DESPITE CHANGING ELECTION EQUIPMENT VENDORS, A LARGE NUMBER OF ELECTION PROBLEMS

REMAIN IN WILLIAMSON COUNTY ELECTIONS. DON’T SWEEP THEM UNDER THE RUG.

“While Tennessee’s (election) system operates extremely well, we should not be afraid to admit where
there’s (a problem) identified and we should aggressively solve the problem.”
-Senate Finance Committee Chairman Bo Watson to
Tre Hargett & Mark Goins, February 15, 2022

Executive Summary
Even with the removal of Dominion Voting System from Williamson County, there are still process and
technology problems that we have long argued need to be addressed before the next election in May
2022. We want to ensure that in replacing the Dominion machines, these problems don’t get swept
under the rug.

1. Machines running unknown software: Why were 19 of 20 tabulators used during the October
26th election running different software than the version demonstrated to candidates during the
September 28th inspection? Secretary of State Tre Hargett didn’t say in his recent letter to the
Williamson County Election Commission recommending Williamson County remove Dominion
machines.

2. Chain-of-custody documentation for the unsealed scanner at the audit: We’ve yet to get the
chain-of-custody document for this scanner seen at the October 27, 2021 audit even after
numerous requests. Does one even exist? If not, that’s a grave concern.

3. A ruling on TCA ~2-8-108: Does this law apply to the retention of electronic artifacts as it does
to paper artifacts? We’ve been waiting for an answer since September 2021 when the
Williamson County Election Commission said it doesn’t retain electronic election artifacts.

4. Will the Dominion Results Tally & Reporting’s (RTR) ability to mass change votes downstream
from the precinct be repeated in the new ES&S system? Why was this issue never touched
when we brought it up multiple times and will it be found in the new system? How can you
affirm that it’s not? We’ll be studying the new system.

5. Poor quality of election officer reconciliation reports: Multiple, blatant, serious errors and
discrepancies appear throughout poll officer reports from the October 26th election. And they
were signed off on by election officials, with no explanation recorded about the mistakes. Is this
how Williamson County now fills out official election documents that back up the electronics? If
so, then our elections are at great risk.

6. Technological and Process issues found in Williamson County’s 2020 election: Twenty-three
issues that we tracked from our research into the 2020 election have never been acknowledged
or addressed by the Williamson County Election Commission. Can they do that now?

7. Were October 1, 2021 letters from all election vendors to Mark Goins saying their machines
didn’t contain a modem a de facto recertification of the machines as the State Election
 2

Commission promised? The Williamson County Election Commission made the recertification
request to the State Election Commission. Since Goins is not answering the question, the WCEC
has the power to ask. Will they?

8. What is the status of the need for poll workers: More people are telling us they signed up last
year to serve as a poll worker and were never called. Our group’s founder did so, as well… and
was never asked to serve. Yet, we hear from the WCEC that they are desperate for more
workers. What gives?

The specifics behind these questions

1. Machines running unknown software: Tre Hargett’s letter of February 16, 2022 did not explain
the reason why 19 of 20 tabulators used during the October 26, 2021 election were running a
different software than the version demonstrated to candidates during machine inspection
September 28, 2021. Why did this occur and what will be done to prevent it from occurring
again?

2. Chain-of-custody documentation for the unsealed scanner at the audit: This is definitely a
document we should have received as part of our open records request. Yet we’ve never been
shown by either the WCEC or the Secretary of State the chain-of-custody for this issue which we
affirmed several times with a photo from the day of the audit before the audit began.

During the October 27th audit that followed the October 26th election when Dominion machines
stopped counting votes, one of the Dominion scanner bins (we believe it was from early voting
or absentee voting) lined up next to the eastern wall at the Williamson County Ag Center where
the audit was to be held did not have a security tag. It is identified in the photo below by the
red box below the bin.

We need to see the chain of custody document that proves there was a tag on that scanner bin
at that time, which would have been 1 p.m. on October 27, 2021. The security tag is meant to
prove that the bin had not been opened since it was closed on election night. If an open records
request doesn’t produce an explanation for this, we must assume that this chain-of-custody
doesn’t exist. Which is a problem pointing to poor election performance by the WCEC. So how
will it be resolved?
 3

3. A ruling on TCA ~2-8-108: According to TCA ~ 2-8-108, all local election artifacts are to be kept
for six months and federal election artifacts kept for 22 months after an election. But during our
September 28, 2021 inspection of Williamson County election machines on behalf of four
Alderman candidates, the Election Administrator said that he was unsure if the statue meant
that BOTH paper and electronic election artifacts are to be retained. He affirmed they kept
paper artifacts but not electronic artifacts, which seems to contradict the law. (We assume the
law covers all DREs which are totally electronic and retain inside all votes in the election. So, it
would see that those counties would be retaining electronic election artifacts under the law.)
We need to see documentation or an interpretation of the law that better delineates if
electronic artifacts are to be kept just as paper artifacts are to be kept per the law. And what
those electronic artifacts might include. The Secretary of State’s legal counsel could simply ask
his staff to make a ruling in concert with the General Assembly, but he won’t do that. Why?

