Arizona Attorney General Implored to Count the Suspect Pima Ballots

The following letter, sent by attorney William J. Risner to Arizona Attorney General Terry Goddard, sets forth the facts in the suspect 2006 Pima County special transit bond election and the ensuing 3-year history of investigation and coverup. 

EDA investigators John Brakey and Jim March discovered evidence of election tampering while examining audit log records for that election.  Their discovery led to further investigation, a court case resulting in the largest release of electronic election data in U.S. history.  Risner has represented plaintiffs in the Pima RTA election case, including the Democratic Party of Pima County, who continue to press for a full and public resolution of the 2006 RTA election controversies.


February 18, 2009

Attorney General Terry Goddard
Office of the Attorney General
1275 West Washington Street
Phoenix, AZ 85007

Dear Mr. Goddard:

An article in the Arizona Daily Star last week (February 13) reported that your office expected to complete its investigation of the May 16, 2006 RTA election in Pima County within the month. [1]

The presumed goal of your investigation was to learn if the RTA election was criminally “rigged” or “fixed” by Bryan Crane on the instructions of his Pima County “bosses” so as to defraud the public of an honest election. We assume that an alleged crime of that importance would have resulted in an intense inquiry focused on whether or not the crime occurred. As you are aware, the Pima County Democratic Party has been engaged in a similar inquiry. Our goal is different than your goal. Your job is to learn whether a crime occurred and, if so, to prosecute the offenders. Our party's responsibility is to ensure that ballots are properly handled and counted.[2]

In other words, we are assigned the task by state law to watch and monitor the actual voting and counting. You have repeatedly said that such election monitoring is not part of the responsibilities of your office. The Secretary of State has said that it has no jurisdiction to examine computer databases to see if any of the various county boards of supervisors or their election personnel are cheating. You both agree that the responsibility for such monitoring is with political parties. We do not entirely agree with your and the secretary of state's legal analysis, but we do accept it as well as accept our responsibility.

On October 2, 2008 I wrote a letter to John Evans at your Tucson office concerning the open criminal investigation you had assigned to them.[3] That letter offered to share the expert skills of persons assisting the Pima County Democratic Party's efforts to ensure that our elections will be honestly conducted. We have several knowledgeable persons who have been looking at the RTA election and could have assisted your office. We never received a response to our offer. It could be that our knowledge and expertise was not needed or desired by your office.

Frankly, we may have helpful information and we would like to share some of it in this letter. Our information mostly relates to facts. Candidly, however, your public remarks suggest that you not see your office's role or authority as we do. The Pima County Democratic Party has not requested a “recount” of the RTA election as that term is used in the statutes. We have suggested that the simple solution to determining whether an election has been criminally rigged is to examine the ballots themselves. That was our suggestion last year and the suggestion of the first national expert contacted by your office. Such an examination of the ballots is not as complicated as you might think. I would like to share some of my experience in a similar effort.

In 1997 an election was held by the City of Tucson for one-half of their council seats. Two citizens, John Kromko and Leo Pilachowski, noted results in some precincts that seemed impossible, in their view. As I recall, some precincts had unusually high under-votes, with perhaps as much as a 40% undervotes. They knew the computer-counted results were highly likely not to be correct, but they didn't know why.

We immediately filed a lawsuit requesting that the court take control of the ballots and the computer software. Upon learning of our intention to file a lawsuit, the City filed its own lawsuit requesting the court's assistance. At our initial court appearance, my clients and the City agreed that we would hand count one precinct that we selected and see what we could learn about the accuracy of the reported vote. The subsequent hand-count of that precinct resulted in a second order to hand count the entire city election. The full hand-count showed that there had not been any criminal manipulation or computer election-rigging. The problem concerned defective paper. The hand-count recorded some 9,000 votes that had not originally been counted. No election was reversed because the paper problem was random and not the result of criminal manipulation. All parties were satisfied that the integrity of that election had been confirmed by the hand-count.

That experience confirms that a ballot examination need not be a complicated matter and that it can benefit the public by providing assurance that ballots are accurately counted. Your press statement used the word “curious” in describing requests that your office subpoena and examine RTA ballots to see if the election had been rigged. We view such an examination as the most basic investigative tool available to your office. Curiosity is a good trait in any real investigation, but the goal remains as one to determine whether a crime occurred. The use of an investigative subpoena to acquire and examine documents for evidence of a crime is normal in any white collar crime investigation in your office. You need neither court approval nor probable cause for such a subpoena. Those are routine matters in your office, as you well know.

