2021 Maricopa County presidential ballot audit

On June 2, Hobbs issued a report detailing observations made to that point by election observers from her office, alleging various infractions on the part of the auditors. These included leaving security gates open, leaving confidential materials unattended, and bringing "prohibited items including cellphones and pens with black or blue ink" to the counting floor.[59] In particular, black and blue ink pens are prohibited because they can be used to modify ballots that were cast.

The objectivity of the audit has been called into question due to the involvement of Logan.[60] Additionally, Anthony Kern, a former Republican state lawmaker who was present at the 2021 storming of the United States Capitol, has been seen tallying votes.[1] Kern, who was himself named on the ballots as a would-be Trump presidential elector as well as running for re-election to the Arizona House of Representatives, has since been removed from the group with access to the ballots.[61] Former Republican Secretary of State Ken Bennett continued advising the audit, and Hobbs, the current Secretary of State, criticized Bennett's efforts, saying he needs to "either do it right, or don't do it at all."[48]

The audit has produced division among Arizona Republicans. After initially supporting the audit, on May 9 Paul Boyer, a member of the Arizona State Senate Republican caucus, criticized the audit, saying "it makes us look like idiots." The Maricopa County Board of Supervisors, which is dominated by Republicans, also opposed the audit.[62] On May 17, the board held a hearing and sent Fann a twelve-page letter to dispute her allegations of wrongdoing by county officials. Republican board chairman Jack Sellers stated that the allegations were actually due to the incompetence of the auditors and accused Fann of an "attempt at legitimatizing a grift disguised as an audit."[63][64] Fann, however, continued to support the audit, and sent the Board of Supervisors a four-page letter stating that "serious issues" had arisen during the audit.[65] Arizona Republican Party Chairwoman Kelli Ward released multiple videos about the audit, in which she criticized the Board of Supervisors and raised "the possibility of placing the validity of the entire 2020 election into question."[66][67] A poll conducted at the end of March found that 78.3% of Arizona Republicans believed "that there was significant voter fraud in the 2020 United States Presidential Election which compromised the integrity of the election."[68]

It was reported in June 2021 that a Cyber Ninjas subcontractor had transported copies of voting systems data to a supposed "lab" in Bigfork, Montana.[69] The exact nature of the data and what efforts had been taken to keep it secure was unclear. A CNN reporter traveled to the location listed in property records for the subcontractor and found a cabin in a wooded non-commercial area.[69][70]

In late June 2021, the Monmouth University Polling Institute reported that a majority of Americans viewed this and similar audits as "partisan efforts to undermine valid election results".[71]

The auditors announced on June 25 they had finished counting and photographing the 2.1 million ballots, and Bennett stated a final report would come in weeks or months.[72] On July 9, Fann announced the Senate would conduct another ballot count as a check on the work done by Cyber Ninjas and the earlier count by county election officials.[73]

On July 14, two House Democrats, Carolyn Maloney and Jamie Raskin, opened an investigation into Cyber Ninjas, sending a letter to Logan requesting documents and records of any communications between the company and Trump or his allies, as well as information on who was funding the audit.[74] The next day, a Maricopa County judge ruled that all information relating to the audit were public records, including communications between the audit participants and information about who was financing the audit, rejecting an argument by Senate Republicans that information held by Cyber Ninjas and other private contractors were not subject to the Arizona public records law. The judge found that government officials could not shield information about their official activities by farming it out to private companies.[75] Another judge and an appeals court agreed, and in September the Arizona Supreme Court declined to hear an appeal from Senate Republicans, requiring the documents to be released.[76]