4. Will the Dominion RTR’s ability to mass change votes be repeated in the new system? Here is
the issue as affirmed by a member of our group, a retired Fortune 500 CIO, and explained in a
number of presentations and documents given to election officials locally and at the state level:

a. After reviewing the most recent version of the User’s Manual Ver. 5.5.139 for the Dominion
RTR (Results Tally and Reporting) Module, a copy sent to us by WCEC Elections
Administrator Chad Gray, we still see the concerns expressed when reviewing the earlier
version of the manual months ago and expressed in our presentations. We believe this
opens opportunities for nefarious actions on the part of bad actors if not addressed
immediately.
b. The following features are documented in the Dominion Result Tally and Reporting (RTR)
system. Section and Figure references are from the Dominion RTR User Manual Ver.
5.5.139.
i. The RTR system allows for mass changing of votes by deleting results entered
(Section 9.3 & 9.4) from secure removable media cards (results physically
transported from precinct scanners) and replacing them with data from a local file
(Section 7.4) or NAS (indicating some form of network is supported) attached files
(Section 7.5) or by manual entry (Section 9.2). No dual-party authentication or
oversight of the operator is required to perform these actions. A log entry is made,
but we have confirmed at least in our county that this log file is not audited as part
of the election certification.
ii. The RTR can publish reports to “Public” transfer points (Figure 65, Section 13.3),
both “Local and Global” apparently including FTP sites (Figure 66), inferring that at
least an indirect connection to the internet is supported.
iii. In addition, “RTR has exposed services through which remote clients can
communicate with the server…” (Section 14.4). Also inferring a network connection
beyond the local area network is possible. These client connections are logged in
the RTM logs. If this log is not being audited prior to election certification, it should
be.
c. As a retired Fortune 500 CIO with years of experience in application development and
security, the capabilities above in a desktop application used to tally voting results seem
exceptionally risky and don’t affirm a devotion to election integrity. If, in fact, a system that
 4

can make mass changes to consolidated votes is in any way attached to the internet or can
be remotely accessed, this appears to be a critical flaw in the system design and integrity.
Even notwithstanding the network access, we have confirmed that in Williamson County, a
single trusted individual has the ability to make massive vote changes locally in the RTR with
no dual-party oversight or 3rd party witness. We believe that nothing short of a ballot
polling RLA would have caught such an action with the current practices.

Now that ES&S has replaced the Dominion system, we worry about the new system containing the
same vulnerability as the old. Can you affirm that such is not the case and, also, tell us the exact
number(s) of the full, complete ES&S system we will be using so we may study it?

5. Poor quality of election officer reconciliation reports: Our group uncovered multiple, blatant,
serious errors and discrepancies in election officer reconciliation reports that were signed off on
by the election officials at the October 26, 2021 Franklin Alderman election, with no explanation
recorded about the mistakes. As we understand it, these are official election documents that
back up on paper the performance of electronics and should be easily readable, understandable
and mathematically and factually correct. These are to help officials reconstruct the election
should all electronics go bad or be hacked.

But that wouldn’t be possible given the state of the October 26th documents as seen from our
two open records requests of WCEC. So, in essence, we’ll play the role of an auditor in the
following review of these reports.

Election day machine certification forms (AM & PM reports). The first form (next page) for the
opening of the precinct appears to have been filled out correctly. Scanner serial #s, ballot
marking device (BMD) serial #s, protective count on the scanners noted and zero votes scanned.
All correct.

The second form (next page) for the closing, the same. BMD serial #, scanner serial #s,
protective count which now has increased by 178 votes. The poll official got that number by
subtracting the 11,196 on the opening form’s protective count from 11,374 on the closing
form’s protective count. 178 votes. Correctly done and signed off.
 5

Total vote count for the precinct: 178 from scanner #1 plus 180 from scanner #2 yields 358 total votes
for the precinct.
 6

The other form tracking BMD ballots and the spoiled ballot count (below) -- this one from another
precinct -- is also correct. While it would be good for there to be a fourth column to the right for the
poll official to total the number of votes per BMD, at least the counter numbers are there to affirm how
the total votes were arrived at.

• But on what form are applications-to-vote tracked?

• We weren’t shown that form in our open records request.
• According to TCA 2-7-114(c)(2), when a ballot stub number for citizen vote confirmation is not on
the ballot (the current ballot does not contain a stub number), the WCEC must reconcile the number
of applications to vote issued in the polling place with the number of ballots recorded by the optical
scanner. And when these numbers differ, the WCEC is supposed to issue a written report explaining
the difference. Where is that reconciliation and report?

