate Republican leaders issued in January.

The Senate then handed everything over to contractors, some of whom they have named and some of whom they have refused to name, to audit the county's November 2020 election results.

What is known about who is involved is concerning to many election consultants. Doug Logan, CEO of Cyber Ninjas, has touted unfounded claims of election fraud online, and much of the recruiting for the review of ballots was done by right-wing groups.

The audit began April 23, and the auditors say they have counted nearly 500,000 ballots and made digital copies of many of the county's machines, which they are examining.

No county officials have observed the audit, with county supervisors saying repeatedly that the county wants no part of it.

The county's only responsibility, supervisors have said, was turning over what was required under the subpoenas. That included the voting systems that count the paper ballots.

The county gave the Senate those machines, which included nine large high-speed ballot-counting machines that process ballots at the tabulation center (known as central count tabulators), 385 ballot-counting machines used at vote centers (known as precinct-based tabulators), along with the servers and equipment used to support those devices.

The auditors already returned many machines to the county, but still have the precinct-based tabulators.

Questions about storage, access
Much is unknown about measures the contractors took to protect the machines.

The Senate signed an agreement with Maricopa County that said the county is not liable for any damages to the equipment while in the Senate's custody.

But the agreement did not include specific rules for moving, storing or accessing the machines.

Cyber Ninjas, the main contractor running the audit, has refused to answer questions from The Republic regarding where in the coliseum the machines were stored, the names of the contractors who had access to them, how the contractors ensured they were kept clean and secure, and why no livestream monitored them.

CyFIR, a Virginia-based digital security company, was hired for the work, along with “a number of additional analysts, the identities and qualifications of whom shall be made available to (the Senate) upon request,”according to Cyber Ninjas' original work plan.

A document released by CyFIR founder Ben Cotton following a court order gives some details on how the machines are guarded and controlled.

The document says they will be kept in an "evidence storage area" in the coliseum enclosed by walls, wooden partitions and chain link fencing. There is also a "forensic imaging area" enclosed in a similar manner.

An "armed security guard" will observe the areas, according to the document, and only the "digital forensic lead and the deputy forensic lead" are able to access them. Two others will sit in the area to document the access to the machines.

The document also says that "24/7 live video" would monitor the area, and it was Cotton's "understanding" that the video would be livestreamed.

That has not happened. While the Senate's contractors set up a livestream in the room where the ballots are stored, there has been no livestream of the machines.

This is concerning to the Secretary of State's Office, which said in a May 5 letter to Senate liaison Ken Bennett that it was a "violation of your own requirements and means that neither election officials, experts, nor the public had any transparency into how the election equipment was handled."

To track what happens to machines, Cotton wrote that "all evidence will be preserved using Logicube WriteProtect devices, ensuring that there is no change to the digital devices being imaged."

The document also says that those with access to the machines, which it referred to as "forensic imagers and evidence custodians" had to complete an "Arizona Audit specific training session" before doing the work.

Election equipment normally in government custody
Because of laws surrounding the certification of voting systems, and because most governments use voting systems built by private companies, getting access to voting systems is challenging for those outside of government.

This has made it relatively difficult for hackers to find ways to circumvent security measures, said Alex Halderman, a University of Michigan computer science and engineering professor who specializes in election security.

That’s no longer true as of this past year, Halderman said, with this post-election audit in Arizona and lawsuits in other states that allowed outside access to voting machines.

The county's contract with Dominion runs until December 2022 and includes the central count and precinct-based tabulators, a server, other support hardware and software, training, maintenance, licenses, warranty and support services. The county has the option of renewing the contract for another two years and seven months.

For private and unknown people to have such access to government-used vote-counting machines without any supervision or control from election officials is rare, Masterson said.

Halderman said that has created the possibility that the contractors could have tampered with the machines or could learn about vulnerabilities in the systems.

“A lot of it comes down to whether you trust the individuals and groups who are conducting the audit,” he said. “If you think they are unscrupulous partisan actors, this might create very real risks.”

Masterson said best practices in the technology field are to assume "bad actors" if you lose physical control of a system.

"The county has had literally zero visibility," he said.

What county should examine
The equipment returned by the Senate is back at the county's election center.

There's no state law telling the county how to ensure its machines weren't tampered with, given "state statutes and the Elections Procedures Manual never contemplated the tabulation equipment leaving the custody of the Elections Department," Gilbertson said.

The county will not use the returned tabulation equipment unless they, the state and Dominion are confident that no malicious hardware or software was installed on the devices, Gilbertson said.

The Secretary of State's Office is concerned about the status of the machines, said Sophia Solis, an office spokesperson.

"We’re in some uncharted territory right now, but we do have some serious concerns about Maricopa County’s voting machines," Solis said.

Masterson, the former Homeland Security election official, said the county should take the machines apart to see whether any hardware was installed or swapped out, and check that the software and its components are exactly the same.

That check should go beyond what's required to certify new voting machines at the federal level, which in itself has more than 1,500 individual requirements, and takes between six to 10 months.

"The level of review here is significant," he said.

While Masterson said he isn't sure if the county should use the systems again, the cost ofnot doing so may compel officials to at least do a cursory check of the system to spot any concerns before making a decision.

The Election Assistance Commission recommends that, generally, when a county has concerns about the integrity of their voting machines they should reach out to the manufacturer — in this case, Dominion — to evaluate the machines.

Also, Harrington said, if the county finds that the machines were significantly altered from when they were first federally certified, the county should reach out to the commission for guidance.

Already, Maricopa County has had to lease additional tabulation equipment for elections it has performed this year, including the Goodyear election in March and the Cave Creek election this week.

Machines kept secure and clean
Under normal circumstances, Maricopa County has extensive procedures for keeping ballot tabulation machines secure and clean between elections.

Only certain county employees typically have access to them.

The central count tabulators are kept in the secure ballot tabulation center at the county's election center, Gilbertson said, and only employees with certain badges can enter. Elected officials, including the county supervisors and recorder who oversee the elections, are not allowed in those rooms.

The precinct-based tabulators are stored in the county's warehouse, Gilbertson said, which also requires a badge to access. The tabulators themselves won't work unless they are programmed by the election management system in the tabulation center, using two new memory cards tied to the machines.

The machines are stored under plastic, Gilbertson said, to help keep them clean.

The central count tabulators are so sensitive that the county vacuumed the ceiling tiles in the election center before hosting the Goodyear election in March, she said, and the county cleans the microfilm in the machines before elections.

The scanners that read the ballots are similar to cellphone cameras, Gilbertson said, in that it's critical there aren't smudges to get a clear picture.

The county's contract with Dominion requires the county to move them with special equipment so they are not damaged.

What are contractors are examining?
It's not clear how the contractors are examining the machines, or what exactly they are looking for beyond whether the machines were connected to the internet during the election.

CyFIR's work already was scrutinized after they, or other contractors, told Senate President Karen Fann, R-Prescott, that the county had deleted certain election directories from the server it provided.

Cotton told Senate Republican leaders this week that he now has access to these files. He said he had initial trouble downloading the county's data because the county didn't provide directions to its multi-layered databases.

Fann also has tried to get additional passwords and keys to the county's voting systems, while the county has said it does not have any additional passwords. It's unclear what the auditors have and don't have access to, and what the passwords would allow them to see.