Since your office has chosen not to use a simple and routine tool to answer the question of whether the RTA was fixed, we may be able to assist your investigation by sharing the results of our investigation. The Democratic Party cannot issue a grand jury subpoena for the ballots like the Attorney General can. We must investigate the hard way by accumulating circumstantial evidence. We can report that, so far, all the circumstantial evidence is consistent with the election having been rigged. We would like to share with you our approach, our results, and where we are headed next.

For us, the question to be answered is whether the RTA was rigged. You alone can answer that question. The Democratic Party can show that it was probably rigged, but we cannot, at this point, be sure. The Democratic Party has alleged in court that there is substantial and credible evidence that it was rigged. We do not know if that is so and only a ballot count can definitively answer that question. Your investigation was prompted by the sworn declaration of Mr. Zbignew Osmolski that he had been told by Pima County's election computer operator, Bryan Crane, that he had “fixed” the election at the instruction of his Pima County bosses. His declaration constitutes direct evidence that a crime occurred. [4]

The Democratic Party has ended up examining the RTA election by an indirect route. In December of 2006 the Pima County Democratic Party requested a copy of the county's election electronic database, since it is a public record. We wanted a copy primarily as an exercise of our election-monitoring responsibilities. To our great surprise, Pima County required us to sue. A unanimous formal resolution of all the elected Democratic Party precinct committee members at the bi-annual organizing meeting was not sufficient to avoid a lawsuit.

Approximately one million dollars and more than one year later, Judge Michael Miller of the Pima County Superior Court ordered the County to provide us with a copy of the database. The singular most shocking aspect of that litigation was that Pima County's election division did not offer a factual defense. The election division relied on the testimony of John Moffatt, who claimed that his “number one fear” was that the Pima County Democratic Party might issue fake written reports after an election that would differ from the County's data and ballots, differ from the Republican Party's copy of the same data, and differ from the Libertarian Party and Green Party's data.[8]

The issuance of a faked report by the largest and oldest political party in Pima County is inconceivable. It would promptly be exposed as a fraud and the reputation of all persons who participated, as well as the party's reputation, would be ruined. Political parties simply do no operate that way. Persons who volunteer their unpaid time through political parties to improve our society don't operate that way. Judge Miller noted that such a false report would be a felony under Arizona law. In short, the defense was delusional or, more correctly, it confirmed that they did not have a factual defense.

Our only rational conclusion was that they had something to hide and we concluded that the “something” was the RTA election that had been zealously pushed by the county administration after having been overwhelmingly rejected by voters on four prior occasions. The evidence suggests to us that the County election department may have cheated, utilizing at least two techniques. One of those techniques is known as a “flip.” The computer could have been instructed to count “no” votes as “yes” votes.

Your office earlier hired the iBeta corporation to examine the database itself for evidence of a flip. In conducting that investigation, you permitted the suspects themselves to suggest the tests that should be utilized. The iBeta report shows that John Moffatt suggested most of the tests and that his explanations were accepted without question.[9] My letter to you of July 14, 2008 pointed out many failures of the iBeta examination that your office permitted the suspects to control.

A “flip” can be discovered by examining the ballot layout and imbedded counting instructions contained in an electronic copy that is sent by all Arizona jurisdictions to the Arizona Secretary of State's office. As part of our discovery process, we learned that the Secretary of State's office has never looked at such data that is sent to them.[5] We were not surprised to learn that they did not examine the submitted data, since copies are sent to them to use in fraud investigations and there had not been any. What did surprise us was that the Secretary of State had never returned such tapes to Pima County. They had simply remained on the shelf along with similar submissions from other counties.[6]

The first time that such tapes were returned was after the RTA election in November of 2006, and after the Democratic Party began asking the County for public records relating to elections. You might want to inquire of the Secretary of State's office what prompted them to return the RTA tape to Pima County. The first and only time the Secretary of State returned the computer data to Pima County required a box, as multiple election tapes from several years were returned, including the critical RTA tape.[10]

The box containing the RTA tape was personally handed by Pima County Election Division's boss, Brad Nelson, to its election division computer operator, Bryan Crane. All the other tapes were still in the opened box when the Democratic Party examined its contents, but the RTA tape disappeared after being placed in Mr. Crane's custody. Mr. Nelson is one of the “bosses” that may have told Bryan Crane to fix the election. The disappearance of that tape has foreclosed a definitive computer data comparison that could have revealed whether the election manipulation utilized a “flip.”