Next page: An overview chart showing the numerical discrepancies throughout all the eight voting
centers in the October 26, 2021 election. Yellow indicates a disagreement.
• The protective count start and finish show the numbers as tracked by the poll officer.
• The scanner votes scanned is the number of ballots scanned per the counts on the scanners.
• The Poll Officer Report votes scanned shows what numbers the poll officer notated as being
scanned by the machines. Yes, most all of the numbers in this column differ from the numbers
shown on the scanner, with no explanation for the difference.
• The BMD ballot print/cast is the total of ballots cast by the BMDs per the poll officer form.
• The Registration/Application to Vote/Spoil column shows the number of applications to vote,
which, in absence of a specific form for that, is the same number as the BMD scanned number.
This is how the Davidson County Election Commission counted applications in absence of an
applications report. The number of spoiled ballots is deducted from the BMD number.
 7

City of Franklin Alderman Election (October 26, 2021)

Election Day Poll Officers Report of Vote Tally by Machine
Voting Locations Election Day
In Franklin Protective Count (3) Scanner Poll Off Rpt (2) BMD (1) Registration
Legacy Start Finish Votes Scanned Votes Scanned Ballots Print/Cast App to Vote (Spoil)
Voting Machine #1 3071 5457 2386 79 331 (1) Finish count down?
Voting Machine #2 5294 3243 -2051 19 5 vote overcount?
Totals 335 98 330 330 Poll Official's scan count
off by 232?
Cool Springs Start Finish Votes Scanned Votes Scanned Ballots Print/Cast App to Vote (Spoil)
Voting Machine #1 11196 11374 178 178 0 (0) Zero applications?
Voting Machine #2 254 434 180 180 Didn't use official form
Totals 358 358 358 0 "Lifetime" #s???

Hunters Bend Start Finish Votes Scanned Votes Scanned Ballots Print/Cast App to Vote (Spoil)
Voting Machine #1 5809 6059 250 479 617 (1) 10 vote overcount?
Voting Machine #2 5575 5951 376 137 Poll Official's scan count
Totals 626 616 616 616 tally match machine?

Pearre Creek Start Finish Votes Scanned Votes Scanned Ballots Print/Cast App to Vote (Spoil)
Voting Machine #1 7457 7677 220 215 763 10 vote overcount?
Voting Machine #2 3896 4449 553 548 Poll Official's scan count
Totals 773 763 763 763 tally match machine?

First Presbyterian Start Finish Votes Scanned Votes Scanned Ballots Print/Cast App to Vote (Spoil)
Voting Machine #1 5923 0 0 0 0 349 (1) No finish count?
Voting Machine #2 7975 0 0 348
Totals 0 348 348 348

Senior Enrichment Start Finish Votes Scanned Votes Scanned Ballots Print/Cast App to Vote (Spoil)
Voting Machine #1 441 653 212 207 467 (0) 10 vote overcount?
Voting Machine #2 3702 3967 265 260 Poll Official's scan count
Totals 477 467 467 467 tally match machine?

Church of the City Start Finish Votes Scanned Votes Scanned Ballots Print/Cast App to Vote (Spoil)
Voting Machine #1 4959 4484 -475 200 717 (0) Finish count down?
Voting Machine #2 4279 5481 1202 72 10 vote overcount?
Totals 727 272 717 717 Poll Official's scan count
tally match machine?
Franklin Christian Start Finish Votes Scanned Votes Scanned Ballots Print/Cast App to Vote (Spoil)
Voting Machine #1 6043 5344 -699 5583 397 (1) Finish count down?
Voting Machine #2 5339 6048 709 6205 Only 10 votes scanned?
Totals 10 11788 396 396 Poll Official's scan count
tally match machine?
Total Votes per Section 3306 14,710 3995 3637
-331 11,073 358 45+ vote overcount?
Key
Step #1 (Registration) = Applications to vote occurs when first entering precinct ("Ballots cast" always equal "vote app" minus spoiled ballots).
Step #2 (BMD) = Candidates selected on the BMD by voter and BMD prints out/cast the ballot.
Step #3 (Scanner) = Ballot scanned by the scanner/tabulator and counted/tallied.
"Scanner votes scanned" from "Election Day Machine Certification Report" each vote center.
Poll Officer Report "votes scanned" from "Total Votes Scanned" on "Election Day Machine Certification Report" each vote center.
 8

"Ballots Printed/Cast" and "Spoiled Ballots" # from "Election Day ICX/Spoiled Ballot Count Report each vote center.
These Reports are Official WCEC Election Documents that tell election officials what occurred numerically and document the election's results.
Some votes never made it to scanner, yet not spoiled? Key items left blank; officer created own form omitting key data.
Do they not track apps-to-vote? Protective counts switched or machine errors? Did they call for help and what actually happened in vote centers?
Demonstrates poll officers were useless and don't know how to run a precinct; training must be abysmal.

The columns on this Excel chart (above) compile all of the issues on one page from top to bottom. The
key at the bottom provides the explanation of the chart’s data sources.

