You are using an outdated browser.
Please upgrade your browser
and improve your visit to our site.

Meet the Trio Who May Have Figured Out How to Save American Democracy

Three retired election auditors in Arizona foiled the Cyber Ninjas scam—and may have created a template for how to protect elections in 2022 and 2024.

A contractor working for Cyber Ninjas
Courtney Pedroza/Getty Images
A contractor working for Cyber Ninjas, which was hired by the Arizona Senate to recount ballots from the 2020 general election, waves a piece of paper at Phoenix’s Veterans Memorial Coliseum on May 1.

Since the 2020 election, Donald Trump and his allies have produced no evidence that Joe Biden’s victory was illegitimate despite their dozens of failed lawsuits, shrill propaganda, and bad-faith postelection reviews. But Trump’s party has shown no reluctance to revise the rules of voting to advantage Republicans before 2022’s midterms and 2024’s presidential election.

Led by battleground state legislators, the Trumpers have rewritten voting laws, threatened election administrators, begun purges of county election boards, created new gerrymanders, and more. The worst of these power grabs limit access to a ballot, which is the starting line of voting, for anti-Trump blocs and would disqualify ballots and nullify votes before the finish line.

This playbook is not new. But modern voting systems, from voter registration to tallying paper ballots, contain numerous stages and respective data sets, many of which are public records and are quite detailed. If smartly used after Election Day, these records could provide an easily understood evidence trail that would make it much harder for the Trump faction to proclaim victory prematurely or falsely.

There are formidable obstacles, though—not just to accessing and parsing the data but to getting election professionals and opinion leaders on board. In recent years, their top priority has been countering cybersecurity threats from abroad, not countering domestic disinformation so that average voters, not election insiders, can see and trust what lies behind high-stakes results.

Using public election records to debunk stolen election lies and confront propagandists is not a “fool’s game,” as a New York Times editorial board member recently opined—arguing that “the professional vote-fraud crusaders are not in the fact business.” The template of debunking and confronting election-theft lies is the largely untold story of what happened in Arizona in 2021, where Trumpers ultimately were forced to admit that Biden won, a process
I witnessed.

Trump’s agents were plotting to fabricate a favorable vote count. But they were stymied by their vast inexperience in elections. As important, they were boxed in at key junctures by three retired election technologists who used public records to hold them accountable. The trio warned the pro-Trump contractors and their legislative sponsors that their “audit” was being watched, repeatedly reported why it was a propaganda-filled hoax, and gradually won local and national press coverage.

Most strikingly, it was the technologists—not Arizona’s Democratic Secretary of State Katie Hobbs, nor Democratic Party lawyers, experts in policy circles and academia, or journalists—who showed that tens of thousands of loyal Republican voters from Phoenix’s suburbs did not vote for Trump. That pattern alone, based on hard data, confirmed his loss in Arizona.

The retirees did more. They rebutted the lie from Trump’s noisemakers that tens of thousands of dead people and made-up people voted, by pairing every ballot cast with a legal voter. They showed that there was no collusion to alter vote counts when local election officials reviewed sloppily marked ballots to determine a voter’s intent, again using public data that tracked the officials’ actions.

And months after Arizona Senate Republicans hired the Cyber Ninjas, a data security firm led by a Trump cultist with no experience in elections, to oversee its 2020 election review in Maricopa County (greater Phoenix), the retirees boxed the Ninjas into revealing that they could not accurately recount votes—again using public records. That strategy culminated last September, when Cyber Ninja CEO Doug Logan testified that Biden had won Arizona, after all.

“We seriously doubt anyone involved in initiating or supporting this activity ever imagined that three retired citizens with knowledge of elections, election law, administration and procedures, election system design and operation, and data analysis skills could hold [Cyber Ninjas] to account and demonstrate convincingly that their announced results were meaningless,” said Benny White, a retired pilot with a law degree and longtime Arizona Republican (yes, Republican!) Party data analyst. “They also never anticipated that their entire effort could be dismantled by referring to available public records and without spending a penny.”