There are other ways in which a flip could be accomplished in GEMS, however, that do not involve the ballot definition tables. Votes can be flipped in the vote summary tables and discovering a flip there without examining ballots is close to impossible. A flip is a crude tool. It is simple to accomplish with GEMS, however. All a computer operator needs to do is to take a copy of the election database home and, utilizing his home computer, he can instruct the computer to read all “no” votes as “yes” votes. When that one change is reintroduced into the computer, GEMS will automatically flip all precinct counts and thereafter all “no” votes will be counted as “yes” votes. The machine will always behave as instructed. (How to flip documents) [11]

Such a crude tool is problematic in a bond election, because historical patterns will show that some precincts in Pima County always vote in favor of bonds, and some precincts regularly vote against bonds. Simply reversing the outcome of the election could be exposed by noting that the always-approving precincts rejected the bonds and the never-approving precincts passed them. Therefore, if a bond election is to be rigged, a more sophisticated approach would have to be utilized.

In our lawsuit discovery, we learned that Pima County administrator Chuck Huckelberry arranged for his special assistant, James Barry, to be awarded a $35,000.00 contract to create a database analysis of all recent Pima County bond elections by precinct. [12] That special contract started the day after Mr. Barry retired and was to be carried out as orally instructed by Mr. Huckelberry. The contract was extended and Mr. Barry ultimately was paid $75,000.00. During his pre-trial deposition, Mr. Barry said that he still had that data on his personal computer, but agreed that it was public information. We have since mailed two separate public records requests to both Pima County and Mr. Barry, neither of which have provided the requested public record data. Perhaps your office has had better luck obtaining that information during your investigation.

Detailed precinct information would be useful in programming the Diebold “memory cards” that record all the precinct-cast votes. Each precinct in Pima County counts ballots with a Diebold Corporation optical scan device. The cast ballots have their votes recorded on a memory card. At the close of the election, the optical scan device is turned off and the vote results are printed out for each precinct. The printed results are termed poll tapes,” as they contain the poll results and look somewhat like an adding machine tape.

The “poll tape” is then personally signed by three poll workers and the results of that precinct are publicly available. The electronic data in the memory card is downloaded into GEMS for the purpose of the eventual canvass. The poll tape is used to compare with the canvass as a check on accuracy. Unfortunately, the Diebold memory cards can be rigged to produce false results and those false results are then printed on the poll tape and downloaded into GEMS.

As you can see, the ability to falsely program a memory card is a very big problem and one that cannot be detected by simply comparing the poll tape numbers with the canvass numbers. The HBO documentary “Hacking Democracy” presented to the nation a videotaped segment where Finnish computer expert Harri Hursti demonstrated that a Diebold optical scan memory card could be programmed to produce false results, and those false results could then be downloaded into GEMS without detection.[13] In cooperation with a national election integrity group of concerned citizens known as Black Box Voting, Mr. Hursti and the group published a report on July 4, 2005 alerting all jurisdictions that use the Diebold memory cards that they could be maliciously programmed.[14]. In order to program the memory cards, Mr. Hursti purchased a “read-write” device sold by an agricultural supply company, Cropscanner, Inc. They sell the devices, known as “cropscanners,” to farmers who want to know when to irrigate their corn crops.

Less than two weeks after the publication of Harri Hursti's report, Bryan Crane and Pima County bought one of those programming machines.[15] The ordinary and approved programming of memory cards is done by GEMS itself. The cropscanner can also program the same memory cards, but it requires some practice. Harri Hursti programmed his test card by attributing “negative votes” to one candidate. He was able to do so because the memory cards contain interpretive code that can be modified using the “hack tool” Pima County bought. [16]

After Bryan Crane received the cropscanner Pima County purchased for him, he practiced with it to learn if he could program it to print out false results. He learned he could do so and that it was not particularly difficult. He has testified that anyone with good computer skills could do so. Bryan Crane testified that while he could program the card to produce false results, he could not get GEMS to accept those false results. As Mr. Crane relates his tale, he was able to disprove what Harri Hursti demonstrated in the movie for everyone to see and thereby disproved the report alerting the nation's election departments to the problem.