• Legacy Middle School (where one Dominion machine stopped counting)

o The finish count of votes on machine #2 decreases? How is that possible?
o The cumulative and individual numbers on the two scanners don’t match.
o The total and individual votes scanned from poll officer’s report don’t match.
o None of the numbers match the number of ballots generated by the BMD.
o There appears to be five missing ballots? (335 scanner count; 330 BMD count)
▪ Were some of these test ballots? If so, they should be accounted for.
• Cool Springs Conference Center
o Numbers are correct and agree, but zero applications?
o Severe problems on the BMD/Spoiled ballot report that you’ll see in a minute.
• Hunters Bend School
o Total votes scanned don’t match poll officer’s report or BMD/application counts.
o There appears to be ten missing ballots?
• Pearre Creak School
o Total votes scanned don’t match poll officer’s report, BMD count or application count.
o There appears to be ten missing ballots here too.
• First Presbyterian Church
o There were no finishing protective counts listed, so no way to verify # votes scanned.
o So, we therefore don’t know if the poll officer’s numbers are correct.
o Although no numbers supplied by officer, without scanner, do numbers match. Sure?
• Senior Enrichment Center
o Total votes scanned don’t match poll officer report, BMD count or application count.
o There appears to be ten missing ballots here as well.
• Church of the City (another precinct with a scanner that stopped counting)
o The finish count of votes on machine #1 decreases?
o The votes scanned per machine count is signifantly different than poll officer’s count.
o The votes scanned count is ten votes different from the poll officer’s and BMD counts.
• Franklin Christian Church (the third precinct with a scanner that stopped counting)
o The finish count of votes on machine #1 decreases?
o The poll officer’s count of votes scanned is impossible to understand.
o It indicates there were 14,710 voters that came through the precinct. Is that possible?
o The votes scanned per scanner number, poll officer’s report of votes and ballot number
printed are all completely – and wildly – off.

Compare these numbers to the totals that were posted online by WCEC for the election:
 9

City of Franklin Alderman Election (October 26, 2021)

Comparison Vote Final Totals By Source

Per Per scanner vote Per Poll Officials’ Per Poll Official’s Per Poll Official’s
Official WCEC numbers according Report BMD/Ballot Registration
Report on WCEC to protective count Print/Cast Applications
website on machines Report Report

Election Day 3,995 3,306 14,710 3,995 3,637

Early Voting 3,397

Total 7,392

• The scanners that tabulated the votes: 3,306 ballots counted.

• The official WCEC count: 3,995.
• Where did the extra 689 votes come from? Absentee votes?
• If so, then where is the document that we requested that might show 689 absentee ballots?
• Why doesn’t the 3,995 balance with the number of registrations that were reported (difference of
358) or the number of votes per the poll official’s official report (difference of 10,715)?
• There is a separate form for scanner votes, for BMD votes and for early voting votes. Where are
absentee votes tracked anywhere?

Here, beginning on the next page, are a few of the official forms where these problems are
demonstrated.
 10

• The protective count on scanner #2 goes down?

• Yet 19 votes were recorded?
• No report of the Dominion scanners that stopped counting votes here. Why?
 11

Opening and closing of First Presbyterian Church.

• No end-of-day protective count? So, how are we sure of 348 votes were on scanner #2?
• How are we sure of 0 votes on scanner #1?
 12

Church of the City opening and closing.

• The scanner #1 protective count went down a minus 475 votes yet 200 votes were counted?
• And these discrepancies can’t be attributed to the glitching machines… too convenient.
• There was no report of the scanner shut-down issue in this voting center. Why?
 13

• The poll officer’s BMD/Spoiled Ballot report for the precinct says there were 272 total ballots
counted on the BMD, yet on this form they reported a BMD count of 717.
• We know the machine stopped counting and that could explain the differences, but there was no
attempt to explain in the notes section what might have happened or what the poll officers saw.
• Or no attempt to document there was even a problem.
 14

But then the most baffling forms come from Franklin Christian Church.

• The protective count on scanner #1 goes down 699 votes, but the total votes scanned on this
machine in their report is 5,583?
• And the total votes scanned on scanner #2 per the report is 6,205? For a total number of votes in
the precinct of 11,788?
• Did anyone think about the number they were writing down for voter through-put?
 15

• This makes no sense whatsoever.

• How can you even trust this poll officer’s report?
• Add the two scanners together on the protective count and you get 10 votes.
• So, what numbers did the WCEC use to calculate the total number of votes in the precinct?
• Where is that shown and explained? We don’t know from the forms.
• The vote differences and the fact that there were glitching scanners in the precinct aren’t explained
either.
• How can you look at this form and say “Here’s what happened in this precinct on election day?”

Then there are the BMD/spoiled ballot count forms. Here’s the official form (next page) from the Cool
Springs Conference Center.
 16

• Yes, these are the official forms we were shown. Why was the official form not filled out?
• How can you accept this form as an official report? Do we know what went on in the precinct?
• Why did you not have them transfer their numbers to the form and fill in the missing information?
• Where are the signatures of poll officials witnessing this form and its information?
• Incredibly poor performance by these officers.
 17

It wasn’t a lot better for early voting.