During an October webcast by an MIT-based election science working group, Larry Moore, the founder and former CEO of Clear Ballot Group, a federally certified election auditing firm, a Democrat, and the second member of the trio, said, “Benny and I have talked many times about, if we knew back in November [2020] what we know now, and we had that information that Trump lost because Republicans voted against him, [whether] that could have changed the [Big Lie’s] narrative, or slowed the narrative down.”

Moore continued: “Right now, as Bob Anglen, who is the writer of the Arizona Republic’s piece [on their analysis that the Ninjas miscounted more than 300,000 ballots], said, ‘You know what we’re not hearing? We’re hearing nothing from the right against your findings. They are that solid.’ I think by analyzing this hard data, and coupling it with ballot-image analysis, we have a shot at very quickly debunking with real hard evidence these allegations that will inevitably be made.”

The trio’s third member was Tim Halvorsen, Clear Ballot’s former chief technology officer and an independent.

How “the Audit Guys” Got Started

Last winter, as pro-Trump state legislators began clamoring for “forensic audits”—a made-up term that has no relation to any established election audit—White, Moore, and Halvorsen, who came to call themselves “the Audit Guys,” decided to direct their experience toward a simple goal: to use public election records, which are the building blocks of voter lists and vote counts, to refute the stolen-election clichés and lies.

The effort began in Arizona’s Pima County, home to Tucson, where White lives and had just lost the race for county recorder, the official who oversees its elections. For more than a decade, White had been tracking voter turnout for the Arizona Republican Party. He turned to two data sets: the county’s voter registration file and another county-generated list of everyone who voted. He wanted to see what had happened in his race and other contests, and to ensure that all voters were legal.

Ironically, White, who proudly describes himself as a Republican “data analyst,” knew exactly how to investigate the voter fraud accusations, which have been a GOP talking point for decades and used to fan ill will in elections where Republican candidates have lost. In late November 2020, White knew that Trump was lying about voter fraud in Arizona.

About two weeks after Election Day, Pima County released its canvass report—the official election results, including precinct-by-precinct subtotals in every contest. White used the records to map 2020’s voter turnout and saw a pattern: Republican voters were rejecting Trump. “I first started seeing this phenomenon of areas where Biden had won the precinct but there were more Republicans than Democrats in the precinct,” he recalled. “Then I did the same thing for Maricopa County [greater Phoenix]. This was all in mid-to-late November.”

White also looked at historic voter-turnout data. This wasn’t data that revealed voting patterns on individual ballots, which the Audit Guys got to later. White was looking for improbable voter turnout at the precinct level. He did not see anything abnormal as he parsed the precinct-level results, county voter registration files, and individual voter histories. White, of course, heard Trump’s overheated claims of illegal voting. Republicans he knew were reciting them.

A Cyber Ninjas contractor transports ballots at Veterans Memorial Coliseum on May 1.
Courtney Pedroza/Getty Images

“Being in the position that I have been in for a number of years [as a GOP data analyst], I am continually bombarded with these various conspiracies. And they don’t have much effect on me in any particular instance,” White recalled. “In this particular case, the narcissist tendencies of Donald Trump started coming to the fore. The [campaign’s postelection] lawsuits were getting filed, and I was watching the lawsuits and the court decisions throughout this whole period of time, up until March. People were making a lot of claims, but they were not substantiated. And here in Arizona, I was confident that we didn’t have the problems that were being claimed, and I was telling my party leadership the same thing. Now my party leadership, as it turns out, was not listening to me. But I was telling everybody that would listen what I was finding.”

White’s use of voter registration files and records of who had voted in November eventually became one evidence trail that the Audit Guys cited to refute claims of massive illegal voting. Basically, he paired every ballot cast with a legally registered voter. The exceptions were the handful of police, judges, and domestic abuse victims whose identities are kept confidential. This was how White showed that virtually all presidential election ballots were cast by legal voters.

What was notable about this line of inquiry was that it produced more easily understood evidence and explanations than the technicality-laced assurances by election officials that their voting systems were reliable. Moreover, the Audit Guys’ takeaways were based on public records.

Though White was delving into the arcane nuts and bolts of election procedure and data, his focus was not on defending that process, per se, as Arizona election officials did. Rather, he was carefully using hard data as the basis for clear explanations that appealed to common sense; explanations that he hoped would stand a better chance of being trusted by voters. “The secret to all of that is knowing what you want to get out of the data,” White said.