On July 15, preliminary findings were presented by Doug Logan, Ken Bennett and Ben Cotton, in an Arizona Senate hearing lead by Arizona Senate member Warren Petersen and Arizona Senate president Karen Fann.[77] During the hearing, Logan incorrectly asserted the county had 74,243 "mail-in ballots" that had no record of being sent to voters,[78] though he acknowledged the discrepancy could have been caused by record keeping errors. The incorrect information was quickly repeated by lawmakers and Republican commentators, echoing a similar false claim that had been made in Pennsylvania soon after the election.[79] County officials and election experts said Cyber Ninjas had misinterpreted data files when examining mail-in ballot figures, leading to an incorrect conclusion.[80][81][82][31] County officials said Logan did not appear to understand that early votes in the county were not cast solely through mail-in ballots, but that some early votes were cast at in-person voting centers. The in-person early votes would not see a record of being mailed to voters, since those ballots were provided directly at the in-person voting centers, rather than being sent to voters by mail.[83][84] Tammy Patrick, who had been a federal compliance officer for Maricopa County elections for eleven years, said the auditors had examined early versions of the data that the county had provided to political parties to aid their get-out-the-vote efforts, but those early versions were not intended to and did not reflect the final official tallies.[31]

Logan also noted about 168,000 ballots with faulty printing that caused the print on the front and back to be slightly misaligned, which he claimed could cause voters to cast ballots for the wrong candidate if voting machine ink bleeds through the ballot, or if a Sharpie marker is used. He said the voting machines used "a lot of very thin paper stock", though the paper was among the types recommended by the vendor of the voting machines that print completed ballots. An independent audit months before the election ran 1.5 million test ballots through the voting machines; two ballots jammed in the tabulators but the test vote was found to be accurate. The county said it used 80lb Vote Secure paper for all mail-in and in-person ballots, and before the election said it would provide polling places with fine-tipped Sharpies because they had the fastest-drying ink to minimize smudged ballots.[31] Logan acknowledged the matter required further analysis, though election experts said bleed-through does not affect the vote count because of printing alignment issues, and a bipartisan process had been in place to flag and examine unreadable ballots.[85][31] Logan also claimed to have an affidavit asserting that signature verification standards had been progressively relaxed during the election until "they were just told to let every single mail-in ballot through", which Republican county recorder Stephen Richer strongly denied.[78] Neither county officials nor Senate Democrats were permitted to participate in Logan's presentation.[86]

Soon after Logan's presentation, Trump released three statements in which he made multiple false assertions regarding the findings. He falsely claimed the 168,000 ballots Logan had identified had been printed on illegal paper and were unofficial. He also characterized as "magically appearing ballots" the 74,243 mail-in ballot discrepancy that Logan had incorrectly found. Trump asserted that "all the access logs to the machines were wiped, and the election server was hacked during the election", though there was no evidence to support the claim. The county said that months before the election an individual had inappropriately downloaded publicly-available data from the county website; a forensic audit by two firms months before the election found the election management system was airgapped from the website and the internet.[31] He then said the incidence of fraud and irregularities was many times more than would be needed to change the election outcome, though the number of identified potential fraud cases was far smaller than Biden's margin of victory. Trump echoed a claim Logan had made, stating "11,000 voters were added to the voter rolls AFTER the election and still voted", though this was explained by voters casting provisional ballots and later being added to the rolls after their eligibility to vote was confirmed.[85][81][31]

On July 16, the auditors claimed they did not have enough information to complete their report, and requested that the Arizona Senate subpoena further records and survey tens of thousands voters at their residences. Logan said during the July 15 presentation that his assertions of a 74,243 mail-in ballot discrepancy, found to be incorrect, merited the household survey.[31] Cyber Ninjas had in May agreed to not survey households, after the Justice Department threatened to sue over the practice.[83][87]

A July Associated Press investigation found that Arizona election officials had identified 182 ballots out of 3.4 million cast statewide that were sufficiently problematic to be referred to investigators for further review. Four of those incidents had led to charges, two against Democratic voters and two against Republicans. A spokesman for Arizona Republican attorney general Mark Brnovich had said in April that 21 active investigations were underway, though he did not indicate how many related to the November 2020 election.[88]