• Why was the serial number of BMD #3 BMD missing on all early voting report forms going forward,
yet all reports have credited votes to it. Was this a mistake or an intent?
• In fact, beginning with the October 11th report, no serial numbers were written down for ANY BMD
on any forms from that point on.
• So, how do we know that BMDs weren’t changed in and out during early voting? We don’t.
• Who is signing off on this work?
 18

Here (below) is an early voting BMD/Spoiled count form for October 15, 2021.

• The 222 total for BMD ballots is correct, but look at what was written for the total ballots cast. 216?
• Which number did the WCEC use when they tallied up the total, 222 or 216? We can’t be sure.
 19

More math issues from the early voting report, this one for October 20, 2021 (below).

• Since there are no public counter numbers from the BMD for the opening of the poll and closing of
the poll, we must assume the numbers written in the third column are correct.
• But they add up to 345, not 387 as is printed for the closing poll total.
• And if you subtract the 6 spoiled ballots from 387 you get 381, not 386.
• And a true closing total of 345, minus six, puts the total ballots cast at 339.
• What are the correct BMD numbers for this day’s vote?
• Which numbers should be used to get a running total of early votes?
• How did WCEC come to that conclusion?

Based on all of these forms, WHY SHOULD WE PLACE ANY CONFIDENCE IN ANY OF THESE OFFICIAL
FORMS? AND, THEREFORE, WHAT WENT ON WITH VOTING IN THE OCTOBER 26, 2021 ELECTION?

We depend upon these officials to accurately document the election in each precinct. Is that being done
here? What if the electronics, the thumb drive, as well as any other counts on other electronics in the
system were hacked or went bad? We’d have to depend upon these written documents to tell us what
happened and who rightfully won (which is their purpose since electronics have been proven to be
hackable/switchable/at times untrustworthy). Yes, it’s good that we can re-count. But if we have to
depend upon post-election hand re-count audits every time to affirm the winners – like we did in this
election – why do we even need electronic voting machines? Why don’t we just go to hand-marked
ballots on which to vote and post-election hand recounts to check the vote?

We need answers and a total commitment that this incredibly sloppy reporting will never be repeated
again! Because if this is what we see in writing, what is it that we DON’T see that’s occurring?
 20

6. Technological and Process issues found in Williamson County’s 2020 election: Twenty-three
issues that we tracked from our research into the 2020 election and presented on March 10,
2021 to WCEC officials have never been acknowledged or addressed. When officials didn’t
answer our questions, we turned them into recommendations based on best practices. But now
that we’ve moved to an ES&S lease, it is critical that citizens know the capabilities and securities
of the ES&S system. Answering these following questions and/or making necessary process
changes will be a good first step to ensure they’re not being swept under the rug and ignored.

Best Practice Solutions: Technological

Establish dedicated encrypted, physical network for voter roll/eligibility system. Voting Centers
require an Intranet connect to span multiple physical locations and ensure some voters don’t multiple
vote. Yes, Williamson County’s internet between voting centers is connected by a virtual private
network, but companies spending billions of dollars every year to highly protect their data are hacked
and the data stolen. VPNs are good but not infallible. Does Williamson County not care enough about
election security to protect citizens against a hack and an election manipulated? You must get rid of
voting centers and the internet connection that supports them and avoid the vulnerability.

Disk encryption must be verified. The Dominion promotional material states that Dell Full Disk
Encryption is utilized in the Democracy Suite, but a third-party forensic audit in Michigan said that the
Dominion disks were not encrypted. Will this be the same for the ES&S machinery? The implementation
of disk encryption must be verified. Will that be done?

Add a system log and alarm to warn of ethernet traffic, especially from outside the voting machine’s
network scope. The Dominion system has the capability for ethernet connections, but we’re told no
connection to the internet was intentionally in place to any of the connected devices. (We believe this
will be the same with ES&S.) A system log should be enabled in the operating system to record any
ethernet traffic and to alarm on any traffic that originates or has a destination IP outside of the voting
machine network’s scope. Will that be done?

No OS or hardware changes should be allowed that haven’t been approved, tested and certified at
least 90 days prior to an election. The Dominion manual provides instructions for the update of
scanner drivers; if requested by the OS, this is a significant vulnerability. Can you confirm and prove that
this is not the case with the ES&S system? No software changes should be allowed that have not been
specifically tested and certified for use. This is especially inappropriate for something as critical as a
scanner driver which is essentially the interface between the scanning of the ballot and the reporting of
scanning results to the election software. Security Certificates required for the function of the EMS
should be checked to ensure they are valid and will not expire during the election period and are issued
by a viable third-party provider. Upon receipt a random hardware audit should be performed (e.g.,
remove outer shell) to confirm no ethernet or other internet access cards are found on motherboards,
or otherwise clandestinely installed unless they have been physically and irreversibly disabled. Recent
letters to Mark Goins from the election vendors stating they don’t have a modem is not sufficient.
 21

Direct access to files within the system must be eliminated and logged if an Administrator accesses
them. Encryption should be at the application level whereby a computer user or admin cannot access
voting results from the operating system and thereby bypass the security of the voting software. It is
reported that Dominion’s current practice is to delete bad “batches” of votes that need to be rescanned
at the OS level in MS File Explorer leaving no trace of this activity in the application logs. Will this be the
case with ES&S? These files are apparently unprotected and available to any user in the C:\dvs\project\
folder of the Window’s C: drive. Direct access to the files must be eliminated and if Administrator access
occurs it must be logged. Will this be done?