How They Debunked Trump’s Lies

After Trump’s failed lawsuits, the Capitol riot, and Biden’s inauguration, Trump and his allies found a new strategy to keep attacking the election. They launched legislative probes that were not bound by the courts’ rules of evidence, where claims must be proven by demonstrable facts or attorneys could be sanctioned or disbarred. (Both occurred with Trump’s lawyers.)

As Arizona emerged as the epicenter of post-2020 reviews, White wanted to examine another public record: the much more detailed countywide database of every vote cast on every ballot. Unlike the county canvass report’s subtotals of precinct-level results, this larger database would allow him to detect voting patterns on individual ballots.

“I was able to look at it [the canvass] on a win-loss basis in a precinct, but I was not able to identify this ballot as a Republican voter or a Democrat because I can’t tie a ballot to a voter registration record,” he explained. “But when I looked at [each ballot to see] if they’re voting for Republican candidates, you can say they’re Republican-supportive voters independent of what political party they’re aligned with.”

In other words, this data set would find otherwise loyal Republicans who rejected Trump. “We got started in early March,” Moore recounted during the MIT webcast. “Benny gave me a call and said, ‘You want to have some fun with this [cast-vote record] and trying to debunk disinformation?’ And I said, ‘Absolutely,’ and then it turned out that CVR was really a monster data file. And I brought in my former CTO [Tim Halvorsen], who really knows his stuff in this area. And we whipped that into shape in about a week.”

In Maricopa County, the voting system can produce a database report that contains every vote on every ballot, which is what Moore is referring to. However, this overall report is not initially in a format that average voters can open and read on their laptops.

Maricopa County residents cast 2.1 million ballots in fall 2020. It is the nation’s second-largest election jurisdiction after Los Angeles County. Its cast-vote record was organized into ballot inventory files (called the manifest) and 10,341 batches (each containing about 200 ballots). Halvorsen, in a process familiar to computer scientists, converted the data (in JSON format) to a mySQL database. “When it is fully up on mySQL, it’s running right around 40 gigabytes,” Moore said. “Think of it as 2.1 million rows and about 800 columns and lots of indices [how votes were tallied].”

Moore reminded the MIT audience that the cast-vote record could reveal if voters had split their votes between different parties’ candidates. “The cast-vote record, for those of you familiar with it, is the only election artifact coming out of the voting system that tells you how people didn’t vote. And that turns out to be key,” he said. “We wanted to find out who voted for these down-ballot [Republican] candidates but didn’t vote for Trump. And, by the way, which of those did vote for Biden.”

The Audit Guys knew what to look for and began sorting and sifting through the data. “We created out of the cast-vote record—I think this will be very familiar to political scientists—a synthetic variable called ‘disaffected Republican supportive voters,’ which is simply defined as those voters who voted for a majority of down-ballot Republican candidates,” Moore said. “And in Maricopa, there were 15 candidates … and they voted for eight or more of those. But they didn’t vote for Trump.”

Moore and Halvorsen quickly found tens of thousands of Republicans who had rejected Trump. White then identified where those voters lived, using precinct-mapping software. “In Maricopa County, there were 59,800 of these folks that were evenly spread out through the mapping data,” Moore said. “And there were 39,102 of the 59,800 who voted for Biden.… And that number, to put it in context, the 39,102, is 3.7 times the winning margin [10,457 votes] that Biden had statewide.”

“Let that sink in,” Moore continued. “Republicans, heavily Republican-leaning voters, voted against Trump at what turned out to be an overwhelming margin. That’s one of the reasons why he lost. There’s a lot of reasons why they did that. But this is just the raw data, brought to life, in such a way that political scientists can now say, with much more definitiveness, ‘Where were these guys [voters] located? What were their average median incomes?’ etc.”

Maricopa County is no different from any other election jurisdiction in that this database of all votes cast on each ballot is the basis for what officials call the canvass—or the certified results. The deadline for finalizing election results varies among states. In Arizona, the canvass must be done within 20 days of an election, meaning the database the Audit Guys analyzed in March 2021 could have been used in November 2020 to show that greater Phoenix’s Republicans had rejected Trump in sufficient numbers to cost him the election.