In fact, the Federal Election Commission (FEC) itself alerted the nation's election departments to this same problem. Crane's claim of disproving the defect was not published or passed on to anyone else, according to his testimony. He did not alert the FEC, Black Box Voting, Mr. Hursti, or anyone involved in the elections to his claimed results. The veracity of Mr. Crane's discovery can thus be questioned, but his practice with the hack tool cannot be doubted.

The Pima County Democratic Party made two separate requests of Beth Ford for access to the original RTA poll tapes that are now in her control and custody. When she refused to cooperate, we filed a lawsuit that is now pending before Judge Javier Chon-Lopez of the Pima County Superior Court. We want to examine the original signed poll tapes for several reasons. Harri Hursti noted that while the memory cards could be programmed, it was tricky and required skill. The original tapes can be examined for clues that they were maliciously programmed. Harri Hursti and Black Box Voting will assist the Democratic Party in examining those poll tapes for discrepancies that might otherwise escape notice yet would be evidence of false programming.

In addition to Pima County's purchase and Bryan Crane's practice, there is considerable circumstantial evidence that the memory cards may have been programmed by the cropscanner. The delicate requirements of false programming may result in the cards appearing defective and not operating properly at the polls. The existence of memory card “failures” is an indication of false programming because the normal GEMS programming is nearly always successful. For example, during the 2004 General Election (with a complicated ballot with Initiatives and a full slate of candidates) there were only four reported memory card “failures” in Pima County and only one memory card had to be loaded after election night.

For the RTA, however, there were massive reported memory card failures. As soon as the media, Ted Downing, and the Democratic Party County Chair Donna Branch-Gilby left the ballot-counting observation area (around 10:15 p.m.) fifty-three memory cards were reloaded. The deletion and reloading of that data continued until 3:14 a.m. The next morning at 9:47 a.m. one more precinct was deleted and reloaded. On May 19, 2006 eight more precincts were deleted and reloaded. On May 20, 2006 twenty-three more precinct results were deleted and reloaded. Since, contrary to normal practice, the election operator did not make a data backup on election night nor for the next two days, we can't see in the recorded data what they were doing.

However, on the 19 of May, we can see what they were doing by comparing the databases from the 19th and the 20th. We can see that they were altering the vote totals. If GEMS had been used to program the cards there should not have been so many failures. Frankly, whether an examination of the poll tapes would reveal their false programming is a long shot. We can be assured, however, that there are a number of errors that need to be understood. It is vitally important for the future to understand errors so they can be prevented. You can't prevent without knowing. Therefore, there is important value in examining the accuracy of the system. It is particularly important concerning Pima County's Diebold/Premier system.

Incidentally, the same software is used in eleven other Arizona counties. That software is well-known for being easy to rig, as your office learned. The iBeta report that your office and the “suspects” at Pima County jointly paid for said. [16] During testing it was discovered that the GEMS software exhibits fundamental security flaws that make definitive validation of the data impossible due to the use of data and log manipulation from outside the EMS software itself.

Judge Michael Miller noted the problems with GEMS, which is built on the base of a common consumer product known as Microsoft Access. The Microsoft Corporation itself specifically advises customers not to use that product for such jobs as complicated elections because the software's “jet engine” can become confused.

During last fall's General Election, a group of citizen election integrity voters in Humboldt County, California, working with that county's election department in a collaboration known as the Transparency Project, examined their election results and found that 197 paper ballots – representing a batch of votes – were deleted from the count because of an error within GEMS.[17] The Diebold/Premier company claimed it knew of the programming defect but had not told the California election officials. It was discovered by the citizens who had scanned all the ballots in cooperation with the county. Without their examination, the extra ballots would not have been otherwise discovered, as the GEMS system was factory-programmed to delete any sign that the ballots had ever been recorded.