Prior to – and after -- any day’s vote, a software verification hash to verify the proper software version
and integrity – as well as any modifications through the day -- should be run and documented. A
software verification hash should be run on each voting system to verify the proper software version
and integrity both before voting is commenced and to ensure no modifications occur during the voting
process it should be run again after the voting and reporting is completed. The Dominion manual only
appears to currently stipulate this during setup. What is the case with our ES&S machinery? Will this
step be implemented?

All application-specific passwords should be managed by the user and required to be changed on first
login to the system and changed on demand if it is believed they have been compromised.
Administrator and Supervisor accounts within the Democracy Suite software have significant
configuration privileges and their passwords are managed in the Election Event Designer. What is the
case with ES&S? Functionality should be provided that these application-specific passwords are
managed by the user and required to be changed on their first login to the system and be changed on
demand should the owner believe their password may have been compromised. The EMS should have
advanced user security where all actions are tracked within the system by a unique and individual login.
Broad user role-based security (e.g., only one or two levels of roles per software module) and one login
to multiple users should be prohibited. Will this be done?

All printed reports should come directly from the election software and not funneled through a third-
party process or platform. The procedure is specified in the Democracy Suite User Guide of running a
report to the screen, then “Select all of the data in the window and copy/paste it to Notepad” then “In
Notepad, print the content and save the report for audit purposes.” This was recommended as a zero
documentation prior to tabulating votes; a relatively critical step. This procedure neither ensures that
the printed data was not modified while in Notepad prior to being printed nor does it provide a reliable
log of the report for auditing. All printed reports should come directly from the Election Software and
not be funneled through a third-party process where integrity can be compromised. What is the case
with the ES&S system? Will this be implemented?

A log-in should be required for both dual-party poll workers and observers in all stages of election
processing. Dual party poll workers and observers were reported absent in some stages of the voting
procedure. It is the policy of some counties that dual party participants be present at some stages of
election processing such as ballot adjudication. It would be advisable that the system require a login
from both party workers in order to accomplish these processes. This is believed not to be currently
available in Dominion. What about with the ES&S system?
 22

Every voting system in use must provide all users with separate UIDs with forced password changes at
first login and security-minded password management. A shared and simplistic password was used by
Williamson County each day of early voting. This eliminates traceability to a user in the audit log and
presents the opportunity for off hours, inappropriate scanning to occur without being able to audit the
user associated with that login. The system must provide all users with separate UIDs with forced
password changes at first login and provide a well-designed password management. Does the ES&S
system do that? Will it be implemented?

Microsoft Winevt logs for applications should be enabled and security and system events set to
archive and not overwrite. Microsoft Winevt logs for applications and removable storage devices
should be enabled and security and system events set to archive and not overwrite. These files should
be reviewed at least on a statistically significant basis after the election with inappropriate findings
resulting in a hand recount. Will this be done?

Paper ballot QR codes should be unencrypted and able to be read by the voter to assure the ballot is
correctly reporting his/her ballot choices. QR barcodes are printed on the paper ballots in some of the
Dominion system ballots to facilitate scanning. We understand that in the ES&S system, bar codes are
used. The codes ostensibly contain the same voter selections as are printed on the ballot in open text.
But the QR codes are encrypted, frustrating any attempt to verify their content. Are the bar codes
encrypted? Notwithstanding any good reason for this, these bar codes should be required to be
unencrypted. Will they be?

The Dominion Results Tally and Reporting (RYR) system definitively allows for mass vote changing
downstream from the precinct. On September 7, 2021, following a deeper study of the Dominion
manuals, we sent the following question to Director of Elections Mark Goins for an answer. We asked
him to include this question in a list of questions we requested he seek answers to from Dominion:

Information we found in the latest manual implies the Dominion Results Tally and Reporting
(RTR) system allows for mass vote changing by deleting results previously entered from secure
removable media and replacing them with data from a local file… with no dual-party
authentication required. We’ve also seen that reports can be published to “Public” transfer
points inferring that there is at least an indirect connection to the internet. Additionally, it
seems that remote clients can communicate with the server through Dominion… again inferring
a network connection. Can you clarify this conclusion?

After submitting this mid-2021, we have heard nothing back either from Goins, the Secretary of State’s
office or Dominion. However, we have heard a frightening answer from the Williamson County Election
Commission employees.

In studying the RTR manual, it was plain that the system could allow mass vote changing by voiding
results previously entered from secure removable media from the vote tally and replacing them with
data from another file or by manual entry. This can be done by a single individual with access to the
system and with no dual-party authentication or other oversight required.
 23

Additionally, it appears that the RTR system can publish results to “Public” transfer points inferring that
the RTR system supports at least an indirect connection to the internet and therefore is exposed to
hacking. Finally, the manuals state that remote clients can communicate with the server … again
inferring a network connection. Williamson county has assured us that our RTR system is not used for
either of these purposes and is in no way connected to the internet.