In November 2020, White saw the pattern of loyal Republicans rejecting Trump and voting for Biden. But it was not until March 2021 that he, assisted by Moore and Halvorsen, had the cast-vote record and ran the analytics that confirmed the voting patterns behind Trump’s loss. As Moore said when concluding his talk, imagine if the press, political parties, and public had seen this evidence trail and disaffected Republicans had been interviewed in mid-November.

No Machine Errors, No Staff Collusion, No Dead Voters

Instead, the absence of easily understood explanations was filled by yet more election-theft conspiracies impugning election officials. The Trumpers were claiming that local officials had siphoned away votes. The Audit Guys also used the cast-vote record to refute that attack.

That accusation typifies a frequent tactic among 2020’s election deniers: finding and hyping an irrelevant statistic as the basis for a conspiracy theory. Maricopa County’s 2020 fall ballots had numerous contests on them—from the presidency to local offices. The Trumpers, correctly, noted that 235,000 ballots had sloppily marked ovals that had been examined by officials to determine the voter’s intent in that race. That review process is called adjudication.

The Trumpers cited the volume of adjudicated votes to claim that the election results could not be trusted. They further said that the adjudication process hid massive ballot-box stuffing.

It turns out that Maricopa County’s voting system, made by Dominion, is very precise and accurate, and the adjudication records affirmed that. If the cast-vote record is the finish line of counting votes, the starting line begins with the marking of a paper ballot and the tabulation system’s initial assignment of votes. This process involves another detailed data set.

After a voter marks a paper ballot with a pen, it goes through a scanner that reads the ballot. The scanner creates a digital image of each side of every ballot card. Software then detects the ballot style, which is all of the races on that voter’s ballot. The software then correlates filled-in ovals with the candidates and questions. If an oval is sloppily marked—say it is not filled in or an ‘X’ is there—or if a voter has voted more than once in a contest, Dominion’s system sets aside that ballot for adjudication. That means county election staff must electronically review the ballot image to determine the voter’s intent. The cast-vote record includes notes on why every adjudicated ballot was flagged and how that voter’s intent was resolved.

“Trump alleged that the [county] staff split the vote to Biden,” Moore said. “In reality, there were 235,000 votes that had to be adjudicated, but only 11,900 were in the presidential race. And 68 percent of those were adjudicating write-ins [for candidates not on the ballot]. So when you break it down and explain it, it is perfectly plausible why this happened. And by the way, Biden eked out a mere 533-vote difference between he and Trump [among the adjudicated ballots]. This was a nothing burger.”

The cast-vote record offered more proof that this line of attack was another lie. It had no inordinate volume of ballots with only Biden votes. The Audit Guys saw that there were only 3,024 ballots with one vote on it for Biden and another 3,474 ballots with only one vote on it for Trump. Their August report noted that there were still other ballot inventory records—again, public documents—such as the number of requests for mailed-out ballots and number of returned ballots, which would have surfaced any illegality. “One cannot simply dump extra ballots into the system; they are too easily detected,” their report said.

A Template for 2022 and 2024

One might ask, why aren’t election officials—or others who work in campaigns and elections—using public records to offer quick and readily understood explanations in high-stakes races?

The answer is layered. Some officials are partisans, whether elected or appointed, and do not see a need for greater transparency—especially if their side wins. Among civil servants, there is an ethic of not wanting to take sides, and often an aversion to having outsiders peer over their shoulders. That’s because elections will almost always be beset by small human or technical errors, which partisans or critics tend to blow out of proportion.

As a result, election officials often cite technical protocols that attest to their voting system’s reliability, which is akin to “Trust us. We’re experts.” Those protocols may be accurate, but most do not track legal voters, ballot inventories, and every vote. Thus, election professionals have not swayed average voters, as the numerous polls showing that majorities of Republicans believe Trump and his enablers attest. Officials also are busy after Election Day, and many do not welcome the added work of producing and presenting public data sets. Further, some officials argue that key data sets, such as digital ballot images, are not public records.

Hovering above these reasons is a larger hurdle. Providing the public with easily understood evidence to trust election results has not been a priority of election insiders. The profession has been more focused on cybersecurity since 2016—in response to Russian meddling—than on countering domestic disinformation coming from a former president and his party. Officials know that disinformation is undermining their work and public confidence in American democracy. But the latest advice given in government journals, policy think tanks, and academic research omits using public data in a focused way to debunk and confront election-theft narratives.