Election officials in the state of Ohio recently discovered another Diebold programming error that resulted in lost paper ballots. The company at first denied, but later agreed, that the software “glitch” existed. The state of Ohio has now sued Diebold/Premier because of their defective product. [18] The existence of known GEMS errors creates a reason for the Democratic Party to examine closely the reported results from the RTA.

Our examination of the electronic database has pointed out that there are “errors” that must be examined and understood. At the present time there is an unusual “consensus” in this community that the RTA ballots should be counted through the supervision of your office. Included in those desiring that the ballots be counted may be Bryan Crane who, if innocent of wrong-doing, would want his name cleared. Deputy Pima County attorney Thomas Denker made such a plea to Judge Michael Miller in his closing argument in the database case. Here is what Denker said. [19] That in the process of doing these things that have already been done in this case, decent, honest, hard-working people, servants of the public, have had their name dragged through the mud and they've been insulted; they've been defamed; they've been slandered, and it is a disgrace what has happened to these people. They never get thanked. Mr. Crane, you saw him. You examined him for a long time, Your Honor. You saw what kind of man he is. You saw what kind of character he has. Did all of his testimony help us? No, but I think you can tell that he's an honest, decent, hard-working guy and he takes a lot of pride in his system and in what he does, and he doesn't get thanked. It's a shame that that's irrelevant to this case, because it probably means he's never going to have a chance to have his name cleared in public. So, I just want to say, speaking just for me, that at least today, I'd like it on the record that Pima County is lucky to have a man like him on our payroll. That's all I have.

Those are serious sentiments that the Democratic Party takes seriously. We are not comfortable with our conclusion that the election may have been rigged by Bryan Crane without his being able to clear his name. A ballot examination would serve that purpose. Your statement to the press reflected your awareness that the Pima County Board of Supervisors, the Regional Transportation Authority (RTA) and local political parties, with the singular exception of the Republican Party, want the RTA ballots examined. All of those groups want the ballots examined not because of “curiosity,” but because such an examination would resolve the criminal allegations. It is your job to resolve the criminal allegations. Therefore, all of those persons and groups are asking your office to do its job.

Our analysis of the RTA election database showed that a large number of precincts had their memory cards downloaded twice. The cards were downloaded on election day, and then a second time up to three days later. In order to do a second download the computer operator had to manually delete the original reported precinct vote totals from the database, then re-read the memory card. It is important to note that those double-downloads changed the number of ballots counted and the number of votes for every candidate and issue on the ballot. The fact that this was not discovered during the iBeta study shows they didn't even do the obvious comparisons.

Even if you just look at the summary reports for each day, you can see that the number of blank-voted ballots for a couple of the races decreases between successive databases. This is a red flag that wasn't investigated. One of the reasons that we want to examine the poll tapes is to compare the signed tapes with the original numbers with the subsequently downloaded results.

Several election computer experts, including Dr. Tom Ryan, Jim March, John Brakey and Michael Duniho have noted and questioned the RTA vote counting, as revealed in the databases. Dr. Ryan, Michael Duniho and Jim March are all currently members of the Pima County Election Integrity Commission that has formally requested the Pima County explain odd vote results such as vote totals going backward and ballots disappearing, which should be impossible.[20] The Commission has allowed Pima County sixty days to provide an explanation. We suppose they are working on it. John Moffatt had previously said he could not offer an explanation because Chuck Huckelberry did not want him to do so while your office's criminal investigation was pending. In other words, the county is taking the Fifth until the coast is clear.

The Democratic Party expects to be able to access the poll tapes in the coming weeks. We, of course, need to get these before Beth Ford, the Pima County Treasurer, destroys the ballots. We are concerned about the retrieval process itself; however, because we want to make sure that the evidence is not contaminated. Since your office is conducting your own investigation, we invite you to participate in the poll tape retrieval. Your participation would serve to preserve the integrity of that evidence, should it ultimately be needed.

As you can see, the Democratic Party's attempt to learn the truth is complicated and expensive for our party. We must essentially beat around the bush when it is your job and sworn duty to resolve the question of criminality. You can look at the ballots and we cannot. You can easily answer the question while we can only suggest the likely answer. As Michael Shamos, a nationally known voting systems expert at Carnegie Mellon University,[21] wrote to John Evans of your office: “Ultimately, the proof of the pudding is in the ballots.[22]” His was the first expert opinion your office sought. All of our experts are in agreement with Mr. Shamos.