In a meeting to inspect the voting machines for several Alderman candidates on September 28, 2021,
the individual in the Williamson County Elections office who manages the RTR was interviewed. They
indicated that they were, in fact, able to make such a change, but that they would never do so. While we
trust that this is true, we feel that the controls protecting against such an action are dangerously
inadequate.

We have identified two controls that may prevent such a manipulation from occurring undetected which
we understand are currently not in place. They are included in the recommendations our team is
making for a best practices pilot in Williamson County:
• A parallel hand tally of voting center, precinct early voting and absentee voting totals confirmed to
match the numbers published by the state for our county; and
• A mandatory audit of the RTR/RTM log files, prior to certifying election results. (As an aside,
Dominion performed a software update on our system in January ’21, it has been reported from
other locations that this upgrade writes over the digital log files that would have been written for
the 2020 general election. Williamson county currently considers only paper records as election
artifacts that must be retained for 22 months after an election. As a result of our queries, they are
now asking for clarification as to whether digital records must also be retained.)

So, it appears that thousands of votes could be switched, and the vote totals changed by nefarious
actors hacking into the RTR system which is designed to allow connection to the internet. What is the
case with the EMS system on the new ES&S voting system?

Best Practice Solutions: Process

Include IT/data/cyber security/process control professionals in review committee. The evaluation

team should include IT, data, cyber security professionals, as well as industrial/process engineering skills
in the evaluation and decision making. The team can also include lay person members including
functional experts in the election processes who can act as the liaison between the end user and the
technical engineers. The findings should be transparent and published for other states to utilize should
they desire. This seems like a reasonable committee to set up, beyond the simple IT technicians you
currently use. Why can’t this be done?

County election officials must ensure sufficient training resources for volunteers to staff and operate
the election fully, without the involvement of the machine/software vendor. The State Election
Commission should consider the value of providing or approving training resources for each of the
approved systems that can be utilized by the counties rather than having each county duplicate this
effort with more limited resources. The training should be consistent and thorough so that no employee
or contractor of the voting machine vendor is needed to run or manage a portion of the voting and
 24

counting process on or around election day. From witnessing parts of Williamson County’s election
process, we don’t think this is happening as a Dominion employee appeared to be the only employee
able to run the absentee voting ballot processing. When the employee was called away to address
other technology issues elsewhere, processing in this area ground to a complete halt for three hours.
This is unacceptable. Will you commit to doing this?

Require dual party poll workers at key steps. Dual-party poll workers or observers should be allowed,
or, better, required, at critical portions of the process, specifically including:
• Opening of a tabulation procedure;
• Closing of a tabulation procedure;
• Discarding a batch of ballots;
• Reopening a Poll ID for additional ballots;
• The printing of Start, interval and ending status reports; and
• The adjudication of ballots.
We don’t believe this is being done. It needs to be. And we know you have an abundance of citizens
who are stepping forward willing to be poll workers but you don’t seem to be using them. This needs to
change as an election is the most critical aspect of our Republic.

Protections to ensure ease for dual party observers. In areas of the process where dual party observers
are allowed a view of the activity, they must be given an unobstructed view equivalent to those
preforming the process. This was evident when citizens during the October 27, 2021 audit had to fight a
bit to get ballot counting tables rearranged so watchers could more closely watch and hear the process
at each table. Pictures and video should be allowed throughout the process with the sole exceptions of
where a voter’s identity and their ballots selections can be connected and where security passwords are
entered into voting systems. There should be severe penalties when views of the process for duly
appointed observers are prevented.

Place cameras in polling/precinct/ballot processing areas to publicly stream video of activity to

increase transparency. Cameras should be placed in polling/precinct/ballot county/election processing
areas for public viewing of these activities. Just not in a way that can connect a voter’s identity and
ballot selections. If a citizen can secure his home with a few cameras and an inexpensive security
program, precincts and ballot counting areas should be able to easily, and affordably, be transparent
and allow the public to witness activities in these areas.

Formally specify and document the criteria and process for archiving voting artifacts. The level of
securing the archives of voting artifacts and the criteria and process for access to these archives should
be formally specified. Prior to a “live” election period, all Election Event Design, Adjudication, and any
other administrative software settings should be captured and “locked.” A GUI and database
(presumably where these settings are stored and then displayed by the GUI) snapshot should be
produced, archived, and secured. This should create a “certified” election settings artifact. If any
changes need to be made, dual observers should be present to review the specific settings, ensure the
implemented change functions as expected, and then a secondary certified election settings artifact
created. These should be maintained for 22 months.
 25

Require a printed zero report as well as status reports at the beginning and end of each working
period, in front of dual observers and retained for the appropriate retention period in a physically
secure location. Dominion “recommends” in their manual that the printed zero report (ensures no
votes are present in the system at the beginning of tabulations) be kept in a physically secure location
for a period of at least 22 months. Is this the case with ES&S? This should be required and, in addition,
such status reports should be produced and secured at the beginning and end of each working period at
a time when dual observers arrive and depart from the operations. They should also be made public
and available to citizens post-election to further increase transparency.