A handful of states and counties are exceptions. Maryland double-checks all of its preliminary results—every vote in every race—before certifying winners. It counts the votes recorded on the digital image of every paper ballot card, which is the first electronic file that is created by vote-count scanners after a voter has turned in their ballot. Florida, a Republican-run state, is now finalizing rules to use digital ballot images in recounts. (The images would be created by a second scan of every paper ballot by an independent system.) That process could become pivotal if its 2022 midterms and 2024 presidential race are close.

As a way to build trust in elections, both states are using a visual technology, invented by Audit Guy Moore, that lets nontechnical people “see” voters’ intent. In short, a viewable library of the most sloppily marked ballots in every race is created, which lets candidates and voters see the most questionable ballots and, if needed, retrieve them for examination. In Florida, where this technology was piloted, its reputation rose among election officials after disproving voter fraud allegations in a county sheriff’s race where the losing candidate had sued. Of course, in a presidential race, the right-wing media would dispute such results and feature “experts” making much ado about irrelevant or false matters. But I have seen this process convince Democratic and Republican candidates to accept results and not to file for recounts.

But it may be that election officials are not best suited for convincing the public that election results can be trusted. That task, the Audit Guys’ White believes, belongs with the political parties, campaign consultants, and academia. Election officials, in contrast, simply need to provide the public records promptly and in uniform data formats. Again, any such process will still be savagely contentious, particularly if Trump is the 2024 GOP nominee and is behind. But at least the competing factions would be working from the same records and data sets—unlike 2021’s Trumpers, who sought to fabricate vote-count evidence and hyped irrelevant data.

“I don’t put the responsibility to do all that stuff on election officials,” White said. “They need to defend their work. That’s obvious. But there are other entities that are better suited to do the analysis: either political parties, or campaign consultants, or even university political science people. They ought to be able to dig into this stuff and teach their students how to do it.”

White raises an intriguing point. The voter-centric data that he uses is already used by political parties and campaign consultants to turn out voters; it’s just not used to debunk voter fraud claims. Moreover, computer scientists say there is nothing especially difficult about parsing election data, although one has to know what one is looking for and be patient and careful.

“There are lots of details to be careful about. But it’s not rocket science,” said Duncan Buell, who recently retired from the Computer Science and Engineering Department at the University of South Carolina. Buell was a county election official and has spent years parsing election data in his state, as well as Pennsylvania, Kansas, North Carolina, and Texas. “It’s a little tedious, like keeping track of all one’s charitable contributions for tax purposes, but it’s not intellectually much more difficult than that. One sums the rows in a spreadsheet, and the columns in a spreadsheet, and verifies that the number in the bottom right-hand corner comes out the same both ways.”

Buell said working with cast-vote record files involved writing and testing scripts for small searches before querying the entire database. “It’s necessary to be careful developing code using small data subsets, and one has to be careful with the big data set, because it’s not possible to know what is really in the data,” he said in an email. “We test, and test, and test again, and we always accept a certain level of skepticism about whether we might have made mistakes and have to refine our analysis yet further.”

But Buell agreed with White that third-party involvement was important for voter confidence. He cited Carolyn Crnich, who ran elections in Humboldt County, California, saying, “I don’t like saying to my constituents, ‘Hey, just trust me.’” Buell believed that his analyses have helped boost public confidence and similar analyses can help throughout the country.

“It’s not that the election officials can’t be trusted,” he said. “I know lots of election officials, and I was one for two years before moving out of South Carolina, but it helps that an outside entity can reproduce the results.”

In early January, Maricopa County, which is run by moderate Republicans, issued its final report debunking dozens of accusations by the state Senate’s pro-Trump contractors. While the report was dismissed by the Arizona GOP chairwoman and ignored by the Senate president, it built on the Audit Guys’ strategy of using public records to debunk and confront 2020’s propagandists. In other words, at a time when many analysts are warning that battleground states are heading toward partisan civil war, the Audit Guys have created a template that may help save our democracy. And at least in Arizona, some responsible Republicans are paying attention.