Actually, we believe we will eventually be able to examine the ballots after we appeal the trail court's refusal to exercise its equity jurisdiction. That ultimate result might be next year during your race for Governor. The public needs to know the answer sooner than next year, however. Your office's participation in these matters would also help to secure evidence that is now in a private warehouse that may not be secure. Pima County officials, the suspects in any crime, have already demonstrated their brazen disregard for evidence that was supposed to be secure.

After Judge Miller ruled that the Democratic Party could obtain from the Pima County Superior Court Clerk's office vault its copy of the database, John Moffatt simply walked into the clerk's office and picked up our hard drive and walked out with it.[23] It was a supreme exercise in hubris. The hard drive was in a sealed box the top of which was entirely covered by a court order that had been taped to the top of the box. The court order instructed the clerk of the court that the box could only be released pursuant to a specific court order in the future. Mr. Moffatt presented no court order and was not required to sign a receipt. They simply handed it to him on request and he carried the box out of the vault to Chuck Huckelberry's office.

In view of the importance of the ballots as the evidence of the possible crime, we request your office help secure that evidence. Since you have said in your press release that you will terminate your investigation next month and ours will continue until we learn the truth, please accept this letter as our formal public record request for your investigative files. You apparently won't need them and we will. It looks from the outside like you have investigated Mr. Osmolski but not the suspects. We may be wrong, but that is how it appears. In any event, your investigation may assist us in carrying out our responsibilities.



William J. Risner

Risner & Graham


URLs in this post:

[1] Arizona Daily Star, AZ, Feb 12, 2009 “Goddard: Recount for 'curiosity' not allowed”:

[2] Bill Risner opening statement in trial that explains how political parties are responsibility is to ensure that election are properly handled and counted as defined in Arizona Constitution:

[3] On October 2, 2008 letter to John Evans at AG Tucson office concerning the open criminal investigation you had assigned to them:

[4] Sworn declaration of Mr. Zbignew Osmolski:

[5] John Moffatt Video from trial:

[6] The iBeta report with notes from Jim March and John Brakey:

[7] Secretary of State's office Joseph Kanefield never looked at such data:

[8] Video 4/21/08 KOLD TV By Bud Foster: “Who Checks the Vote Counters?” NOT the Secretary of State! Not the Attorney General! Not the County!"

[9] Tucson Citizen, 12/6/07: Record of votes in '06 RTA election missing: Tape may confirm whether results were altered
[10] AUDITAZ, simple ways on how to flip a Diebold Election:

[11] Chuck Huckelberry arranged $70,000 on James Barry's services alone in analyzing four prior bond and tax elections, by precinct. He also was paid $13,000 by the Yes for RTA Committee. 11 minutes:

[12] HBO documentary “Hacking Democracy (the Pima County Way):

[13] Black Box Voting Harri Hursti's report July 2005:

[14] Bryan Crane and Pima County purchased cropscanner:

[15] Crop scanner “hacking tool” Pima County bought:

[16] Ibeta report:

[17] Humboldt County, California examined their election results:

[18] Ohio Sues Diebold/Premiere Over Lost E-Voting Votes:

[19] Here is what Denker said, video link:

[20] Report by Tom Ryan, PhD, on RTA Anomalies, Submitted to Pima County Election Integrity Commission on 1/28/09:

[21] Resume of Michael Ian Shamos:

[22] Letter from Michael Shamos, nationally known voting systems expert at Carnegie Mellon University, to John Evans of the AG's office:

[23] Video of John Moffatt walking into the court clerk's office and removing the sequestered hard drive bearing plaintiff's evidence in the RTA case:

[24] Previous letter from attorney Bill Risner, July 14 2008, to Attorney General Terry Goddard explaining why he should investigate Pima County's 2006 RTA election:

[25] Deposition of Bryan Crane by attorney Bill Risner, on vote flipping, Pima County Election Trial (11 minutes):



Pt1_Database_Password.pdf724.68 KB
Pt2_Flip_a_Diebold_Election.pdf752.82 KB
Pt3_Criminal_Investigation_RTA.pdf18.28 KB