Independent validation of accurate transfer of votes to next level of consolidation. A dual-party

validation should occur and be documented at each voting jurisdiction whereby local vote tallies are
verified through a separate means than the original reporting against a read-only access to the tallies
that were attributed to them in the consolidated location. Failure to pass and document this validation
should be cause for a reconsolidation. We suspect this may be being done, but are not sure. Can you
confirm?

Appropriate chain of custody is a must and should be audited prior to certification of vote. Questions
have arisen regarding adequate chain of custody and documentation in Williamson County in
transmission and consolidation of votes from polling locations to the county and ultimately the state
and national levels. There has been one example where a chain-of-custody report on a scanner seal
may be missing because election officials have refused to provide it after multiple open records
requests. (The scanner in question contained ballots to be counted in an October 27th recount, yet did
not visibly contain a protective seal as all of the other scanners did and was shown in a provided photo.)
A verification of the chains of custody should be audited prior to certification of the vote. Failure to pass
and document this validation should be cause for a reconsolidation. We need an answer on this one
scanner and a commitment that chains of custody will be maintained in future elections.

Standard operating procedures and process charts should be developed for every voting process to
ensure concise, consistent communications leading to a high quality, highly trustworthy election
result by a disparate team of volunteers and workers. When any manufacturer wants to ensure
consistent, systematic quality in every single product or piece of a product that it manufactures, it
implements standard operating procedures and process charts. Our group has continually requested a
process sheet for provisional ballots since that was suggested by both the WCEC Chairman and Election
Administrator as a possible cause of the six Dominion machines that stopped counting in the October
26, 2021 election.

Standard operating procedures and process charts are step-by-step instructions detailing how a process
should proceed by either one person or multiple persons to ensure the outcome is consistently the
same, regardless who performs it or how long it takes to perform it. These “blueprints” are a manual
that involves detailed procedures of tasks so that anyone who enters a process can execute it fully and
effectively simply by following the steps on the sheet so that the finished outcome/product from the
complete manufacturing team is of high, consistent quality.

In the case of voting, the “manufacturing process” includes all of the steps that all of the volunteers
working the election need to take to ensure their particular portion of the process is completed with
 26

high integrity. Whether they work the set-up, maintenance and security of the voting equipment, the
registration process, the voting process or the counting/reporting process, each person must follow a
precise step-by-step course to ensure the highest quality, consistent outcome.

This is especially critical in an election as a majority of individuals working elections are dissimilar
volunteers and the results of a trustworthy, accurate, transparent election are critical… with everyone
being counted on to do precisely the right thing.

Despite our requests to see them, to our knowledge, detailed process charts and standard operating
procedures do not exist for any of the procedures that are necessary in elections in Williamson County.
We are aware there is some type of training process, but we’ve not been privy to that information. This
means people working the election might cavalierly freelance their way through their jobs in the various
precincts or stages of processing the votes if not shown precisely what they need to do and how they
need to do it. Meaning outcomes might be unduly erratic or untrustworthy.

We also strongly suggest that an overall Process Flow Diagram tracing the actual "vote" that lays out its
chain of custody is paramount to ensure a robust system. Secondly, standard operating procedures and
process charts should be developed by a process engineer to ensure that communications of all duties
to all workers in all elections in Williamson County is clear, consistent, effective, leading to a high
quality, highly trustworthy election result by a disparate team of workers.

7. Were October 1, 2021 letters from all election vendors to Mark Goins saying their machines
didn’t contain a modem a de facto recertification of the machines as the State Election
Commission promised? Your commission made the recertification request. You CAN find out.

In their April 5, 2021 meeting, the Tennessee State Election Commission stated it would perform
a recertification on all five brands of election equipment used throughout the state of
Tennessee. This was done in reaction to a January 11, 2021 letter from Chad Gray requesting
the recertification of the Dominion machines following issues in the 2020 Williamson County
election.

There has been no stated recertification action by the SEC on this since it was deferred from
their October 11, 2021 meeting. However, minutes from that meeting that were finally posted
in early 2022 contain six unannounced attached letters from the five voting machine brands
stating there are no modems in their machinery. That came in reaction to a September 28, 2021
memo from Mark Goins requesting this verification from vendors.

On February 4, 2022, we sent a note to Goins, Hargett and the State Election Commission asking
if this was, in essence, the extent of a recertification. As usual, there has been no answer from
any of the three. But, as a bona fide election commission of the state which answers to the
State Election Commission, you can obtain an honest answer to this question. Will you do that
please?
 27

8. What is the status of the need for poll workers: More people are telling us they signed up last
year to serve as a poll worker and were never called? Our founder did so as well… and was
never asked to serve. Yet, we hear from the WCEC that they are desperate for more workers.
What gives?

###