Fann expressed confidence in Cyber Ninjas, asserting "they are working with a number of other contractors that have experience in audits and in their expertise in their own fields." The Arizona Republic had reported in June that none of the contractors involved in the audit were certified by the federal Election Assistance Commission, while two firms that had conducted forensic audits for the county before the election were certified.[89][90] In late July, Bennett confirmed that he was being shut out of the auditors' second ballot count because he questioned the lack of transparency in the processes being used, which he characterized as "hide-the-ball-from-me stuff". He said he believed an independent group should have conducted the second count after the auditors' first count did not match the official results. He added he had "indirectly...allowed some information that was supposed to be private to get out," referring to partial ballot count data given to an outside election auditing firm which found the Cyber Ninjas second count was a 99.9% match with the official count. The CEO of the outside firm said that if the difference was extrapolated to all 2.1 million ballots, the count would differ by 124 votes.[91][92][93][94]

Trump chief spokesperson Liz Harrington often tweeted about the audit, and on July 26 she appeared on Special Report with Bret Baier on Fox News to falsely assert that Logan's analysis meant there were 275,000 "potential fraudulent ballots."[4]

On July 26, the Republican Senate issued new subpoenas for the envelopes bearing signatures for mail-in ballots, as well as for all routers, and passwords and log-in information for the ballot tabulation devices. County officials had previously told the auditors that access to such equipment was unnecessary and posed a security threat, including possible access to sensitive information in the county sheriff's office.[93] County supervisors and the election voting machine vendor, Dominion Voting Systems, refused to comply with most of the demands in the subpoenas days later, responding that much of the materials had already been provided under subpoenas months earlier. The supervisors also said some of the requested materials were held in the Recorder's office, which was not named in the subpoenas. The demand for routers was again flatly denied on security concerns. The supervisors noted the subpoenas had not been authorized by a Senate vote, while Dominion asserted the subpoena it received demanded information the company did not have and that it would take Cyber Ninjas to court to protect its proprietary rights. Fann responded she would grant more time for compliance while the auditors considered their options for gaining access to the routers and passwords.[95][96] Senate Republicans and the Board of Supervisors reached a settlement on September 17 in which the demand for routers, network logs and the voter registration database would be withdrawn in exchange for the Board dropping its effort to recoup from the auditors the $2.8 million that had been authorized to replace voting equipment that had been potentially compromised by the auditors. The settlement called for a special master to arrange for an independent technology team to examine the routers and answer questions about how they were used in the 2020 election and how they will be used in future elections.[97] The results of the examination, led by former Arizona Republican congressman John Shadegg, were released in March 2022, finding that the county's ballot tabulation system was never connected to the internet or any external devices. The team found there were actually no routers involved that required inspection and there was no evidence any data had been deleted or tampered with.[98]

On July 27, Twitter banned the audit's official account for violating rules regarding platform manipulation and spam.[2]

Cyber Ninjas released a summary of its major donors on July 28, indicating $5.7 million was raised from five groups associated with individuals who had cast doubt on the presidential election, including Byrne, Flynn and Powell, as well as OANN personalities Chanel Rion and Christina Bobb.[99]

Attorney General Mark Brnovich stated that the Maricopa County Board of Supervisors violated state law by not complying with election audit subpoena. The Maricopa Board of Supervisors, in response, said that there was no violation, since the Senate lacked the power of enforcement when not in legislative session.[100][101]

Concurrently, on August 3, a county judge enforced a previous ruling from July wherein he rejected the argument from Senate Republicans that they were immune from suits to release their audit records, ordering the records released immediately; the order was expected to be appealed to a higher court.[102] On August 25, Maricopa County Superior Court Judge John Hannah ordered Cyber Ninjas to preserve all records of their audit for later public release.[103]

On September 23, 2021, Maricopa County claimed that the report from the audit would show that Biden had indeed won the county.[104] The New York Times has reported that draft versions of the report it had seen showed Biden to have won slightly more votes and Trump to have won slightly fewer than the official count had.[105]

