Cyber Ninjas:

Withheld Devices and Data:

-Routers and Network related data

-Poll worker laptops

-ICX Devices

-ICP Credentials to validate configuration settings or Administrative Settings

-Other devices connected to election network

–192.168.100.1

–192.168.100.11

Cyber Ninjas: I can not sit here today and tell you whether or not the wireless modems were enabled and connected to the internet at the time of the vote. I can not sit here and tell you today the status of the land connections we know were inherent to those devices as part of the lease from Dominion.

Cyber Ninjas: EAC Certification Defense is NOT valid in view of the evidence:

• 4 .exe files crested after Dominion Software install

• 45 .exe files modified after Dominion Software install

• 377 .dll files created after Dominion Software install

• 1053 .dll files modified after Dominion Software install

Cyber Ninjas: Second hard drive contained non-Maricopa County data

Cyber Ninjas: 865 directories and 85,673 election related files [scanned ballots, .dvd files, slog.txt files, etc] deleted between 10/28/20 and 11/05/20

Cyber Ninjas: 9,571 directories and 1,064,746 election related files were deleted between 11/01/20 and 3/16/21.

Cyber Ninjas: 1,016 directories and 196,463 files containing election data deleted from the HiPro Scanner 3 on March 3rd, 2021.

Cyber Ninjas: Clear intentional overwriting of Security Logs by the EMSADMIN Account.

Cyber Ninjas: Security Logs set to maintain 20MB of data.

Cyber Ninjas: Someone went into the program, and clicked on something that said 'I want to purge all the results for this election'….the day before an audit started.

Cyber Ninjas: Atypical anonymous logins were discovered.

Cyber Ninjas:

• 59 Ports were open on the EMS Server at boot

-Unexpected High Port Listening Activity by Standard Windows Process

-IPV6 Enabled

-Terminal Services are Enabled

-Remote Access is Enabled

Cyber Ninjas: I would request from Maricopa County the documentation from those functions that rely on those connections. [EMS Network Connections]

Cyber Ninjas:

-Both Mariciopa audits did not find any internet history

-Significant internet history recovered from unallocated space

–EMS Server

–EMS Client Workstations

–REWEB 1601

–REGIS 1202

Cyber Ninjas: At some point in time, this device was connected to the internet…there is also a connection to the purging of the database..almost the same time exactly.

Cyber Ninjas: EMSADMIN1 account was used to access,what I can only surmise was a wireless land configurator.