The audit's report found that the auditors' ballot recount increased Biden's margin of victory by 360 votes compared to the official count.[122] Cyber Ninjas asserted they found problems with election conduct and alleged widespread anomalies in the election count that set the result in doubt. The report called into question a total of 53,305 ballots for varying reasons, though it noted multiple times there could be legitimate explanations for discrepancies.[12][123]

The auditors misleadingly stated that voting data had been deleted from the EMS server just before their audit was set to begin. The data had actually been archived to permanent storage systems in February, before a county-commissioned audit was to begin, and no data were missing. The auditors also asserted that some voting equipment was connected to the Internet, citing a server in the Recorder's office, but county officials noted that server was not part of the EMS and maintained the EMS was not connected to the Internet. In its report, the auditors said 3,432 more ballots were cast than were shown in a file of voters provided by the county, but the county explained that certain government officials and others are excluded from that file for their personal security because the file contains home addresses. One audit team member, Shiva Ayyadurai, who is known to promote conspiracy theories, claimed to have found faulty or missing signatures on ballot envelopes that could have resulted in thousands of duplicate ballots being counted, though election workers contact such voters so they can "cure" the errors and their ballots can be counted. The county said no duplicate ballots were counted.[124][125][126][127][128]

Ayyadurai also said he found 17,322 duplicate ballot envelope images, which he suggested might mean ballots had been counted more than once. However, election workers may take multiple images of a ballot envelope as the signature curing process proceeds with voters, and each envelope bears a barcode to track that process and ensure that only one ballot is counted per voter. Ayyadurai asserted the receipt of envelopes "surged right after the election was over," though state law allows election workers five business days after elections to cure signatures, so there was a spike in such activity for those who voted on or just before election day. During the curing process, a ballot may be recorded as received by mail more than once, but it is counted as a vote only once.[129][128] Ayyadurai's analysis was mischaracterized on social media and alternative news sites as having found 17,322 duplicate ballots.[130]

Auditors said they found 5,047 Arizona voters with the same names and birth years who potentially voted twice, including in Maricopa County. County officials countered that matching names and birth years was not unusual in a state with 7 million residents.[129]

Cyber Ninjas identified as a "critical" issue that 23,344 voters had their ballots mailed to old addresses. The county responded there were numerous legal reasons for this, including that the voter served in the military, had recently moved but not yet updated their driver license address, or had requested a one-time temporary address. The auditors used a commercial database system to compare addresses, saying they found voters who had moved out of state or died before they voted, though that database system is not always accurate and the auditors conceded it was not comprehensive.[129] The auditors said that "a number" of the 86,391 individuals they could not find in the database — which Trump characterized as "phantom voters" — "are in fact real people with a limited public record and commercial presence; but it is unclear how large that number is." Barry Burden, director of the Elections Research Center at the University of Wisconsin–Madison, said it was unclear how data were collected for the database.[131]

Election workers can make a duplicate of a ballot that tabulation machines reject due to damage. Cyber Ninjas said it counted 2,592 more duplicated ballots than had originally been sent for duplication. County officials said they were confident the duplication process was accurate, pointing to a court case that affirmed the process that was used.[129]

An edited version of the report, which stated: "The election should not be certified, and the reported results are not reliable", was spread by QAnon and The Gateway Pundit, the latter of which baselessly claimed that the Arizona State Senate had pressured for the above line to be removed. Cyber Ninjas CEO Doug Logan has said that this edited report "is a false version" of the audit report, and that the notion that the Arizona State Senate had issued threats to suppress the edited report was "absolutely false".[132][133] Arizona State Senate audit liaison Randy Pullen, a former chairman of the Arizona Republican Party, also stated that the edited report was "a fake document", and further said that "there was never a discussion about decertifying" the election.[134] During an October 2021 podcast where conservative activist Joe Oltmann was interviewing Doug Logan, Oltmann admitted to being the person who released the edited version of the report.[135][136]